AFFIRMATIVE-CONSUMER/INTERNET-INHERENCY 359

P3P APPROACH IN THE STATUS QUO FAILS

P3P WILL NOT BE SUIFFICIENT TO PROTECT PRIVACY

John J. Fried, The Ottawa Citizen, March 20, 2000, SECTION: High Tech Report; D3 TITLE: Privacy protection becoming a priority: A ubiquitous Internet threatens to snag more personal information // acs-VT2001

Richard Purcell, director of corporate privacy at Microsoft, does not believe that P3P's advent, probably later this year, will be enough.

Users will have to be educated about the privacy platform and the proper way to use it. Even then, some experts think, P3P will not help. Many users will not have the patience to configure their browser. Others will not understand how to set criteria to cover the dozens of ways information can be gathered by a Web site.

P3P HAS MANY FAILINGS AND FAULTS

SIMSON GARFINKEL The Boston Globe January 6, 2000, SECTION: BUSINESS; Pg. C4 TITLE: PLUGGED IN / PROTECTING YOUR PRIVACY CONCERNS ABOUT THIRD-PARTY MONITORING PUTTING A DAMPER ON E-COMMERCE // acs-EE2001

But not everybody thinks that P3P is the answer to the Internet's privacy dilemma. One problem with the system for automatically sending personal information to Web sites is that P3P makes it harder for users to provide false information, a technique used by many surfers to protect their privacy today. Another problem with P3P, as it is envisioned currently, is that it transmits a tremendous amount of personal information about the user to the Web site, but little information about the Web site is sent to the user to assist in making a privacy judgment.

"What type of business is it? Is it a private or a public company? Where is it incorporated? Is it a subsidiary of another company, and if so, which one? Unfortunately, P3P does not allow a user to ask any of these important questions," writes Christopher D. Hunter, a doctoral candidate at the Annenberg School for Communication, in an article he recently finished on the topic. The fundamental problem with P3P, argues Hunter, is that it does not ensure an individual's privacy, only "industry's view of privacy."

IN ORDER FOR THE P3P TO BE EFFECTIVE A LARGE NUMBER OF USERS WOULD HAVE TO USE IT, WHICH IS UNLIKELY

Neil Weinstock Netanel, Arnold, White & Durkee Centennial Professor of Law, University of Texas School of Law, March 2000; California Law Review, "Cyberspace Self-Governance: A Skeptical View from Liberal Democratic Theory," EE2001-hxm lxnx

If P3P works as its promoters claim, it might go a long way towards ameliorating Internet users' privacy concerns. But in order for P3P to be effective, a critical mass of users will have to use it. They will also have to insist upon bypassing web sites that either do not encode the site's privacy policies in P3P format or have onerous information practices. Without that critical mass, many commercial web site operators would no doubt prefer to lose the business of isolated P3P-armed customers than put at risk their lucrative trade in user data. Thus, especially given the imperfect substitutability of much Internet content, information asymmetries regarding personal data collection and aggregation, and the likelihood of oligopolistic producer market power as telecommunications mergers proceed apace, Internet users who wish to employ P3P will face a significant collective action problem. Unless a critical mass of additional users also employ P3P, the P3P pioneers will simply shut themselves out of most of the sites they want to visit. As a result, no one will employ P3P unless he can be assured that a critical mass of others will join him. n346

GOVERNMENT REGULATION IS KEY TO OVERCOMING THE COLLECTIVE ACTION PROBLEM THAT HINDERS P3P’S FROM WORKING

It seems likely that government regulation requiring or inducing web site operators (and other purveyors of Internet content and services) to implement P3P will be necessary to overcome this collective action problem. n347 Even if P3P encoding is universal, web site operators may still resist [*480] user privacy demands. But then users (or more precisely, their browsers) will have at least a greater awareness of site information practices and will be able to engage in transactions to pursue users' privacy preferences.

IF THE STATE ENACTED DEFAULT RULES FOR FAIR INFORMATION PRACTICES SITE OPERATORS WOULD IMPLEMENT P3P

n347. One way the state could induce site operators to implement P3P would be to enact default rules requiring a high standard of fair information practices. For a well-reasoned argument favoring such default rules, as well as mandatory rules regarding notice and an individual's right to inspect and correct personal data, see Schwartz, supra note 147, at 1670-79. See also Kang, supra note 317, at 1270 (advocating default rule that "unless the parties agree otherwise, personal data collected in the course of executing a cyberspace transaction can only be used in ways that are functionally necessary to the successful execution of that transaction"). Such default rules would, in effect, give users a property right in their personal information, transferable only through P3P-based transaction. Cf. Kenneth C. Laudon, Extensions to the Theory of Markets and Privacy: Mechanics of Pricing Information, in U.S. Dep't. of Commerce, Privacy and Self-Regulation in the Information Age (1997), available at (visited Jan. 7, 2000) <http://www.ntia.doc.gov/reports/privacy/seflreg1. htm#1D> (favoring creation of a property right in personal information, held in the first instance by the individual whom the information is about).