22. Does P3P solve all privacy concerns on the Web?

No. P3P focuses on the disclosure of web site privacy practices. Its goal is to help users find out what the privacy practices of a particular site are, and how these practices compare with the user's preferences. P3P does not solve all privacy issues, but it can be part of a larger, more comprehensive set of technical and legal solutions.

23. Does P3P eliminate the need for other technologies like encryption or anonymizers?

Definitely not. In fact, P3P focuses on doing one thing and doing it well: communicating to users, in a simple and understandable way, web sites' stated privacy policies. Consequently, we defer to others tasks such as encrypting or anonymizing electronic communications. P3P is meant to be complementary to such technologies. For instance, users must be able to express preferences such that, "I will only give my credit card information to sites over a secured communication channel such as SSL or SET." We don't attempt to reinvent anonymizers, encryption or payment protocols, but we expect P3P will be able to work with all of these things.

24. Does P3P prevent secondary use of data?

Here are some of the principal flaws in the concept of P3P.

1.      The concept presumes that privacy is a preference that some technologically advanced minority might be granted an opportunity to avoid having violated on occasions where those people have taken a specific action designated by the companies who wish to exploit personal information. Rather, privacy is a fundamental human right that should be universally expected.

2.      The concept presumes consumers have an extremely diverse range of "privacy preferences" that should be catered to with a correspondingly wide range of options, like flavors of soft drinks. Rather, the core of consumers' desires for privacy are simple and easily stated, but unpalatable for marketers: consumers don't want their personal information sold, shared, or reused for secondary purposes. The fact that some are willing to grant specific consent for certain uses doesn't mean that they wish to make an open offer of their privacy. A bewildering range of options tends to to distract consumers and policymakers from the sad fact that what should be standard equipment is hard to find or entirely absent.

3.      The concept's premise promotes the view that personal information is a secondary currency or commodity to be bartered rather than a necessary detail for performing some part of the transaction, such as delivering the ordered goods by mail. Rather than the fake-privacy doctrine of "notice and choice," which in practice means burdening the consumer with understanding complex details and attempting to opt-out of some of them, real privacy consists of limiting the use of information to what is needed, always with the explicit consent and understanding of the consumer.

4.      There is a presumption that access should be focused on a company's policy instead of access by individual consumers to information held by the company about them. Rather, a consumer should be able to assume that the company's policy is to treat her data fairly; what she then needs is to be given access to all her specific data so that she can check that it is being correctly handled in practice. She should be able to check that her understanding of what information the company should have about her corresponds with what is actually held, and amend it if not. Granted, P3P does offer a way for a site to say whether it grants access, but stops there. Standards such as the now-moribund Open Profiling Standard can be quickly recognized as marketing mechanisms rather than privacy standards by the fact that the flow of personal information is unidirectional: from the consumer to the company.

5.      The political environment surrounding the development of P3P promotes the erroneous belief that Internet privacy is something terribly complex and remote from "offline" privacy, and that technology will eventually solve the problem if given time, making legal rights and enforcement mechanisms unnecessary. Rather, the core privacy issues are identical online and offline; online consumers are more aware of the risks, so companies have been forced to give it more attention. Further, no amount of technology can ever make up for the lack of enforceable privacy rights held by the American citizen.

6.      Perhaps the most implausible premise is the view that a high level of privacy will eventually be achieved if software makers and ecommerce sites agree on a standard that (after an even longer time, as software is upgraded) might be adopted by a sufficiently large percentage of consumers, thus expressing through the market and technology an economic demand for privacy. Believing this process will succeed in protecting privacy is as naive as hoping that environmental protection would be well served by having Exxon and GM draw up standards for emission control, and by the auto industry providing consumers the opportunity to vote on these standards by checking boxes on postcards made available to them at gas stations and automobile showrooms. Rather, technologists should take as their point of departure the strong privacy rights that are being mandated by an increasing number of legislatures, and develop technology that will efficiently and effectively serve people exercising those rights.

7.      There is an unspoken assumption that as soon as a highly technical language is provided for codifying privacy policies, then marketers will offer good policies in this language. Rather, a simple argument will prove that P3P will never provide the majority with any real privacy protection or even useful guidance. Under the banner of "policy-neutral language," P3P is simply deferring the difficult decision of what the minimum acceptable standard should be. As a thought-experiment, suppose that some time in the 21st century, the P3P language is finalized and the software ready. A decision will have to be made on the defaults, designating the minimum expectation that surfers should have before the browser raises alerts on visiting a substandard site. (For P3P to have any widespread effect, it would have to be pre-installed in both major browsers, and there would have to be some such default below which an alarm is raised.) This entails a large number of questions to which no consensus answer is ever likely to be found. Should the consumer be alerted if a site's policy:

1.      says it might sell names if the consumer doesn't separately opt out?

2.      doesn't provide access to the data held by the company about the person?

3.      applies its web site privacy policy only to information gathered on the web?

and a hundred other questions like these. It will take at least until the 22nd century for marketers to agree to defaults that are anywhere near the levels that consumers or privacy experts would want. And who would be making the decision on whether this technology and its defaults goes into browsers? Microsoft and AOL/Netscape control more than 90% of the market. Do these companies have a history of choosing privacy-friendly defaults, such as those for cookies? No. Do these companies have a history of placing the privacy of consumers above the commercial interest of themselves and their marketing partners? No. Would they install defaults that alarm prospective purchasers unless stated privacy standards are higher than what they currently offer? Very unlikely. If you disagree, why not issue a public challenge to AOL, Microsoft and other sponsors of P3P and the Direct Marketing Association to propose default settings that they consider would be acceptable. If you receive no satisfactory response, take this as an admission that your project has been used as a pawn in a cynical campaign against privacy. If you receive a sensible response, present it to consumers and consumer advocates and ask whether they consider them acceptable. This exercise is unlikely to succeed in gaining a consensus, and you might as well find out whether it can before going to the mighty effort of finalizing the specification and implementing it.