A Protocol to Protect Privacy.

Five Democratic Congressmen recently introduced a resolution recognizing the importance of an online privacy standard called P3P, or the Platform for Privacy Preferences. P3P is "an immediate way to address consumer concerns without onerous regulation," according to a statement by Congressman Adam Smith (D-WA), one of the sponsors of the resolution.

There are two essential components of P3P. Web sites must have machine-readable privacy policies in place, and Web browsers must support the protocol. Both components are now becoming more commonplace.

To make a site P3P compliant, a privacy policy statement is created in the machine-readable code of a Web site. This statement can be read by browsers that support P3P, including the recently released Internet Explorer 6.0. Users answer multiple-choice questions to configure their browsers to determine how much--if any--personal information they wish to share with the sites visited. Depending on the user's preferences, some or all cookies can be blocked.

P3P was developed by the World Wide Web Consortium several years ago. It has been getting positive reviews not only from Washington but also from businesses and privacy groups. Ari Schwartz, senior policy analyst at the Center for Democracy and Technology, a group promoting online privacy, praised the proposal.

"I think that P3P is moving in the right direction," he says. "We've been supportive of it from the beginning and are still supportive." He is critical of Microsoft's limited use of P3P in its new browser, though. "The Microsoft implementation for Explorer, which is probably the most important implementation, is in our view very incremental," dealing mostly with cookies, not a full range of privacy concerns.

Jules Polonetsky, chief privacy officer for online advertiser DoubleClick, is a member of the group that has been developing P3P specifications. He says that P3P will help users make privacy decisions. "One criticism of privacy policies has always been that they're hard to read, difficult to access, and need to be checked often because they're subject to change," he says. "P3P goes a long way towards addressing those concerns.

However, he warns that many businesses may be surprised to find that Internet Explorer 6.0 treats some of its cookies as though they belonged to third parties, because of the way their domains are structured. At its default setting, the browser automatically blocks all third-party cookies if the setter of the cookie doesn't deliver along with the cookie a compact policy that describes the cookie's intent.

"If a bank has a personal sign-on or online payment page, they consider themselves first party, but they're third party to each other because they're different domains," Polonetsky says. He adds that even domestic sites that are linked to sites in foreign countries (such as example.com and example.fr, in France) will be treated as third parties to each other.

Ari Schwartz says that the weakest point of the protocol is likely to be consumer awareness and that consumer education needs to be increased dramatically for [P.sub.3]P to be effective. But over time the protocol may prove a valuable tool for ensuring data privacy.