Amending P3P for clearer privacy promises

Abstract

The Platform for Privacy Preferences (P3P) can be a viable tool for organizations to clarify their privacy promises. In this paper, we summarize our experiences and describe some of the problems we have encountered when using P3P. Our main criticisms on P3P are its complicated structure, ambiguities in the specification, and missing guidelines for user agents. We suggest several improvements such as an extended but simplified syntax and a revised consent model that groups opt-in/opt-out choices into one "consent block", which can be associated with multiple statements.