WD-P3P-syntax-19980702

Platform for Privacy Preferences (P3P)
Syntax Specification

W3C Working Draft 2-July-1998

Latest Version: 

http://www.w3.org/TR/WD-P3P10-syntax 

This Version 

http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702

Previous Version: 

http://www.w3.org/TR/1998/WD-P3P10-syntax-19980519.html

Editors 

Massimo Marchiori, W3C ([email protected]) 

Dan Jaye, Engagetech ([email protected]) 

Status of This Document 

This is the second public W3C Working Draft for review by W3C members and other interested parties. It will be updated once more (within 6 weeks) before being advanced towards proposed recommendation status. This document has been produced as part of the P3P Activity, and will eventually be advanced toward W3C Recommendation status. It is inappropriate to use W3C Working Drafts as reference material or to cite them as other than "work in progress." The underlying concepts of the draft are fairly stable and we encourage the development of experimental implementations and prototypes so as to provide feedback on the specification. However, this Working Group will not allow early implementations to affect their ability to make changes to future versions of this document.

This draft document will be considered by W3C and its members according to W3C process. This document is made public for the purpose of receiving comments that inform the W3C membership and staff on issues likely to affect the implementation, acceptance, and adoption of P3P.

Comments should be sent to [email protected] (archived for Members at http://lists.w3.org/Archives/Member/p3p-comments/).

___

Copyright ©  1998 W3C (MIT, INRIA, Keio), All Rights Reserved. W3C liability, trademark, document use and software licensing rules apply.

Index

1. Introduction
   1. Problem Space
   2. About this Specification
   3. Operational Description and Design
   4. Terminology
   5. Assumptions
2. Agreement Scenarios
   1. No existing agreement, site sends proposal and requests PUID
   2. Existing realm agreement
   3. Existing realm agreement, new proposal
   4. Service wants data from client repository
3. Transport, Primitives and Reason Codes
   1. Data Transport
   2. P3P Requests
   3. Negotiation Primitives
      1. Success (OK)
      2. Here's A Proposal (PROP)
      3. Sorry (SRY)
      4. Transmit Data (TXD)
      5. Ending Negotiation with final
      6. Syntax of Negotiation Primitives
   4. Reason Codes Definition
      1. Success Codes
      2. Rejection Codes
      3. Error Codes
4. P3P Schema
   1. Proposal
   2. RDF Encoding of Proposal
      1. The PROP element
      2. Realms and URI's
      3. The STATEMENT element
      4. The source attribute
      5. The DISCLOSURE element
   3. Data Transfer
      1. Referencing data: the ref tag
      2. Prefixing references using <with><prefix>
      3. The category attribute
      4. Client Side Writes
      5. Unambiguous Optional Elements and Purposes
   4. Creating New Data Sets
      1. Data Definition
      2. Data Schema Format
5. Base Data Set and Data Types
   1. Required (Base) Data Elements and Sets
   2. Data Types
   3. Abstract Elements
6. Appendices

   Appendix 1: References (Normative)
   Appendix 2: Fingerprints and Canonicalization (Normative)
   Appendix 3: P3P XML DTDs (Non-normative)
   Appendix 3: Line-flow Scenario (Non-normative)
   Appendix 4: ABNF Notation (Non-normative)
   Appendix 5: Working Group Contributors (Non-normative)

1. Introduction

The Platform for Privacy Preferences Project (P3P) enables Web sites to express their privacy practices and enables users to exercise preferences over those practices. P3P compliant products will allow users to be informed of site practices (in both machine and human readable formats), to delegate decisions to their computer when appropriate, and to tailor their relationship to specific sites. Site practices that are compatible with a user's preferences can, at the user's option, be accessed "seamlessly". Otherwise users will be notified of a site's practices and have the opportunity to agree to those terms or other terms and continue browsing if they wish.

P3P gives users the ability to make informed decisions regarding their Web experience and the ability to control the use of their information. Sites can use P3P to increase the level of confidence users place in their services, as well as improve the quality of the services offered, customize content, and simplify site access.

