12

Google and Facebook authentication both have fake P3P policies in the HTTP headers that link to a webpage that explains why they don't support it:

  • CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

  • CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"

Considering that companies listed above are in the business of collecting PII information for social networking I'm not sure I want to believe their claims. Also note that I can't find a similar invalid P3P policy in Yahoo's or Microsoft's website, I'm not sure who to believe.

Are Google and Facebook giving out bad advice, saying that this is an outdated technology? (perhaps to protect their own self-interests)

If the technology really is outdated, are there legal ramifications of having a "fake" P3P policy to allow cross domain cookies in IE?

Should anyone support P3P policies at all (given that they may be in fact outdated)

Are they legally binding?

Improve this question
1

3 Answers 3

Reset to default
10

I agree with most of the previous responses, but note that the FB and Google compact policies might be considered fraudulent due to the fact that they omit P3P elements and the way the P3P syntax is defined, omitting an element is an affirmative statement that you do not do the practice represented by that element. (See for example section 3.3.4 of the P3P spec: "Service providers MUST disclose all that apply. If a service provider does not disclose that a data element will be used for a given purpose, that is a representation that data will not be used for that purpose.") Also, the policies might be considered deceptive since an IE user might rely on IE to block cookies from websites without CPs and these CPs are designed to evade IE's blocking. However, I am not a lawyer.

There is a class action lawsuit pending against Amazon on a similar matter http://www.infolawgroup.com/tags/p3p/

And there is a relevant research paper at http://www.cylab.cmu.edu/research/techreports/2010/tr_cylab10014.html

Improve this answer
7

Note that according to the P3P Compact Policy spec, the "P3P policies" presented by Facebook and Google aren't actually fraudulent, but syntactically invalid: they don't contain any of the allowable P3P elements; what they do contain is pretty much garbage from the parser's point of view. IIRC, a browser should treat this like a "null/undefined" P3P policy.

They would be fraudulent if they actually contained factually incorrect P3P elements (e.g. NOI - "Web Site does not collected identified data."). This is not the case here.

Note also that P3P policy is a way of expressing a privacy policy (P3P is a subset of all possible ways to express a privacy policy); lack of P3P doesn't imply a lack of any privacy policy.

Improve this answer
2
  • This is actually a statement by omission-- the omission of the tags and the lack of the OTP tag means they're claiming that the cookie isn't being used for any purpose.
    – EricLaw
    Feb 21, 2012 at 1:37
  • @EricLaw -MSFT-: Good point on the OTher Purposes token; but would a P3P: CP="OTP" be sufficient for a CP? (It would definitely awaken the Eye of Sauron, but that's a slightly different issue. (Also, incidentally, it's quite interesting to see the echoes of the current MSFT x GOOG battle ripple into SE))
    – Piskvor left the building
    Feb 21, 2012 at 17:16
4

Whether P3P serves a beneficial purpose is a subjective question that is open to debate. My personal opinion is that it probably does not, but others may reasonably disagree.

One of the primary reasons why many sites declare P3P policies is because IE by default will allow third-party cookies for sites that do declare a P3P policy. This leads to problematic incentives, where sites copy-and-paste a P3P policy without understanding what it means. A P3P policy is supposed to be a statement of the site's privacy practices; but often it is not treated that way, it is just copy-pasted to make IE accept third-party cookies. This is an abuse of P3P, but it is widespread. To their credit, Google and Facebook have avoided the temptation to do so. Good for them.

Are there legal ramifications? I don't know. As far as I know, the law is not settled. However, in the US the Federal Trade Commission (FTC) has jurisdiction. They have authority to file suit against any company that engages in "unfair or deceptive trade practices", and they have repeatedly done so. It is generally accepted that if a web site declares a privacy policy, but then fails to comply with their declared privacy policy, then they are engaged in unfair or deceptive trade practices and the FTC has regulatory authority to file suit against the company. The FTC has done so multiple times, and has won. A P3P policy is basically a form of declared privacy policy. Therefore, I believe a company is taking on some legal risk if it declares a P3P policy that it does not comply with. I would not encourage any company to do so, without consulting with legal experts to understand the ramifications.

Apart from the legal ramifications, personally I would consider it abusive, improper, and deceptive for a site to declare a P3P policy that it has no intention of complying with. If I discovered that a site I frequented had done so, they would lose my trust, and I would re-consider my relationship with them. In other words, beyond the legal risk, there is also brand/reputational risk associated with violating your own declared P3P policies.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .