Privacy Preferences Policy Control

Privacy Preferences Policy Control, P3P for short, is a technical standard from the year 2002. It was meant to get websites to publish their privacy policies in a fixed, machine-readable form — that is, in a way that not only humans could read, but also a program. A user’s browser would then have been able to automatically check what data a website collects, and would have blocked the page if necessary. P3P was developed by the World Wide Web Consortium, the international body that sets many web standards. In practice, however, the approach failed — today P3P no longer plays any role.

The problem P3P was meant to solve

In the late 1990s, the web was growing rapidly, and with it concern about privacy. Websites collected data about visitors, but privacy policies were long texts that hardly anyone read. Users had no practical way to quickly recognize what was happening with their data.

P3P was meant to solve this problem technically: instead of relying on the voluntary reading of privacy texts, the browser was supposed to take over this check automatically. The goal was to turn privacy from a manual decision into an automatic process. Users would have set their preferences once — for example, “I do not allow my email address to be shared” — and the browser would have measured every visited page against that.

How P3P was technically structured

A website that supported P3P deposited a special XML file — XML is a format that stores information in clearly structured tags, similar to labels in a filing cabinet. This file described, in fixed categories, what data is collected, for what purpose, and whether it is shared. The browser could automatically retrieve this file and compare it with the stored user settings.

Microsoft built P3P support into Internet Explorer 6, which was released in 2001. However, the browser used P3P data only for a very limited function: it used it to decide whether a website was allowed to set so-called third-party cookies — small text files with which ad networks track browsing behavior. For this purpose P3P worked technically, but that was far less than originally planned.

A fundamental problem was that P3P was based on self-declaration. A website could state in its P3P file that it does not share data, and still do so anyway. There was no technical verification of the truth, only a formal declaration. This made the standard susceptible to abuse — and indeed, some web developers created P3P files with fabricated or meaningless content, just to bypass Internet Explorer’s cookie filter.

P3P in the history of privacy

Today P3P is mainly known as a textbook example: a well-intentioned standard that failed in the face of the web’s reality. The major browsers Chrome, Firefox, and Safari never seriously supported P3P. Microsoft declared the standard obsolete along with the end of Internet Explorer. The W3C officially discontinued further development in 2018.

However, the idea behind P3P lives on. The European General Data Protection Regulation, GDPR for short, which has been in effect since 2018, pursues a related goal: it legally obligates websites to transparently inform users about data processing and to obtain their consent. Today this usually happens via cookie banners, which everyone knows. However, this process does not run automatically and invisibly on a technical level — which was precisely P3P’s original dream.

In research on the so-called privacy-by-design idea — that is, the approach of building privacy into technology from the start instead of adding it on afterward — P3P is regularly cited as an early attempt that shows how difficult it is to automate privacy.