P3P uses  [XML] (and in particular [RDF]) for the exchange of structured data and assertions. P3P will support future digital certificate and digital signature capabilities. P3P can be incorporated into browsers, browser plug-ins, servers, or proxy servers that sit between a client and server.

1.1 Problem Space

The P3P specification provides mechanisms:

• For a user agent to be informed of a site's data collection and privacy practices.
• For a user agent and service to automatically negotiate and to come to an agreement satisfactory to both parties; alternatively, for the user agent to notify the user and take instruction concerning proposed data exchanges from the user.
• To exchange data when such exchange is authorized by the user and consistent with a user's preferences and any outstanding agreement.

1.2 About This Specification

This document includes all the specification necessary for the implementation of interoperable P3P applications. This specification was built upon the work of previous working groups and includes:

1. Protocol primitives.
2. Protocol schemas, including the privacy practice vocabularies of the proposal.
3. Protocol syntax and encoding, including the data structures and formats.

   We use the following typographical conventions for representing the status of text:

• Schema definition in ABNF notation.

• Brief implementation note.

The ABNF notation used in this specification is specified in RFC2234 and summarized in Appendix 3.

1.3 Operational Description and Design

A P3P proposal consists of one or more statements, each of which expresses privacy practices for a set of data elements. The P3P proposal should cover all relevant data elements and practices: if a service wants to collect a data element, it must be mentioned in the proposal. Note that most declarations in P3P are positive, meaning you state what you do, rather than what you do not do.

A core concept to the P3P specification is that of a P3P agreement. A P3P agreement is a proposal agreed to by both the service and user agent. User agents compare the privacy practices specified in a proposal with the user's preferences to determine whether to enter into an agreement. An agreement applies to all data exchanged between the user agent and service within a specified realm -- a Web resource or "tree" of Web resources referenced by a single URI, or list of Web resources referenced by a list of URIs.

Once an agreement is reached, the enumerated data elements that are included in the agreed-to proposal should be interpreted by the user agent as data requests from the service. It is possible to have an agreement without referencing data elements. Such an agreement states that no information is collected.

When privacy practices do not match the user's preferences, the two sides can come to an agreement by exchanging alternative proposals. Every proposal can have a set of consequences that can be shown to a human user to explain why the suggested practice may be valuable in a particular instance even if the user would not normally allow the practice. We expect user agents will record the agreements reached, indexed by a fingerprint of the agreement, called the agreementID.

Rather than sending a new proposal to the user agent on every contact, a site may send the agreementID of an existing agreement. This is 1) asserting that the service and the user agent have already agreed to a proposal, 2) signaling which proposal and privacy practices they are operating under, and 3) requesting those data elements referenced in the agreement. The user agent may turn away, respond with the requested data, or request a full proposal -- if either it has no record of such an agreement or it desires a new one.

Sites also have the capability, as part of their proposal, to request that a Temporary or Pairwise Unique ID (TUID/PUID) be automatically sent to the site when the user agent returns. A PUID is similar to a cookie but under P3P control and limited to a numerical field.

Our design is such that applications can be efficiently implemented independent of our assumptions or expectations regarding the latency of multi-round communications, the cacheability of proposals, the use of user agent or server side data repositories, and the size of the agreement repositories.

1.4 Terminology

Assuring Party

Within P3P, an assuring party is a legal entity (person or organization) that makes a statement of assurance about a proposal (e.g. that practices are audited, or are in compliance with certain data collection guidelines). Assurance may come from the service itself or from an independent third party. The assuring party must identify what it is attesting to as part of the assurance statement within the proposal, at a specified URI, or as part of the semantic definition of a meta-data schema.

Agreement

A proposal to which both the service and user agent agree. This agreement is applied within the realm and is often represented by a an agreementID. The non-repudiability of such agreements will be strengthened by the support of certificate and digital signature capabilities in future versions of P3P; however this is not specified in version 1.0. We do provide the appropriate fields for the inclusion of such tokens within P3P1.0 (e.g. a digital signature from the assuring party.)

