Survey Data Mining:   Home | FAQ | Archive | Glossary
Free Reports
  


You are viewing an outdated report. The latest version of this report was published on November 1st, 2024


    
P3P Compact Privacy Policy Report
October 1st, 2017

The Report
This report focuses on sites that have implemented compact privacy policies that deal with how the site and its organization use cookies. According to the P3P specification:

The Platform for Privacy Preferences Project (P3P) enables Web sites to express their privacy practices in a standard format that can be retrieved automatically and interpreted easily by user agents. P3P user agents will allow users to be informed of site practices (in both machine- and human-readable formats) and to automate decision-making based on these practices when appropriate. Thus users need not read the privacy policies at every site they visit.

Part of the spec provides for what is termed "Compact Policies". These are summaries of the full privacy policy that relate to cookies, and provide browsers with policy information within HTTP header requests of pages that are retrieved, allowing for quick decisions by the browser on how to deal with content on that page.

This report details the usage of Compact Privacy Policies.

Web-Wide Penetration of Compact Privacy Policies
The following graph illustrates the rate of adoption and penetration rate of compact policies.

The October 1st, 2017 survey retrieved the home page of 2327514 different sites. Of these sites, a total of 151237 returned an HTTP header containing a compact privacy policy statement.

Compact Privacy Policy Tag Usage
Compact Privacy policies consist of a sequence of tags that define the policy in effect. A raw analysis of the tags and the frequency of occurrance of each of these tags is shown in the tables below.

ACCESS
The ACCESS element indicates whether the site provides access to users to the information that has been collected by the site, and address questions or concerns to the service provider. Sites deploying valid P3P policies must specify one of the ACCESS tags listed below.

TagDescription%
NOIWeb Site does not collected identified data.36.43%
ALLAll Identified Data: Access is given to all identified data.3.03%
CAOIdentified Contact Information and Other Identified Data: access is given to identified online and physical contact information as well as to certain other identified data.12.81%
IDCIdentifiable Contact Information: access is given to identified online and physical contact information (e.g., users can access things such as a postal address) 14.63%
OTIOther Identified Data: access is given to certain other identified data (e.g., users can access things such as their online account charges).1.12%
NONNone: no access to identified data is given.8.86%

DISPUTES
Privacy policies SHOULD contain disputes elements. These elements describe dispute resolution procedures that may be followed for disputes about a services' privacy practices. If a privacy policy contains one or more DISPUTES elements, then the P3P-compact policy field should contain the DSP token.

TagDescription%
DSPThe privacy policy contains DISPUTES elements.34.45%

REMEDIES
Each DISPUTES element SHOULD contain a REMEDIES element that specifies the possible remedies in case a policy breach occurs. If a remedies element exists, it MUST specify one of the 3 remedies shown below, which SHOULD be included in the P3P-compact policy.

TagDescription%
CORErrors or wrongful actions arising in connection with the privacy policy will be remedied by the service.32.77%
MONIf the service provider violates its privacy policy it will pay the individual an amount specified in the human readable privacy policy or the amount of damages.0.43%
LAWRemedies for breaches of the policy statement will be determined based on the law referenced in the human readable description.0.98%

NON-IDENTIFIABLE
If each statement of a privacy policy contains the NON-IDENTIFIABLE element, then the compact privacy policy may specify the NID token.

TagDescription%
NIDNon-identifiable.5.37%

PURPOSE
Each statement in a privacy policy must contain a PURPOSE element that contains one or more purposes of data collection or uses of data. Sites MUST classify their data practices into specific purposes.

