An analysis of P3P-enabled web sites among top-20 search results

ABSTRACT

Search engines play an important role in helping users find desired content. With the increasing deployment of computer-readable privacy policies encoded using the standard W3C Platform for Privacy Preferences (P3P) format, search engines also have the potential to help users identify web sites that will respect their privacy needs. We conducted a study of the quantity and quality of P3P-encoded privacy policies associated with top-20 search results from three popular search engines. We built a P3P-enabled search engine and used it to gather statistics on P3P adoption as well as the privacy landscape of the Internet as a whole. This search engine makes use of a privacy policy cache that we designed to facilitate fast searches. Using a list of "typical" search terms taken from AOL users' queries, we examined the trends in privacy policies that are returned from queries to the AOL, Google, and Yahoo! search engines. We then compared these results to results compiled after using "e-commerce search terms" from Google's Froogle service. We examined the top 20 search results returned by each search engine for each of the search terms and found at least one result with a P3P policy for 83% of the typical search terms. Overall we found that these typical search terms yielded P3P adoption rates of 10%. This contrasts with adoption rates of 21% percent when searching for e-commerce terms. Examining the content of the policies, we discovered that a minority of sites engage in direct marketing with or without a way of opting out, and that even fewer sites share personal information with other companies. Finally, we outline ways to increase P3P adoption rates as well as decrease policy errors.

REFERENCES

• 1: Alessandro Acquisti, Privacy in electronic commerce and the economics of immediate gratification, Proceedings of the 5th ACM conference on Electronic commerce, May 17-20, 2004, New York, NY, USA [doi>10.1145/988772.988777]
• 2: W. Adkinson, J. Eisenbach, and T. Lenard. Privacy online: A report on the information practices and policies of commercial web sites. Technical report, Progress & Freedom Foundation, 2002. http://www.pff.org/publications/privacyonlinefinalael.pdf.
• 3: B. Bos, H. W. Lie, C. Lilley, and I. Jacobs. Cascading Style Sheets, level 2, CSS2 Specification, May 1998. http://www.w3.org/TR/REC-CSS2/.
• 4: Sergey Brin , Lawrence Page, The anatomy of a large-scale hypertextual Web search engine, Proceedings of the seventh international conference on World Wide Web 7, p.107-117, April 1998, Brisbane, Australia
• 5: E. Burns. Search increased in august, October 7, 2005. http://www.clickz.com/stats/sectors/search_tools/article.php/3554731.
• 6: Simon Byers , Lorrie Faith Cranor , David Kormann, Automated analysis of P3P-enabled Web sites, Proceedings of the 5th international conference on Electronic commerce, p.326-338, September 30-October 03, 2003, Pittsburgh, Pennsylvania [doi>10.1145/948005.948048]
• 7: CBS News. Poll: Privacy rights under attack. CBS News, October 2, 2005. http://www.cbsnews.com/stories/2005/09/30/opinion/polls/main894733.shtml.
• 8: L. Cranor, S. Byers, and D. Kormann. An Analysis of P3P Deployment on Commercial, Government, and Children's Web Sites as of May 2003. Technical report, AT&T Labs-Research, May 14, 2003.
• 9: L. Cranor, M. Langheinrich, and M. Marchiori. A P3P Preference Exchange Language 1.0 (APPEL1.0), April 2002. http://www.w3.org/TR/P3P-preferences/.
• 10: L. Cranor, M. Langheinrich, M. Marchiori, M. Presler-Marshall, and J. Reagle. The Platform for Privacy Preferences 1.0 (P3P1.0) Specification, April 2002. http://www.w3.org/TR/P3P/.
• 11: L. F. Cranor, S. Byers, D. Kormann, and P. McDaniel. Searching for Privacy: Design and Implementation of a P3P-Enabled Search Engine. In Proceedings of the 2004 Workshop on Privacy Enhancing Technologies (PET2004), May 26--26, 2004.
• 12: M. J. Culnan and G. R. Milne. The culnan-milne survey on consumers and online privacy notices, 2001. http://intra.som.umass.edu/georgemilne/pdf_files/culnan-milne.pdf.
• 13: Electronic Privacy Information Center (EPIC). Pretty Poor Privacy: An Assessment of P3P and Internet Privacy, June 2000. http://www.epic.org/reports/prettypoorprivacy.html.
• 14: Ernst & Young. P3P Dashboard Report. August 2002. http://www.ey.com/global/download.nsf/US/P3P_Dashboard_-_August_2002/$file/P3PDashboardAugust2002.pdf.
• 15: Ernst & Young. P3P Dashboard Report. January 2003. http://www.ey.com/global/download.nsf/US/P3P. _Dashboard_-_January_2003/$file/E&YP3PDashboardJan2003.pdf.
• 16: D. Fellows. Search Engine Users. January 23, 2005. http://www.pewinternet.org/pdfs/PIP_Searchengine_users.pdf.
• 17: S. Fortunato, A. Flammini, F. Menczer, and A. Vespignani. The egalitarian effect of search engines. Technical report, arXiv.org e-Print Archive, 2005. http://arxiv.org/pdf/cs.CY/0511005.
• 18: S. Fox, L. Rainie, J. Horrigan, A. Lenhart, T. Spooner, and C. Carter. Trust and privacy online: Why Americans want to rewrite the rules. August 20, 2000. http://www.pewinternet.org/pdfs/PIP_Trust_Privacy_Report.pdf.
• 19: Google, Inc. Froogle, 2005. http://froogle.google.com/.
• 20: E. Hargittai. The Changing Online Landscape: From Free-for-All To Commercial Gatekeeping. Community Practice in the Network Society: Local Actions/Global Interaction, pages 66--76, 2004. http://www.eszter.com/research/c03-onlinelandscape.html.
• 21: Harry Hochheiser, The platform for privacy preference as a social protocol: An examination within the U.S. policy context, ACM Transactions on Internet Technology (TOIT), v.2 n.4, p.276-306, November 2002 [doi>10.1145/604596.604598]
• 22: Y. Koike and S. Taiki. P3P Validator, January 29, 2002. http://www.w3.org/P3P/validator.html.
• 23: H. W. Lie and B. Bos. Cascading Style Sheets, level 1, December 1996. http://www.w3.org/TR/CSS1.
• 24: E. Meyer. What Makes CSS So Great?, July 21, 2000. http://www.oreillynet.com/pub/a/network/2000/07/21/magazine/css_intro.html.
• 25: D. Mulligan, A. Schwartz, A. Cavoukian, and M. Gurski. P3P and Privacy: An Update for the Privacy Community, March 28, 2000. http://www.cdt.org/privacy/pet/p3pprivacy.shtml.
• 26: Office of Management and Budget. About E-GOV, 2005. http://www.whitehouse.gov/omb/egov/g-4-act.html.
• 27: H. Taylor. Most People are "Privacy Pragmatists" Who, While Concerned about Privacy, Will Sometimes Trade It Off for Other Benefits. 17, 2003. http://www.harrisinteractive.com/harris_poll/index.asp?PID=365.
• 28: J. Turow. Americans and online privacy: The system is broken, 2003. http://www.asc.upenn.edu/usr/jturow/internet-privacy-report/36-page-turow-version-9.pdf.
• 29: U.S. Federal Trade Commission. How to comply with the children's online privacy protection rule. http://www.ftc.gov/bcp/conline/pubs/buspubs/coppa.htm.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Privacy

Additional Classification:
  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.3 Information Search and Retrieval

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce

Keywords:
P3P, e-commerce, privacy policies, search engines