Web Privacy With P3P

This is the only book on the market that explains P3P-Platform for Privacy Preferences-the new specification from the World Wide Web Consortium (W3C) that is quickly becoming the standard for web site privacy policies. Under increasing pressure from users, corporations and other organizations are adopting the P3P protocol for their web sites so that browsers on the user end will automatically understand their privacy practices. Web Privacy with P3P lets web developers know how to configure a site for P3P compliance. Many people other than web developers will be interested in this new book. Privacy consultants, corporate decision-makers, lawyers, public policy-makers, developers of P3P software products, and any individual interested in online privacy issues will want to understand the P3P protocol and how web sites can be configured to comply with it. Because the chair of W3C's P3P Specification Working Group wrote the book, Web Privacy with P3P goes right to source.

Dr. Lorrie Faith Cranor is a principal technical staff member in the Secure Systems Research Department at AT&T Labs-Research Shannon Laboratory in Florham Park, New Jersey. She is chair of the Platform for Privacy Preferences Project (P3P) Specification Working Group at the World Wide Web Consortium. Her research has focused on a variety of areas where technology and policy issues interact, including online privacy, electronic voting, and spam. Dr. Cranor plays the tenor saxophone in the Chatham Community Band. She spends most of her free time with her husband, Chuck, and her son, Shane, but sometimes she finds time to design and create quilts.

Foreword

xi

Preface

xv

Part I. Privacy and P3P

Introduction to P3P

3

(9)

How P3P Works

4

(5)

P3P-Enabling a Web Site

9

(1)

Why Web Sites Adopt P3P

9

(3)

The Online Privacy Landscape

12

(18)

Online Privacy Concerns

12

(10)

Fair Information Practice Principles

22

(2)

Privacy Laws

24

(3)

Privacy Seals

27

(1)

Chief Privacy Officers

28

(1)

Privacy-Related Organizations

29

(1)

Privacy Technology

30

(13)

Encryption Tools

31

(5)

Anonymity and Pseudonymity Tools

36

(4)

Filters

40

(1)

Identity-Management Tools

41

(1)

Other Tools

41

(2)

P3P History

43

(18)

The Origin of the Idea

43

(2)

The Internet Privacy Working Group

45

(1)

W3C Launches the P3P Project

46

(1)

The Evolving P3P Specification

47

(4)

The Patent Issue

51

(1)

Feedback from Europe

52

(1)

Finishing the Specification

53

(2)

Legal Implications

55

(1)

Criticism

56

(5)

Part II. P3P-Enabling Your Web Site

Overview and Options

61

(20)

P3P-Enabled Web Site Components

61

(2)

P3P Development Steps

63

(2)

Creating a Privacy Policy

65

(3)

Analyzing the Use of Cookies and Third-Party Content

68

(5)

One Policy or Many?

73

(1)

Generating a P3P Policy and Policy Reference File

74

(1)

Helping User Agents Find Your Policy Reference File

75

(1)

Combination Files

76

(1)

Compact Policies

77

(1)

The Safe Zone

78

(1)

Testing Your Web Site

79

(2)

P3P Policy Syntax

81

(29)

XML Syntax

81

(1)

General Assertions

82

(7)

Data-Specific Assertions

89

(15)

The P3P Extension Mechanism

104

(3)

The Policy File

107

(3)

Creating P3P Policies

110

(23)

Gathering Information About Your Site's Data Practices

110

(11)

Turning the Information You Gathered into a P3P Policy

121

(7)

Writing a Compact Policy

128

(3)

Avoiding Common Pitfalls

131

(2)

Creating and Referencing Policy Reference Files

133

(20)

Creating a Policy Reference File

133

(11)

Referencing a Policy Reference File

144

(5)

P3P Policies in Policy Reference Files

149

(1)

Changing Your P3P Policy or Policy Reference File

150

(1)

Avoiding Common Pitfalls

151

(2)

Data Schemas

153

(17)

Sets, Elements, and Structures

153

(1)

Fixed and Variable Categories

154

(1)

P3P Base Data Schema

154

(10)

Writing a P3P Data Schema

164

(6)

P3P-Enabled Web Site Examples

170

(21)

Simple Sites

170

(9)

Third-Party Agents

179

(1)

Third Parties with Their Own Policies

180

(1)

Examples From Real Web Sites

180

(11)

Part III. P3P Software and Design

P3P Vocabulary Design Issues

191

(12)

Rating Systems and Vocabularies

191

(4)

P3P Vocabulary Terms

195

(6)

What's Not in the P3P Vocabulary

201

(2)

P3P User Agents and Other Tools

203

(11)

P3P User Agents

203

(4)

Other Types of P3P Tools

207

(3)

P3P Specification Compliance Requirements

210

(4)

A P3P Preference Exchange Language (APPEL)

214

(22)

APPEL Goals

214

(2)

APPEL Evaluator Engines

216

(1)

Writing APPEL Rule Sets

216

(9)

Processing APPEL Rules

225

(4)

Other Privacy Preference Languages

229

(7)

User Interface

236

(75)

Case Studies

236

(18)

Privacy Preference Settings

254

(5)

User Agent Behavior

259

(3)

Accessibility

262

(2)

Privacy

264

(5)

Part IV. Appendixes

A. P3P Policy and Policy Reference File Syntax Quick Reference

269

(15)

B. Configuring Web Servers to Include P3P Headers

284

(5)

C. P3P in IE6

289

(12)

D. How to Create a Customized Privacy Import File for IE6

301

(5)

E. P3P Guiding Principles

306

(5)

Index

311

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

Summary

Author Biography

Table of Contents

Supplemental Materials