For all of P3P s complexity, it can not stand alone, either in reality or in user perception. All users know that a protocol like P3P is a promise that may not be kept. Therefore internal processes are required at a fulfillment level. Authentication of the web site operator Web sites can misrepresent their policies. Web sites can make false promises of how they will use the personal information collected from users.
Web sites can misrepresent themselves.
Companies with less integrity may claim erroneously to be another company altogether, or a subsidiary of a different company. P3P does not provide for secure means to store information. Web sites can request additional pieces of information. It is possible that many web sites will request additional items, and thus inundate the user with many prompts to fill in such information. There is no regulation as to this process, but again, it is in the best interest of web sites not to needlessly trouble the user, because the user ultimately may choose not to use P3P at all.