2.4.3 The "Safe Zone"

P3P defines a special set of "safe zone" practices, which SHOULD be used by all P3P-enabled user agent and services for the communications which take place as part of fetching a P3P policy or policy reference file. In particular, requests to the well-known location for policy reference files SHOULD be covered by these "safe zone" practices. Communications covered by the safe zone practices SHOULD have only minimal data collection, and any data that is collected is used only in non-identifiable ways.

To support this safe zone, P3P user agents SHOULD suppress the transmission of data unnecessary for the purpose of finding a site's policy until the policy has been fetched. Therefore safe-zone practices for user agents include the following requirements:

• User agents SHOULD NOT send the HTTP Referer header in the safe zone
• User agents SHOULD NOT accept cookies from safe-zone requests
• User agents MAY also wish to refrain from sending user agent information or cookies accepted in a previous session on safe zone requests
• User agent implementors need to be aware that there is a privacy trade-off with using the Accept-Language HTTP header in the safe zone. Sending the correct Accept-Language header will allow fetching a P3P policy in the user's preferred natural language (if available), but does expose a certain amount of information about the identity of the user. User agents MAY wish to allow users to decide when these headers should be sent.

Safe-zone practices for servers include the following requirements:

• Servers SHOULD NOT require the receipt of an HTTP Referer header, cookies, user agent information, or other information unnecessary for responding to requests in the safe zone
• If the communications is taking place over a secure connection (such as SSL), then the server SHOULD NOT require an identity certificate from the user agent for safe zone requests
• In addition, servers SHOULD NOT use in an identifiable way any information collected while serving a safe zone request

Note that the safe zone requirements do not say that sites cannot keep identifiable information -- only that they SHOULD NOT use in an identifiable way any information collected while serving a policy file. Tracking down the source of a denial of service attack, for example, would be a legitimate reason to use this information and ignore this recommendation.