AgreementID

A small unit of information that indicates both parties have agreed on a common proposal. An agreementID is the fingerprint of an accepted proposal. The presence of the agreementID in the P3P headers is the definitive declaration of which agreements are in effect for a given realm.

Data Element

An individual data entity, such as last name or phone number. For interoperability, P3P 1.0 specifies a base set of data elements.

Data Category

A significant attribute of a data element or data set that may be used by a trust engine to determine what type of element is under discussion, such as "Contact Information." P3P 1.0 specifies 10 base data categories.

Data Set

A known grouping of data element, such as such as "User.Home.Postal.". A set is represented with a trailing period. P3P 1.0 specifies a number of base data sets.

Fingerprint (Hash, Digest)

A fixed size value resulting from the application of a hash function to a set of data. Fingerprints are easily computed, but even small modifications to the original information result in a virtually unpredictable value. Consequently, fingerprints are often used as a key to entries in a table or databases, or as methods of assuring information integrity. We use the [MD5] digest algorithm for P3P fingerprints. This yields a 128-bit value that will be encoded and exchanged in P3P communications.

Preference

A rule, or set of rules, that determines what action(s) a user agent will take or allow when involved in a conversation or negotiation with a service. A preference might be expressed as a formally defined computable statement (e.g., the APPEL preference exchange language). In this document, preferences govern the types of agreements that can be reached between a user agent and a service.

Proposal

A proposal is a collection of one or more privacy statements together with information asserting the identity, URI, assurances, and disclosures of the service covered by the proposal. A proposal is always created from the point of view of the service and contains identifying information for the service, but it may be created by the user and sent to the server for approval.

PUID

PUID := hash(UUID(Realm, agreementID)). The PUID is an optional way for the user to identify herself to a service under a particular agreement over an extended period of time. PUIDs directly correspond to a specific realm and agreement. PUIDs are sent within the P3P header as part of the ReturnID with any GET request.

Realm

The realm is the experience space from which requests under a given agreement may be issued -- it broadly defines the area to which a proposal applies.   It is referenced by one or more URIs. The definitive declaration of which agreements are in effect for a given URI is determined by the presence of agreementIDs. Each URI may name a specific resource or a set of resources qualified by the URI. For instance, in the HTTP URI scheme, a URI ending with an object (home.html) applies to that specific object, a URI that is a path http://www.w3.org/P3P/   references the file system tree below that path.   If the proposal is not digitally signed, then each of the URIs must be from a domain that domain-matches the origin server. Domain matching is covered in the HTTP state management mechanism internet draft [STATE].

Repository

A mechanism for storing user information under the control of P3P.

ReturnID

ReturnID = (agreementID, [PUID], [TUID]), where PUID and TUID are optionally returned.

Service

A program that issues proposals and (possibly) data requests. By this definition, a service may be a server (site), a local application, a piece of locally active code, such as an ActiveX control or Java applet, or even another user agent.

Statement

A P3P statement is a set of privacy practice disclosures relevant to a collection of data elements, sets, and categories. The enumerated elements act as an embedded data request. A statement which references no data, requests no data.

TUID

TUID := hash(UUID(session salt)) A temporary ID generated by the user agent that is returned to a service for the duration of one session. A new TUID should be generated for every session at every service. If a service wants a persistent ID across sessions, they should request a PUID.

URI

A Uniform Resource Identifier used to identify Web resources. For definitive information on URI syntax and semantics, see "Uniform Resource Identifiers (URI): Generic Syntax and Semantics," (which replaces RFCs 1738 and RFC 1808). This document refers to the following URIs:

propURI: URI at which a proposal may be fetched.
postURI: URI which information may be transmitted to.
discURI: URI of the complete natural language privacy statement of the proposal.

User Agent

A program whose sole purpose is to mediate interactions with services on behalf of the user under the user's preferences. A user may have more than one user agent, and agents need not reside on the user's desktop, but any agent must be controlled by and act on behalf of only the user. The trust relationship between a user and her agent may be governed by constraints outside of P3P. For instance, an agent may be trusted as a part of the user's operating system or Web client, or as a part of the terms and conditions of a ISP or privacy proxy.

