Wirtschaftsuniversität Wien Magisterarbeit - SemanticLab

The P3P1.1 specification defines the syntax and semantics of P3P privacy
policies, and the mechanisms for associating policies with Web resources.
P3P policies consist of statements made using the P3P vocabulary for expressing
privacy practices. P3P policies also reference elements of the P3P
base data schema – a standard set of data elements that all P3P user agents
should be aware of. The P3P specification includes a mechanism for defining
new data elements and data sets, and a simple mechanism that allows for
extensions to the P3P vocabulary.
P3P has two goals: First, it wants to empower websites to provide their privacy policy
in a standardized, machine-readable way. Second, it wants users to understand which
data is collected by websites and in what different ways this data will be used. More
importantly, users should be able to decide whether they want to disclose specific data
or not. That is, websites should be able to provide information on collected data and
reasons why they actually collect that data - but in a way that these reasons can be
automatically matched to the users’ preferences.
To make this happen, the P3P specification defines ways and methodologies to perform
this task. Two important factors are policy reference files and P3P policies. These
policies describe websites’ privacy policies in a machine-readable way. This can be done
by using predefined vocabulary to describe privacy policies in place (via P3P policies
using the P3P XML schema), using a predefined schema for data a website may wish
to collect (the P3P Base Data Schema) and by applying methods to associate privacy
policies to websites, cookies and other content (by using policy reference files).
3.1.2. Requirements
As every other standard, P3P specifies some requirements which need to be fulfilled to
successfully implement P3P on a website and in user-agents. P3P is based on XML-files,
therefore, the basic requirement is that all P3P related XML-files must be well-formed 1 .
Besides this requirement one of the most important specifications is the way the location
of policy reference files is indicated. This is due to the fact that user-agents depend on
the policy reference file to be able find and parse the P3P policies of websites and hence
compare them with users’ privacy settings. According to the P3P specification there are
four mechanisms to indicate the location of a privacy policy reference file:
1. “Well-known location” method
2. HTTP header
3. HTML link tag
4. XHTML link tag
1 W3C provides a P3P validator to validate P3P policies which can be found at
http://www.w3.org/P3P/validator.html. However, as of the time of writing, the validator
was not operational
19