TagDescription%
CURInformation is used to complete the activity for which it was provided.7.67%
ADMInformation may be used for the technical support of the Web site and its computer system. Users cannot opt-in or opt-out of this usage. This is the same as tag ADMa below38.62%
ADMaInformation may be used for the technical support of the Web site and its computer system. Users cannot opt-in or opt-out of this usage.23.41%
ADMiInformation may be used for the technical support of the Web site and its computer system. Opt-in requirements dictates prior consent must be provided by users.0.24%
ADMoInformation may be used for the technical support of the Web site and its computer system. Users may opt-out of the data being used for this purpose.0.38%
DEVInformation may be used to enhance, evaluate, or otherwise review the site, service, product, or market. Users cannot opt-in or opt-out of this usage. This is the same as tag DEVa below.32.94%
DEVaInformation may be used to enhance, evaluate, or otherwise review the site, service, product, or market. Users cannot opt-in or opt-out of this usage.8.35%
DEViInformation may be used to enhance, evaluate, or otherwise review the site, service, product, or market. Opt-in requirements dictates prior consent must be provided by users.3.84%
DEVoInformation may be used to enhance, evaluate, or otherwise review the site, service, product, or market. Users may opt-out of the data being used for this purpose.0.43%
TAIInformation may be used to tailor or modify content or design of the site where the information is used only for a single visit to the site and not used for any kind of future customization. Users cannot opt-in or opt-out of this usage. This is the same as tag TAIa below.2.07%
TAIaInformation may be used to tailor or modify content or design of the site where the information is used only for a single visit to the site and not used for any kind of future customization. Users cannot opt-in or opt-out of this usage.5.02%
TAIiInformation may be used to tailor or modify content or design of the site where the information is used only for a single visit to the site and not used for any kind of future customization. Opt-in requirements dictates prior consent must be provided by users.4.10%
TAIoInformation may be used to tailor or modify content or design of the site where the information is used only for a single visit to the site and not used for any kind of future customization. Users may opt-out of the data being used for this purpose.0.10%
PSAInformation may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals for purpose of research, analysis and reporting, but it will not be used to attempt to identify specific individuals. Users cannot opt-in or opt-out of this usage. This is the same as tag PSAa below18.55%
PSAaInformation may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals for purpose of research, analysis and reporting, but it will not be used to attempt to identify specific individuals. Users cannot opt-in or opt-out of this usage.2.71%
PSAiInformation may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals for purpose of research, analysis and reporting, but it will not be used to attempt to identify specific individuals. Opt-in requirements dictates prior consent must be provided by users.27.68%
PSAoInformation may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals for purpose of research, analysis and reporting, but it will not be used to attempt to identify specific individuals. Users may opt-out of the data being used for this purpose.1.16%
PSDInformation may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals to make a decision that directly affects that individual, but it will not be used to attempt to identify specific individuals. Users cannot opt-in or opt-out of this usage. This is the same as tag PSDa below8.50%
PSDaInformation may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals to make a decision that directly affects that individual, but it will not be used to attempt to identify specific individuals. Users cannot opt-in or opt-out of this usage.1.38%
PSDiInformation may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals to make a decision that directly affects that individual, but it will not be used to attempt to identify specific individuals. Opt-in requirements dictates prior consent must be provided by users.0.16%
PSDoInformation may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals to make a decision that directly affects that individual, but it will not be used to attempt to identify specific individuals. Users may opt-out of the data being used for this purpose.1.08%
IVAInformation may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data for the purpose of research, analysis and reporting. Users cannot opt-in or opt-out of this usage. This is the same as tag IVAa below0.22%
IVAaInformation may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data for the purpose of research, analysis and reporting. Users cannot opt-in or opt-out of this usage.0.68%
IVAiInformation may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data for the purpose of research, analysis and reporting. Opt-in requirements dictates prior consent must be provided by users.5.45%
IVAoInformation may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data for the purpose of research, analysis and reporting. Users may opt-out of the data being used for this purpose.0.39%
IVDInformation may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data to make a decision that directly affects that individual. Users cannot opt-in or opt-out of this usage. This is the same as tag IVDa below0.39%
IVDaInformation may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data to make a decision that directly affects that individual. Users cannot opt-in or opt-out of this usage.0.17%
IVDiInformation may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data to make a decision that directly affects that individual. Opt-in requirements dictates prior consent must be provided by users.5.45%
IVDoInformation may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data to make a decision that directly affects that individual. Users may opt-out of the data being used for this purpose.0.70%
CONInformation may be used to contact the individual, through a communications channel other than voice telephone, for the promotion of a product or service. This includes notifying visitors about updates to the Web site. Users cannot opt-in or opt-out of this usage. This is the same as tag CONa below0.10%
CONaInformation may be used to contact the individual, through a communications channel other than voice telephone, for the promotion of a product or service. This includes notifying visitors about updates to the Web site. Users cannot opt-in or opt-out of this usage.0.12%
CONiInformation may be used to contact the individual, through a communications channel other than voice telephone, for the promotion of a product or service. This includes notifying visitors about updates to the Web site. Opt-in requirements dictates prior consent must be provided by users.6.68%
CONoInformation may be used to contact the individual, through a communications channel other than voice telephone, for the promotion of a product or service. This includes notifying visitors about updates to the Web site. Users may opt-out of the data being used for this purpose.0.99%
HISInformation may be archived or stored for the purpose of preserving social history as governed by an existing law or policy. Users cannot opt-in or opt-out of this usage. This is the same as tag HISa below3.91%
HISaInformation may be archived or stored for the purpose of preserving social history as governed by an existing law or policy. Users cannot opt-in or opt-out of this usage.0.17%
HISiInformation may be archived or stored for the purpose of preserving social history as governed by an existing law or policy. Opt-in requirements dictates prior consent must be provided by users.0.01%
HISoInformation may be archived or stored for the purpose of preserving social history as governed by an existing law or policy. Users may opt-out of the data being used for this purpose.0.15%
TELInformation may be used to contact the individual via a voice telephone call for promotion of a product or service. Users cannot opt-in or opt-out of this usage. This is the same as tag TELa below0.05%
TELaInformation may be used to contact the individual via a voice telephone call for promotion of a product or service. Users cannot opt-in or opt-out of this usage.0.05%
TELiInformation may be used to contact the individual via a voice telephone call for promotion of a product or service. Opt-in requirements dictates prior consent must be provided by users.0.35%
TELoInformation may be used to contact the individual via a voice telephone call for promotion of a product or service. Users may opt-out of the data being used for this purpose.1.66%
OTPInformation may be used in other ways not captured by the above definitions. Users cannot opt-in or opt-out of this usage. This is the same as tag OTPa below0.44%
OTPaInformation may be used in other ways not captured by the above definitions. Users cannot opt-in or opt-out of this usage.0.10%
OTPiInformation may be used in other ways not captured by the above definitions. Opt-in requirements dictates prior consent must be provided by users.1.67%
OTPoInformation may be used in other ways not captured by the above definitions. Users may opt-out of the data being used for this purpose.0.00%

