What Is P3P (Privacy Preferences Platform)?

Trying to monitor and protect your online privacy is a challenge. Websites aren't always forthcoming with their policies and may classify things differently. Wish it were simpler? P3P did too.

What was P3P? 

P3P stands for Platform for Privacy Preferences Project. It was a project by the World Wide Web Consortium (W3C), which aims to help consumers manage their privacy while navigating websites with differing privacy policies (i.e., what information is collected, what duration is set, among others). The idea was that users could set their privacy preferences in their P3P-enabled browsers.

Before a user loaded a site, the browser's P3P agent would check the privacy policy of the website being loaded. If the site fell within the user's preset privacy settings, the site loaded automatically. If the site's privacy policy didn't match the user's settings, the user was prompted with a warning and needed to accept proceeding manually. 

Critics of P3P noted that it offered weak protection against the highly evolving pace of website content, only a small fraction of websites complied with P3P, and websites had no legal compulsion to enforce their privacy policies. In essence, the P3P, its critics charged, was a well-intentioned failure — a toothless tiger.

Who created P3P?

Privacy Preferences Platform (P3P) was set up by the World Wide Web Consortium (W3C), the international governing body that sets up standards for the Internet. W3C established P3P standards to help users protect their privacy using the Internet.

P3P addressed consumer concerns about the type and number of data gathered by websites. At its core, P3P charged that any website collecting user information should clearly declare the reasons for the data collection, how it plans to use the information, and how long it will retain the information.

Then, a P3P-compliant website could display its privacy policies to users who use browsers with the P3P feature. The P3P-compliant browser would automatically accept or deny cookies or bypass the site based on the user's settings. The user received an alert and could override the previously set privacy level.

Why was P3P created?

P3P was established to provide Internet users with a sense of privacy when surfing the web. More importantly, the failed initiative hoped to empower users to take control of their digital data. 

P3P started to allay consumer concerns about the amount of data collected by websites. The idea was that any site gathering information about its users should state why it wants the information and how long the information will be retained. For example: "We are monitoring these pages to improve site usability," or "We want to make our advertising more relevant." A user visiting a site with a P3P policy had access to its privacy policies and could decide whether or not to accept cookies or use that website at all.

How do P3P privacy controls work?

Theoretically, P3P enabled you to control (at the browser level) how websites used information about your visit.

The dream was for mass users to set privacy preferences in their browsers before they even began to surf the internet. As you download web pages, a P3P-enabled server could send the content to your browser together with a privacy policy that your browser can automatically read. Before your browser could display the page, your privacy preferences had to align with the site's. If the website collected more data than you preferred, then you'd be alerted so that you could decide whether to proceed or not. 

For a more detailed explanation of this well-intended project, check out W3C's website.