A large-scale empirical study of P3P privacy policies: Stated actions vs. legal obligations

ACM Transactions on the Web

Volumn 3, Issue 2, 2009, Pages

  Reay, Ian ^a   Dick, Scott ^a   Miller, James ^a  

^a UNIVERSITY OF ALBERTA   (Canada)

Author keywords

Electronic commerce; Legislation and enforcement; P3P; Privacy protection

Indexed keywords

AUSTRALIA; AUTOMATED ANALYSIS; E-COMMERCE; EMPIRICAL STUDIES; EUROPEAN UNION; INTERNET USERS; LEGAL OBLIGATIONS; LEGISLATION AND ENFORCEMENT; NATIONAL LEGISLATION; P3P; PERSONAL PRIVACY; PLATFORM FOR PRIVACY PREFERENCES; PRIVACY LAW; PRIVACY POLICIES; PRIVACY PROTECTION;

ELECTRONIC COMMERCE; INTERNET; WORLD WIDE WEB;

INTERNET PROTOCOLS;

EID: 70349754413     PISSN: 15591131     EISSN: 1559114X     Source Type: Journal    
DOI: 10.1145/1513876.1513878     Document Type: Article

References (48)

1. ADKINSON,W.F., EISENACH, J. A., AND LENARD, T. M. 2002. Privacy Online: A Report on the Information Practices and Policies of Commercial Web Site. The Progress and Freedom Foundation.
2. AGRAWAL, R., KIERNAN, J., SRIKANT, R., AND XU, Y. 2003. An XPath-based preference language for P3P. In Proceedings of the 12th International Conference on the World Wide Web. ACM Press.
3. ANTON, A. I., EARP,J.B., VAIL, M., JAIN, N., FRINK,J., AND GHEEN, C. 2007. An analysis of Web site privacy policy in the presence of HIPPA. IEEE Secur. Priv. 5, 1, 45-52.
4. ASIA-PACIFIC ECONOMIC COOPERATION. 2004. APEC Privacy Framework.
5. AUSTRALIA OF FICE OF LEGISLATIVE DRAFTING AND PUBLISHING. 1988. Privacy Act 119.
6. BELLMAN, S., JOHNSON,E.J., AND LOHSE, G. L. 2001. On site: to opt-in or opt-out?: It depends on the question. Comm. ACM 44, 2, 25-27.
7. BLACK, H. 2005. On-line data brokers. http://www.privcom.gc.ca/ legislation/let/let-051118-e.asp.
8. BOWIE,N.E. AND JAMAL, K. 2006. Privacy rights on the Internet: Self-regulation or government regulation. Bus. Ethics Quar. 16, 3.
9. BYERS, S., CRANOR,L.F., AND KORMANN, D. P. 2003. Automated analysis of P3P-enabled Web sites. In Proceedings of the 5th International Conference on Electronic Commerce (ICEC).
10. CANADIAN PUBLIC WORKS AND GOVERNMENT SERVICES. 2000. Personal Information Protection and Electronic Documents Act.
11. COHEN, J. 1988. Statistical Power Analysis for the Behavioral Sciences 2nd Ed. Lawrence Earl-baum Associates, Hillsdale, NJ.
12. COPAS,J. AND JACKSON, D. 2004. A bound for publication bias based on the fraction of unpublished studies. Biometrics 60, 146-153.
13. CRANOR, L., DOBBS, B., EGELMAN, S., HOGBEN, G., HUMPHREY, J., LANGHEINRICH, M., MARCHIORI, M., PRESLER-MARSHALL, M., REAGLE, J. M., SCHUNTER, M., STAMPLEY, D. A., AND WENNING, R. 2006. The Platform for Privacy Preferences 1.1 (P3P1.1) Specification. http://www.w3.org/TR/P3P11/.
14. CRANOR,L. F., EGELMAN, S., SHENG, S., MCDONALD, A.M., AND CHOWDHURY, A. 2008. P3P deployment on websites. Electron. Commerce Resear. Appl. Elsevier Science, Amsterdam.
15. CRANOR, L., LANGHEINRICH, M., AND MARCHIONI, M. 2002. A P3P Preference Exchange Language 1.0 (APPEL 1.0). http://www.w3.org/TrRP3P-preferences/.
16. CRANOR,L.F., BYERS,S., AND KORMANN, D. 2003. An analysis of P3P deployment on commercial, government, and children's Web sites as of May 2003. Federal Trade Commission Workshop on Technologies for Protecting Personal Information, AT&T Tech. rep.
17. CRANOR, L. F., GUDURU,P., AND ARJULA, M. 2006. User interfaces for privacy agents. ACM Trans. Comput-Hum. Inter. 13, 2, 135-178.
18. CRANOR, L. F., MARCHIORI, M., PRESLER-MARSHALL, M., AND REAGLE, J. M. 2002. The Platform for Privacy Preferences 1.0 Specification. http://www.w3.org/TR/P3P/.
19. Crocker,D. and Overell, P. 1997. Augmented BNF for Syntax Specifications: ABNF. The Internet society.
20. EARP, J. B., ANTON, A. I., AIMAN-SMITH, L., AND STUFFLEBEAM, W. 2005. Examining Internet privacy policies within the context of user privacy values. IEEE Trans. Eng. Manag. 52, 2, 227-237.
21. EGELMAN, S., CRANOR, L., AND CHOWDHURY, A. 2006. An analysis of P3P-enabled Web sites among top-20 search results. In Proceedings of the 8th International Conference on Electronic Commerce. ACM, New York.
22. EUROPEAN PARLIAMENT. 1995. Directive 95/46/EC the protection of individuals with regard to the processing of personal data and on the free movement of such data. Union, of ficial J. L 281.
23. FRANÇAISE, C. R. 2006. Comission Nationale De L'Informatique Et Des Libertes. http://www.cnil.fr/index.php?id=4.
24. GIDEON, J., CRANOR, L., EGELMAN,S., AND ACQUISTI, A. 2006. Power strips, prophylactics, and privacy, oh my! In Procceedings of the 2nd Symposium on Usable Privacy and Security.
25. HASSELBLAD,V. AND HEDGES, L. V. 1995. Meta-analysis of screening and diagnostic tests. Psych. Bull. 117, 1, 167-178.
26. HOGBEN, G. 2002. A Technical Analysis of Problems With P3P V1.0 And Possible Solutions. Joint Research Centre.
27. HOGBEN, G., JACKSON,T., AND WILIKENS, M. 2002. A fully compliant research implementation of the P3P standard for privacy protection: Experiences and recommendations. in Proceedings of the 7th European Symposium on Research on Computer Security. Lecture Notes in Computer science vol. 2502, 104-125.
28. JAMAL, K., MAIER, M., AND SUNDER, S. 2003. Privacy in e-commerce: Development of reporting standards, disclosure, and assurance services in an unregulated market. J. Account. Res. 41,2, 285-309.
29. JUTLA,D. AND ZHANG, Y. 2005. Maturing e-privacy with P3P and context agents. In Proceedings of the IEEE International Conference on e-Technology, e-Commerce, and e-Services. I EEE.
30. KARAT, C., BRODIE,C., AND KARAT, M. 2003. Views of Privacy: Business Drivers, Strategy and Directions, IBM Research.
31. LAWSON,P. AND VICQ, J. 2006. On the data trail: How detailed information about you gets into the hands of organizations with whom you have no relationship. The Canadian Internet Policy and Public Interest Clinic.
32. LIPSEY,M.W. AND WILSON, D. B. 2001. Practical Meta-Analysis. Sage Publications, Thousand Oaks, CA.
33. MARKEL, M. 2006. Safe Harbor and Privacy Protection: A looming issue for IT Prof essionals. IEEE Trans. Prof . Comm. 49, 1, 1-11.
34. OECD 1980. OECD Guidelines on the protection of privacy and transborder flows of personal data. http://www.oecd.org/document/18/0,2340,en264-3425-186-1- 1,1-1,00.html.
35. RAJAN, M. T. S. 2002. The Past and Future of Privacy in Russia. Rev. Cent. East Europ. Law 27, 4, 625-638.
36. REAY, I. K., BEATTY, P., MILLER,J., AND DICK, S. 2007. A survey and analysis of the P3P protocol's agents, adoption, maintenance and future. IEEE Trans. Depend. Secure Comput. 4, 2, 151-164.
37. RICE, J. A. 2007. Mathematical Statistics and Data Analysis. Thompson/Brooks/Cole, Belmont, CA.
38. SAFE HARBOR PROGRAM. 2007. http://www.export.gov/safeharbor/doc- safeharbor-index.asp.
39. SELIGY,J.L. AND LAWSON, P. 2006. Compliance with Canadian data protection laws: Are retailers measuring up? The Canadian Internet Policy and Public Interest Clinic.
40. SHENG,S. AND CRANOR, L. 2006. An evaluation of the effect of US financial privacy legislation through the analysis of privacy policies. I/S: A J. Law Policy Inform. Soc. 2, 3, 943-979.
41. SHESKIN, D. J. 2004. Handbook of Parametric and NonParametric Statistical Procedures. Chapman and Hall/CRC, Boca Raton IL.
42. SWEDISH DATA INSPECTION BOARD. 1998. The Personal Data Act of Sweden.
43. U.S. FEDERAL TRADE COMMISSION. 1996. Health Insurance Portability and Accountability Act.
44. U.S. FEDERAL TRADE COMMISSION. 1998. Children's Online Privacy Protection Act.
45. U.S. FEDERAL TRADE COMMISSION. 1999. Gramm-Leach-Bliley Act.
46. U.S. FEDERAL TRADE COMMISSION. 2004. The Fair Credit Reporting Act.
47. WATT, A. 2005. Beginning Regular Expressions. Wiley Publishing, Inc., New York, NY.
48. WENNING,R. AND CRANOR L. 2006. The platform for privacy preferences (P3P) project. http://www.w3.org/P3P/.