UUID

A mechanism used for creating PUIDs and TUIDs. UUID is specified by [UUID]. P3P does not specify a method for collecting UUIDs.

1.5 Assumptions

P3P makes several assumptions about the environment in which it works and the problem it is trying to solve.

1. P3P allows a service to include identifying information about itself in its proposals. Since the registered owner of a domain name may not correspond to the entity responsible for a service, this information MUST be provided.
2. Strong non-repudiable evidence of identities and agreements will be provided by future versions of the protocol. At this time, no clear/dominant PKI model exists for use in P3P. In the future both users and services may require signatures and certificates.
3. We assume that communication security is achieved through means other than P3P itself [SSL]. Hence, P3P does not provide mechanisms for cryptographically protecting information in storage or transit.
4. P3P agreements are end-to-end: between the user and the service. Intermediaries such as telecommunication providers, internet service providers, proxies and others may be privy to the exchange of data between a service and a user but those practices are not included in the agreement between the end parties.
5. While P3P can make profitable use of the protocol extension features [MANDA], which are based on [HTTP1.1], P3P should be able to work with [HTTP1.0] servers/proxies.
6. P3P covers all data generated or exchanged via HTTP.

2. Agreement Scenarios

The following scenarios are designed to illustrate several possible ways that P3P might be used. Each scenario highlights a different P3P feature. Scenario 1 shows how a basic P3P agreement is established. Scenarios 2 and 3 show what happens when a user returns to a site where an agreement has already been reached. Scenarios 4 and 5 highlight the use of the user data repository given existing agreements.

These scenarios illustrate interactions in which no negotiation occurs. However, any scenario could be expanded to one in which a site initially offers multiple proposals, or one in which a series of proposals and/or counter-proposals are exchanged between the site and the user. The expanded example scenario in Appendix 1 includes an example of negotiation.

The table below summarizes the features of each scenario. A "-" in the table indicates a feature about which no assumptions (neutral) are made.
 

Scenario 1) No existing agreement, site sends proposal and requests PUID

1. User goes to the home page of CoolCatalog (CoolCatalog/*), she has never been there before but is P3P-compliant.
2. CoolCatalog makes a proposal, including privacy practices, disclosures, and the data elements to which they apply. In this instance, the service asks to be automatically given the PUID as part of the returnID in the future.
3. User agrees to proposal, and agrees to send the PUID in the returnID on all future requests to the realm specified in the proposal.

Protocol Scenario: Client sends OPT header (see [MANDA]) to server.  If server does not support P3P, it will merely return content. (This content could be a HTML form which transfers information to a server using traditional CGI methods.) If the server supports P3P and has a relevant proposal, server shall return 409 with content and a proposal for P3P clients in a header, HTML header, or as referenced by a URI.

Scenario 2) Existing realm agreement

1. User has previously done scenario 1.
2. User returns to CoolCatalog and -- following the existing agreement -- furnishes the returnID on all page requests in the realm of the agreement.

Protocol Scenario: Client sends OPT header to server, and all relevant returnIDs. Server returns relevant content or (orthogonally) can send subsequent P3P data-requests (TXD with agreementID).

Scenario 3) Existing realm agreement, new proposal

1. User has previously completed scenario 1.
2. User returns to CoolCatalog and furnishes returnID of Agreement(1) on all page requests.
3. User goes to order page on CoolCatalog (CoolCatalog/Order/*) and sends returnID of Agreement(1) and the service makes a new proposal because its policies at the order page differ from the rest of the site. In this instance, it wants actual order information.
4. The user considers the new proposal. We consider two cases, differing on whether a new PUID (as part of a returnID) is requested.

• Case 1:
  • The new proposal does not include a request for a new returnID, the proposal is agreed to.
  • Future requests to order page will only include returnID of proposal of (CoolCatalog/*), not the order page.
• Case 2:
  • The new proposal does include a request for a new returnID, this proposal is agreed to.
  • All future requests to order page include both the (CoolCatalog/*) and (CoolCatalog/Order/*) returnIDs.

