delivery2 will depend on the implementations. There are a wide variety of implementation styles, and it is unclear how the products will work. Part of it will be driven by consumer demand. Survey after survey has documented enormous public concern with privacy and a real anxiety about disclosing personal information, because people feel that Web sites are not forthright about what they do with data.

A tool that allows people to gain better knowledge about how the data are used certainly may allow more personalization. Some people will choose personalization because they are comfortable having certain types of data collected; if data collection and the personalization it enables are done with the individual’s consent, it will advance privacy protection. If a Web site offers the news or sports scores, you might be comfortable telling it which state or county you live in, or your zip code, because the site provides a service that you think is worthwhile. But today you might be anxious about what the site does with the data. If there were a technical platform that allowed you to know ahead of time that only things you were comfortable with would be done with your data, then certainly it might facilitate personalization. But it would be personalization based on your privacy concerns and your consent to the data collection.

With regard to the truth of a site’s privacy statements, the question of bad actors is one that we have in every context. There is nothing about P3P that provides enforcement, but it does provide for some transparency, which could facilitate enforcement. In this country, people who say something in commerce that is designed to inform consumers run the risk of an enforcement action by the FTC or a state attorney general if they fail to do what they’ve said. In other countries, there are similar laws prohibiting deceptive trade practices, and, in addition, many countries have laws that require businesses to adhere to a set of fair information practices designed to protect privacy. Collaborative filtering—a process that automates the process of “word-of-mouth” recommendations by developing responses to search queries based on the likes and dislikes of others who share interests, buying habits, or another trait with the searcher—is independent of P3P. I have not seen a discussion of its applicability in the privacy area.


Bob Schloss gave the hypothetical example of Sports Illustrated warning that some of its content shows people in skimpy bathing suits, and a user agent (or client) saying it does not want to see sites like this. Sports Illustrated could offer to present a subset of its content honoring the request. But why would the magazine go through such complex programming if only 10 people had user agents that could negotiate? To what extent would there be negotiations in which a site would either collect data or provide a subset of its function without collecting data?

The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement