Privacy Negotiations with P3P

This paper examines how negotiation techniques can resolve the trade-off between service providers’ personalization efforts and users’ individual privacy concerns and demonstrates how they can be integrated into existing technologies to overcome the shortcomings of static privacy policies. The analysis includes the identification of relevant and negotiable privacy dimensions. An extension to P3P is proposed that allows a simple expression and implementation of negotiation processes. Support for this extension has been developed for the Mozilla Web browser. INTRODUCTION The Web’s complexity both in size and diversity has led online retailers to offer their customers individually targeted products and services. Personalization efforts have been implemented in the vast majority of popular sites. Their inherent need for personal information and the long-time storage of these data drew attention to the induced privacy issues. Still, the Privacy-Personalization trade-off is only one example for increased awareness of privacy issues. Personal identifiable information is collected during almost every Web interaction. The obvious need for better communication of the data handling procedures in place gave rise to several technical approaches both in research and in practice – with notable involvement of W3C’s Platform for Privacy Preferences (P3P) initiative. These technologies can be classified according to the market structure and the targeted transaction phase, while abstracting from further explanation in the light of this Workshop’s expert audience: (a) Service providers publish P3P Policies that are retrieved by a user agent (UA) acting on the user’s behalf. (b) The UA checks if the P3P Policy is compatible with the user’s privacy preferences. Latter can be coded using the privacy preference languages APPEL [18] or XPref [2]. (c) Intraand inter-organizational guidelines governing the handling of collected data can be expressed using EPAL [6]. The depicted set of existing privacy languages are evidence that the design of privacy technologies has extent beyond user-facing front-ends. Yet, the initially agreed upon privacy policy between a service provider and its customers (whether this policy is textual or a P3P privacy policy) will govern all subsequent data flows. Yet these privacy policies are usually static and all customers are offered the same privacy settings regardless their individual privacy preferences. A privacy-focused “meta-personalization” does not take place. Posting “privacy policies” on websites is a rigid approach and hampers users providing an informed consent as the compensation for data disclosure is not apparent. The empirical proof of users’ stated privacy preferences diverging from their actual behaviour is a symptom of this burden [14]. Our contribution is to depict how negotiation techniques can overcome current drawbacks of static privacy policies, and reconcile privacy and personalization. We investigate how negotiations can be implemented using existing technologies, namely P3P. The implementation of PRINT by extending W3C’s Platform for Privacy Preferences (P3P) is soundly explained and detailed information is provided how language support for PRINT can be integrated in P3P in a straightforward way. RELATED WORK: EXISTING PRIVACY LANGUAGES P3P is an XML-based language developed by the World Wide Web Consortium (W3C) [21]. It became a recommendation in 2002 and aims “to inform Web users about the data-collection practices of Web sites” [22]. P3P has become widely adopted by service providers but it remains restricted to the “take-it-or-leave-it” principle: The service provider offers a privacy policy; the potential customer has to accept as a whole if she wants to use the service. A negotiation process between the involved parties is not intended. Although the first drafts of the P3P specification included multi-round negotiation mechanisms, these parts had been removed in favour of easy implementation and early and wide adoption of the protocol. The latest version of the P3P 1.1 specification [22] does not mention negotiations either. Still, a reintroduction has been discussed at the P3P Workshop in Kiel (2003) [19] and is planned for future versions of P3P [20]. The relevance and suitability of APPEL and XPref along with the role of the Enterprise Privacy Authorization Language (EPAL) have been developed in [9]. In summary, privacy preference languages are improper to implement 1 Meta-personalization describes personalization of the means and methods being used for the actual offerings’ personalization