False Start on Guarding Privacy
The Internet industry’s answer to growing consumer concerns over privacy online is a new technology dubbed the Platform for Privacy Preferences Project, or P3P. The White House hails it as the best thing short of legislation, but many consumers rightly are skeptical. P3P does go some distance toward protecting consumers from uncontrolled snooping by Web site operators. But the system has major flaws and clearly does not solve all consumer privacy worries. Further, the initiative has no teeth and is so complex that it may even induce people to disclose more information than they otherwise might. It also gives consumers no power over the use of their personal data once it is disclosed.
More than three years in development, P3P is a software technology that, when adopted by both the user and the Web site, allows Internet surfers to decide what information they want to keep private and, in simple language, tells them how sites they visit use information about them. Presumably, should visitors decline to part with the information that a Web site demands, they would not be allowed to enter.
Notification that a Web site is snooping--this usually is done by planting electronic tracking codes called cookies on the user’s hard drive--is a substantial improvement on the current practice. Privacy policies today often are complex legal documents designed to hide, rather than highlight, the fact that a Web site is ferreting out loads of a user’s personal data.
But does software that merely tells a visitor that the site is demanding personal information--and making its disclosure the price of entry--protect consumer privacy? Not really. It does not set standards that discourage the invasion of privacy. It makes the consumer believe that users and not the Web sites are responsible for providing privacy protection. As Marc Rotenberg, head of the Electronic Privacy Protection Center, put it, P3P “is not a technology for privacy protection; it’s actually designed to facilitate data collection.”
Though consumers would be offered some choice, they would have no control other than simply not visiting a Web site. Moreover, privacy protection is not only a technological problem. It must be part of an enforceable system. P3P is purely voluntary; Web sites can simply disregard it by declining to install the necessary coding. The argument that operators would be forced by market pressures to adopt P3P is not persuasive. Companies offer very little privacy protection now and have spent far more money lobbying against privacy protection rules than in developing new technology to offer protection voluntarily.
The Federal Trade Commission is seeking legislative authority to draw up enforceable Internet privacy protection rules. P3P does not obviate the need for such rules.