RECIPIENT
Each statement in a privacy policy must contain a RECIPIENT element that contains one or more recipient of the collected data. Sites MUST classify their recipients into one or more of the six recipients groupings below, with optional attributes describing opt-in/opt-out criteria.

TagDescription%
OUROurselves and/or entities acting as our agents or entities for whom we are acting as an agent.77.59%
DELDelivery services possibly following different practices. Users cannot opt-in or opt-out of this usage. This is the same as tag DELa below0.33%
DELaDelivery services possibly following different practices. Users cannot opt-in or opt-out of this usage.0.75%
DELiDelivery services possibly following different practices. Opt-in requirements dictates prior consent must be provided by users.1.46%
DELoDelivery services possibly following different practices. Users may opt-out of the data being used for this purpose.0.02%
SAMLegal entities following our practices. Users cannot opt-in or opt-out of this usage. This is the same as tag SAMa below0.12%
SAMaLegal entities following our practices. Users cannot opt-in or opt-out of this usage.0.05%
SAMiLegal entities following our practices. Opt-in requirements dictates prior consent must be provided by users.1.51%
SAMoLegal entities following our practices. Users may opt-out of the data being used for this purpose.0.26%
UNRUnrelated third parties whose data usage practices are unknown by the original service provider. Users cannot opt-in or opt-out of this usage. This is the same as tag UNRa below2.31%
UNRaUnrelated third parties whose data usage practices are unknown by the original service provider. Users cannot opt-in or opt-out of this usage.0.06%
UNRiUnrelated third parties whose data usage practices are unknown by the original service provider. Opt-in requirements dictates prior consent must be provided by users.1.34%
UNRoUnrelated third parties whose data usage practices are unknown by the original service provider. Users may opt-out of the data being used for this purpose.0.08%
PUBPublic fora such as bulletin boards, public directories, or commercial CD-ROM directories. Users cannot opt-in or opt-out of this usage. This is the same as tag PUBa below0.00%
PUBaPublic fora such as bulletin boards, public directories, or commercial CD-ROM directories. Users cannot opt-in or opt-out of this usage.0.03%
PUBiPublic fora such as bulletin boards, public directories, or commercial CD-ROM directories. Opt-in requirements dictates prior consent must be provided by users.1.38%
PUBoPublic fora such as bulletin boards, public directories, or commercial CD-ROM directories. Users may opt-out of the data being used for this purpose.0.00%
OTRLegal entities following different practices. Users cannot opt-in or opt-out of this usage. This is the same as tag OTRa below1.13%
OTRaLegal entities following different practices. Users cannot opt-in or opt-out of this usage.0.10%
OTRiLegal entities following different practices. Opt-in requirements dictates prior consent must be provided by users.1.35%
OTRoLegal entities following different practices. Users may opt-out of the data being used for this purpose.27.10%

RETENTION
Each statement element in a privacy policy must contain a RETENTION element that indicates the kind of retention policy that applies to the data referenced in that statement.

TagDescription%
NORInformation is not retained for more than a brief period of time necessary to make use of it during the course of a single online interaction. Information MUST be destroyed following this interaction and MUST NOT be logged, archived, or otherwise stored.4.04%
STPInformation is retained to meet the stated purpose. This requires information to be discarded at the earliest time possible. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy.30.78%
LEGAs required by law or liability under applicable law: Information is retained to meet a stated purpose, but the retention period is longer because of a legal requirement or liability. For example, a law may allow consumers to dispute transactions for a certain time period; therefore a business may for liability reasons decide to maintain records of transactions, or a law may affirmatively require a certain business to maintain records for auditing or other soundness purposes. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy.0.57%
BUSis retained under a service provider's stated business practices. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy.8.43%
INDInformation is retained for an indeterminate period of time. The absence of a retention policy would be reflected under this option. Where the recipient is a public fora, this is the appropriate retention policy.55.14%

CATEGORIES
Categories are elements inside data elements that provide hints to users and user agents as to the intended use of the data.

TagDescription%
PHYInformation that allows an individual to be contacted or located in the physical world -- such as telephone number or address.14.85%
ONLInformation that allows an individual to be contacted or located on the Internet -- such as email. Often, this information is independent of the specific computer used to access the network. (See the category COM)15.87%
UNINon-financial identifiers, excluding government-issued identifiers, issued for purposes of consistently identifying or recognizing the individual. These include identifiers issued by a Web site or service.19.21%
PURInformation actively generated by the purchase of a product or service, including information about the method of payment.4.30%
FINInformation about an individual's finances including account status and activity information such as account balance, payment or overdraft history, and information about an individual's purchase or use of financial instruments including credit or debit card information.2.35%
COMInformation about the computer system that the individual is using to access the network -- such as the IP number, domain name, browser type or operating system.54.04%
NAVData passively generated by browsing the Web site -- such as which pages are visited, and how long users stay on each page.45.40%
INTData actively generated from or reflecting explicit interactions with a service provider through its site -- such as queries to a search engine, or logs of account activity.13.53%
DEMData about an individual's characteristics -- such as gender, age, and income.35.26%
CNTThe words and expressions contained in the body of a communication -- such as the text of email, bulletin board postings, or chat room communications.7.28%
STAMechanisms for maintaining a stateful session with a user or automatically recognizing users who have visited a particular site or accessed particular content previously -- such as HTTP cookies.20.05%
POLMembership in or affiliation with groups such as religious organizations, trade unions, professional associations, political parties, etc.2.45%
HEAInformation about an individual's physical or mental health, sexual orientation, use or inquiry into health care services or products, and purchase of health care services or products.2.29%
PREData about an individual's likes and dislikes -- such as favorite color or musical tastes.6.08%
LOCInformation that can be used to identify an individual's current physical location and track them as their location changes -- such as GPS position data.2.20%
GOVIdentifiers issued by a government for purposes of consistently identifying the individual.1.44%
OTCOther types of data not captured by the above definitions.2.54%

TEST
The TEST element indicates that the privacy policy is an example ONLY, and must be ignored (i.e. not considered a valid P3P policy).

TagDescription%
TST 0.03%



© 1998-2024 E-Soft Inc. All rights reserved.