Pass the P3P

Microsoft tosses new sliding-scale technology into the privacy ring

Microsoft plans to incorporate the World Wide Web Consortium (W3C)-developed Platform for Privacy Preferences (P3P) specification into its Internet Explorer 6 and Windows XP operating system, both available in fall 2001. P3P lets Internet surfers select levels of privacy protection in dealing with Web sites, and in particular with the sites' use of cookie files. But many analysts question whether P3P is sufficient to protect users' privacy and worry about possible Microsoft domination of Web privacy.

The privacy tools in Internet Explorer 6 will let people choose from five privacy level settings, according to their privacy preferences. With the sliding scale of protection levels, the tool provides consumers with information about the types of cookies used, where they originate, whether sites collect personally identifiable information, and whether collected information will have secondary uses; based on Web sites' XML-based P3P privacy policies.

However, some privacy advocates argue P3P leaves too many problems, such as the need for widespread Web site compliance with the standard and the potential frustration of users who are expected to understand the complexities of third-party cookies and opting out of ad network tracking. While some major Web sites are embracing Microsoft's plan, others are taking a wait-and-see stance.

Junkbusters President Jason Catlett, a longtime P3P critic, commented, "Microsoft's 'thermostat setting,' where surfers are required to tell their PCs how much they will tolerate being [under surveillance] gives a misleading and dangerous view of privacy. People shouldn't be forced to trade privacy for participation. People need legally guaranteed privacy rights to control the data collected about them."

Microsoft prefers to leave privacy decisions to individual users. "Rather than telling consumers what privacy level is right for them, we have provided a tool that will allow them to determine the appropriate level for themselves," said Tonya Klause, a Microsoft spokesperson. "We feel it shouldn't be up to the privacy advocates or Microsoft to make a blanket decision for consumers in every country." Klause added, "Microsoft remains cautious when it comes to additional regulation around privacy."

In addition, many find Microsoft's default setting too lenient - an important concern of critics who believe that the complexity of the system may leave many users with a de facto choice that doesn't meet their privacy needs. Microsoft officials said in a Wall Street Journal article (March 21, 2001) that default settings blocking most advertising and data collection activities are unrealistic. Furthermore, the higher levels of protection may disrupt rapid Web surfing, which would result in many users simply turning the tools off.

Other vendors are also readying or have available P3P-compliant products, such as IBM's P3P Policy Editor and YOUPowered Inc.'s Orby Privacy Plus. Data collection and advertising is big business, but perhaps privacy tools will be just as lucrative.

— Michelle Nichols

In this Issue: