The Report

This report focuses on sites that have implemented compact privacy policies that deal with how the site and its organization use cookies. According to the P3P specification:

The Platform for Privacy Preferences Project (P3P) enables Web sites to express their privacy practices in a standard format that can be retrieved automatically and interpreted easily by user agents. P3P user agents will allow users to be informed of site practices (in both machine- and human-readable formats) and to automate decision-making based on these practices when appropriate. Thus users need not read the privacy policies at every site they visit.

Part of the spec provides for what is termed "Compact Policies". These are summaries of the full privacy policy that relate to cookies, and provide browsers with policy information within HTTP header requests of pages that are retrieved, allowing for quick decisions by the browser on how to deal with content on that page.

This report details the usage of Compact Privacy Policies.

Web-Wide Penetration of Compact Privacy Policies

The following graph illustrates the rate of adoption and penetration rate of compact policies.

The March 1st, 2020 survey retrieved the home page of 5813775 different sites. Of these sites, a total of 155481 returned an HTTP header containing a compact privacy policy statement.

Compact Privacy Policy Tag Usage

Compact Privacy policies consist of a sequence of tags that define the policy in effect. A raw analysis of the tags and the frequency of occurrance of each of these tags is shown in the tables below.

ACCESS

The ACCESS element indicates whether the site provides access to users to the information that has been collected by the site, and address questions or concerns to the service provider. Sites deploying valid P3P policies must specify one of the ACCESS tags listed below.

Tag	Description	%
NOI	Web Site does not collected identified data.	52.39%
ALL	All Identified Data: Access is given to all identified data.	4.78%
CAO	Identified Contact Information and Other Identified Data: access is given to identified online and physical contact information as well as to certain other identified data.	12.10%
IDC	Identifiable Contact Information: access is given to identified online and physical contact information (e.g., users can access things such as a postal address)	13.80%
OTI	Other Identified Data: access is given to certain other identified data (e.g., users can access things such as their online account charges).	1.41%
NON	None: no access to identified data is given.	7.15%

DISPUTES

Privacy policies SHOULD contain disputes elements. These elements describe dispute resolution procedures that may be followed for disputes about a services' privacy practices. If a privacy policy contains one or more DISPUTES elements, then the P3P-compact policy field should contain the DSP token.

Tag	Description	%
DSP	The privacy policy contains DISPUTES elements.	32.47%

REMEDIES

Each DISPUTES element SHOULD contain a REMEDIES element that specifies the possible remedies in case a policy breach occurs. If a remedies element exists, it MUST specify one of the 3 remedies shown below, which SHOULD be included in the P3P-compact policy.

Tag	Description	%
COR	Errors or wrongful actions arising in connection with the privacy policy will be remedied by the service.	29.64%
MON	If the service provider violates its privacy policy it will pay the individual an amount specified in the human readable privacy policy or the amount of damages.	0.07%
LAW	Remedies for breaches of the policy statement will be determined based on the law referenced in the human readable description.	0.74%

NON-IDENTIFIABLE

If each statement of a privacy policy contains the NON-IDENTIFIABLE element, then the compact privacy policy may specify the NID token.

Tag	Description	%
NID	Non-identifiable.	7.44%

PURPOSE

Each statement in a privacy policy must contain a PURPOSE element that contains one or more purposes of data collection or uses of data. Sites MUST classify their data practices into specific purposes.

Tag	Description	%
CUR	Information is used to complete the activity for which it was provided.	13.05%
ADM	Information may be used for the technical support of the Web site and its computer system. Users cannot opt-in or opt-out of this usage. This is the same as tag ADMa below	60.07%
ADMa	Information may be used for the technical support of the Web site and its computer system. Users cannot opt-in or opt-out of this usage.	20.25%
ADMi	Information may be used for the technical support of the Web site and its computer system. Opt-in requirements dictates prior consent must be provided by users.	0.15%
ADMo	Information may be used for the technical support of the Web site and its computer system. Users may opt-out of the data being used for this purpose.	0.24%
DEV	Information may be used to enhance, evaluate, or otherwise review the site, service, product, or market. Users cannot opt-in or opt-out of this usage. This is the same as tag DEVa below.	51.72%
DEVa	Information may be used to enhance, evaluate, or otherwise review the site, service, product, or market. Users cannot opt-in or opt-out of this usage.	11.85%
DEVi	Information may be used to enhance, evaluate, or otherwise review the site, service, product, or market. Opt-in requirements dictates prior consent must be provided by users.	5.44%
DEVo	Information may be used to enhance, evaluate, or otherwise review the site, service, product, or market. Users may opt-out of the data being used for this purpose.	0.28%
TAI	Information may be used to tailor or modify content or design of the site where the information is used only for a single visit to the site and not used for any kind of future customization. Users cannot opt-in or opt-out of this usage. This is the same as tag TAIa below.	3.02%
TAIa	Information may be used to tailor or modify content or design of the site where the information is used only for a single visit to the site and not used for any kind of future customization. Users cannot opt-in or opt-out of this usage.	9.15%
TAIi	Information may be used to tailor or modify content or design of the site where the information is used only for a single visit to the site and not used for any kind of future customization. Opt-in requirements dictates prior consent must be provided by users.	5.70%
TAIo	Information may be used to tailor or modify content or design of the site where the information is used only for a single visit to the site and not used for any kind of future customization. Users may opt-out of the data being used for this purpose.	0.24%
PSA	Information may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals for purpose of research, analysis and reporting, but it will not be used to attempt to identify specific individuals. Users cannot opt-in or opt-out of this usage. This is the same as tag PSAa below	23.01%
PSAa	Information may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals for purpose of research, analysis and reporting, but it will not be used to attempt to identify specific individuals. Users cannot opt-in or opt-out of this usage.	2.02%
PSAi	Information may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals for purpose of research, analysis and reporting, but it will not be used to attempt to identify specific individuals. Opt-in requirements dictates prior consent must be provided by users.	42.82%
PSAo	Information may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals for purpose of research, analysis and reporting, but it will not be used to attempt to identify specific individuals. Users may opt-out of the data being used for this purpose.	1.23%
PSD	Information may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals to make a decision that directly affects that individual, but it will not be used to attempt to identify specific individuals. Users cannot opt-in or opt-out of this usage. This is the same as tag PSDa below	14.05%
PSDa	Information may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals to make a decision that directly affects that individual, but it will not be used to attempt to identify specific individuals. Users cannot opt-in or opt-out of this usage.	1.59%
PSDi	Information may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals to make a decision that directly affects that individual, but it will not be used to attempt to identify specific individuals. Opt-in requirements dictates prior consent must be provided by users.	0.33%
PSDo	Information may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals to make a decision that directly affects that individual, but it will not be used to attempt to identify specific individuals. Users may opt-out of the data being used for this purpose.	1.13%
IVA	Information may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data for the purpose of research, analysis and reporting. Users cannot opt-in or opt-out of this usage. This is the same as tag IVAa below	0.36%
IVAa	Information may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data for the purpose of research, analysis and reporting. Users cannot opt-in or opt-out of this usage.	0.68%
IVAi	Information may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data for the purpose of research, analysis and reporting. Opt-in requirements dictates prior consent must be provided by users.	8.25%
IVAo	Information may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data for the purpose of research, analysis and reporting. Users may opt-out of the data being used for this purpose.	0.23%
IVD	Information may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data to make a decision that directly affects that individual. Users cannot opt-in or opt-out of this usage. This is the same as tag IVDa below	0.23%
IVDa	Information may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data to make a decision that directly affects that individual. Users cannot opt-in or opt-out of this usage.	0.31%
IVDi	Information may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data to make a decision that directly affects that individual. Opt-in requirements dictates prior consent must be provided by users.	8.46%
IVDo	Information may be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data to make a decision that directly affects that individual. Users may opt-out of the data being used for this purpose.	0.32%
CON	Information may be used to contact the individual, through a communications channel other than voice telephone, for the promotion of a product or service. This includes notifying visitors about updates to the Web site. Users cannot opt-in or opt-out of this usage. This is the same as tag CONa below	0.10%
CONa	Information may be used to contact the individual, through a communications channel other than voice telephone, for the promotion of a product or service. This includes notifying visitors about updates to the Web site. Users cannot opt-in or opt-out of this usage.	0.31%
CONi	Information may be used to contact the individual, through a communications channel other than voice telephone, for the promotion of a product or service. This includes notifying visitors about updates to the Web site. Opt-in requirements dictates prior consent must be provided by users.	10.49%
CONo	Information may be used to contact the individual, through a communications channel other than voice telephone, for the promotion of a product or service. This includes notifying visitors about updates to the Web site. Users may opt-out of the data being used for this purpose.	1.14%
HIS	Information may be archived or stored for the purpose of preserving social history as governed by an existing law or policy. Users cannot opt-in or opt-out of this usage. This is the same as tag HISa below	5.53%
HISa	Information may be archived or stored for the purpose of preserving social history as governed by an existing law or policy. Users cannot opt-in or opt-out of this usage.	0.70%
HISi	Information may be archived or stored for the purpose of preserving social history as governed by an existing law or policy. Opt-in requirements dictates prior consent must be provided by users.	0.01%
HISo	Information may be archived or stored for the purpose of preserving social history as governed by an existing law or policy. Users may opt-out of the data being used for this purpose.	0.01%
TEL	Information may be used to contact the individual via a voice telephone call for promotion of a product or service. Users cannot opt-in or opt-out of this usage. This is the same as tag TELa below	0.08%
TELa	Information may be used to contact the individual via a voice telephone call for promotion of a product or service. Users cannot opt-in or opt-out of this usage.	0.01%
TELi	Information may be used to contact the individual via a voice telephone call for promotion of a product or service. Opt-in requirements dictates prior consent must be provided by users.	0.13%
TELo	Information may be used to contact the individual via a voice telephone call for promotion of a product or service. Users may opt-out of the data being used for this purpose.	3.06%
OTP	Information may be used in other ways not captured by the above definitions. Users cannot opt-in or opt-out of this usage. This is the same as tag OTPa below	0.12%
OTPa	Information may be used in other ways not captured by the above definitions. Users cannot opt-in or opt-out of this usage.	0.64%
OTPi	Information may be used in other ways not captured by the above definitions. Opt-in requirements dictates prior consent must be provided by users.	2.97%
OTPo	Information may be used in other ways not captured by the above definitions. Users may opt-out of the data being used for this purpose.	0.01%

RECIPIENT

Each statement in a privacy policy must contain a RECIPIENT element that contains one or more recipient of the collected data. Sites MUST classify their recipients into one or more of the six recipients groupings below, with optional attributes describing opt-in/opt-out criteria.

Tag	Description	%
OUR	Ourselves and/or entities acting as our agents or entities for whom we are acting as an agent.	94.45%
DEL	Delivery services possibly following different practices. Users cannot opt-in or opt-out of this usage. This is the same as tag DELa below	0.15%
DELa	Delivery services possibly following different practices. Users cannot opt-in or opt-out of this usage.	1.81%
DELi	Delivery services possibly following different practices. Opt-in requirements dictates prior consent must be provided by users.	2.70%
DELo	Delivery services possibly following different practices. Users may opt-out of the data being used for this purpose.	0.01%
SAM	Legal entities following our practices. Users cannot opt-in or opt-out of this usage. This is the same as tag SAMa below	0.16%
SAMa	Legal entities following our practices. Users cannot opt-in or opt-out of this usage.	0.02%
SAMi	Legal entities following our practices. Opt-in requirements dictates prior consent must be provided by users.	2.88%
SAMo	Legal entities following our practices. Users may opt-out of the data being used for this purpose.	0.22%
UNR	Unrelated third parties whose data usage practices are unknown by the original service provider. Users cannot opt-in or opt-out of this usage. This is the same as tag UNRa below	5.20%
UNRa	Unrelated third parties whose data usage practices are unknown by the original service provider. Users cannot opt-in or opt-out of this usage.	0.16%
UNRi	Unrelated third parties whose data usage practices are unknown by the original service provider. Opt-in requirements dictates prior consent must be provided by users.	2.73%
UNRo	Unrelated third parties whose data usage practices are unknown by the original service provider. Users may opt-out of the data being used for this purpose.	0.25%
PUB	Public fora such as bulletin boards, public directories, or commercial CD-ROM directories. Users cannot opt-in or opt-out of this usage. This is the same as tag PUBa below	0.00%
PUBa	Public fora such as bulletin boards, public directories, or commercial CD-ROM directories. Users cannot opt-in or opt-out of this usage.	0.03%
PUBi	Public fora such as bulletin boards, public directories, or commercial CD-ROM directories. Opt-in requirements dictates prior consent must be provided by users.	2.89%
PUBo	Public fora such as bulletin boards, public directories, or commercial CD-ROM directories. Users may opt-out of the data being used for this purpose.	0.00%
OTR	Legal entities following different practices. Users cannot opt-in or opt-out of this usage. This is the same as tag OTRa below	3.17%
OTRa	Legal entities following different practices. Users cannot opt-in or opt-out of this usage.	0.18%
OTRi	Legal entities following different practices. Opt-in requirements dictates prior consent must be provided by users.	2.71%
OTRo	Legal entities following different practices. Users may opt-out of the data being used for this purpose.	41.21%

RETENTION

Each statement element in a privacy policy must contain a RETENTION element that indicates the kind of retention policy that applies to the data referenced in that statement.

Tag	Description	%
NOR	Information is not retained for more than a brief period of time necessary to make use of it during the course of a single online interaction. Information MUST be destroyed following this interaction and MUST NOT be logged, archived, or otherwise stored.	4.49%
STP	Information is retained to meet the stated purpose. This requires information to be discarded at the earliest time possible. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy.	45.03%
LEG	As required by law or liability under applicable law: Information is retained to meet a stated purpose, but the retention period is longer because of a legal requirement or liability. For example, a law may allow consumers to dispute transactions for a certain time period; therefore a business may for liability reasons decide to maintain records of transactions, or a law may affirmatively require a certain business to maintain records for auditing or other soundness purposes. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy.	0.28%
BUS	is retained under a service provider's stated business practices. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy.	16.15%
IND	Information is retained for an indeterminate period of time. The absence of a retention policy would be reflected under this option. Where the recipient is a public fora, this is the appropriate retention policy.	69.13%

CATEGORIES

Categories are elements inside data elements that provide hints to users and user agents as to the intended use of the data.

Tag	Description	%
PHY	Information that allows an individual to be contacted or located in the physical world -- such as telephone number or address.	16.79%
ONL	Information that allows an individual to be contacted or located on the Internet -- such as email. Often, this information is independent of the specific computer used to access the network. (See the category COM)	18.44%
UNI	Non-financial identifiers, excluding government-issued identifiers, issued for purposes of consistently identifying or recognizing the individual. These include identifiers issued by a Web site or service.	22.83%
PUR	Information actively generated by the purchase of a product or service, including information about the method of payment.	8.75%
FIN	Information about an individual's finances including account status and activity information such as account balance, payment or overdraft history, and information about an individual's purchase or use of financial instruments including credit or debit card information.	5.94%
COM	Information about the computer system that the individual is using to access the network -- such as the IP number, domain name, browser type or operating system.	70.00%
NAV	Data passively generated by browsing the Web site -- such as which pages are visited, and how long users stay on each page.	63.47%
INT	Data actively generated from or reflecting explicit interactions with a service provider through its site -- such as queries to a search engine, or logs of account activity.	16.26%
DEM	Data about an individual's characteristics -- such as gender, age, and income.	59.06%
CNT	The words and expressions contained in the body of a communication -- such as the text of email, bulletin board postings, or chat room communications.	12.08%
STA	Mechanisms for maintaining a stateful session with a user or automatically recognizing users who have visited a particular site or accessed particular content previously -- such as HTTP cookies.	24.78%
POL	Membership in or affiliation with groups such as religious organizations, trade unions, professional associations, political parties, etc.	5.75%
HEA	Information about an individual's physical or mental health, sexual orientation, use or inquiry into health care services or products, and purchase of health care services or products.	5.88%
PRE	Data about an individual's likes and dislikes -- such as favorite color or musical tastes.	9.86%
LOC	Information that can be used to identify an individual's current physical location and track them as their location changes -- such as GPS position data.	6.03%
GOV	Identifiers issued by a government for purposes of consistently identifying the individual.	2.85%
OTC	Other types of data not captured by the above definitions.	5.10%

TEST

The TEST element indicates that the privacy policy is an example ONLY, and must be ignored (i.e. not considered a valid P3P policy).

Tag	Description	%
TST		0.10%