Scenario 4) Service wants data from client repository

• Any of scenarios 1, 2 may apply to the client's first request for content.
• In order to request data, the service has two options:
  1. send agreementID
     • if the client does know it (by doing lookup against valid agreements entered into to by this client), the client transfers the requested data back to server (TXD).
     • if the client does not know it (either because it never agreed to anything with this service or it simply ran out of space in its log) the client sends a sorry (SRY) and reason code 430 (Unrecognized Agreement). Server then sends the complete proposal as follows in option 2.
  2. sends the complete proposal.
     • The client inspects the proposal, matches user preferences or prompts the user for agreement, and either sends data using TXD, negotiates usage terms, or breaks off negotiation.

Scenario 5) Client write information to service

• This is an added step to scenario 4, where the service's proposal includes writing one or more data elements to the client data repository.
• In this case, once the user has accepted the agreement, the service will send the appropriate data elements, which are then saved transparently by the user agent.

Protocol Scenario: scenario 5 is an extension of scenario 4 which assumes that scenario 4 ended with the user agent sending an OK and optionally a TXD to the server. Now the server will reply with its own TXD sending the appropriate data elements to the client. If successful the user agent will respond with an OK/200 reason code; if unsuccessful the client will respond with SRY/500 reason code.

3. Transport, Primitives and Reason Codes

The following section specifies primitives necessary for forming an agreement and transferring any subsequent data if appropriate.

3.1 Data Transport

P3P was designed to exchange the primitives and their content in the headers of a P3P HTTP extension. However, we foresee instances in which the content of the PROP or TXD primitives could exceed the expected length of a header in some HTTP implementations (e.g. a large graphical image). Hence, as an application of RDF/XML, P3P implementations should be able to conform to methods of RDF/XML exchange when those methods are completely specified. Those methods are likely to be:

1. Within the HTTP extension header.
2. At a specified URI that a client or server then obtains with a HTTP GET request.
3. As part of the content of a XML or HTML page; if HTML, it should not be rendered by older implementations.

P3P1.0 implementations MUST support each of methods 1-3; we illustrate them by means of scenarios. The following table summarizes the features of each scenario, whether or not it uses propURI, postURI. and whether or not the proposal is embedded in content.

Scenario 6) Service references proposal at URI

The service believes that an intermediary proxy cache might truncate long HTTP headers, or the service would like its proposal to be cached at a proxy:

1. User sends GET to service and requests proposal.
2. Service sends prop-message with the propURI.
   <PROP agreeID="94df1293a3e519bb"
   propURI="http://www.CoolCatalog.com/P3P.RDF" />
3. User sends GET to the propURI.
4. The service at the propURI sends the proposal.

The propURI is not relevant to the definition of the realm. Rather, implementations which need to make trust decisions on the basis of the realm should make them with respect to the realm defined in the proposal, and the original URI they fetched in scenario 1.

Scenario 7) Service embeds proposal in HTML content

Content providers may wish to declare simple privacy practices without sending modified HTTP headers. In such a case, sites MAY embed a simple P3P proposal within the HTML  HEAD tag. Since a P3P proposal does not contain content within tags (<tag>content</tag>) we need not worry that older versions of HTML browsers will render such data. However, such a proposal has the following constraints:

1. They MUST be embedded within the HEAD tag.
2. The proposal MUST refer to a propURI.
3. Only a single proposal may be made for any realm. No overlapping proposals are permitted.

Consequently,

1. User sends GET to service and requests a proposal through the presence of the optional header.
2. Service returns content without header.
3. User agent MUST examine the HEAD tag of the HTML-content for a proposal.
4. Upon finding such a header, it would fetch the proposal from the propURI as described in scenario 6.

Note: We hesitate to recommend this method because of the potential (undetermined) overhead of having to seek proposals in the content and the complexity of managing a site with embedded proposals. Consequently, this method should only be used for sites which 1) do not use P3P data methods and 2)  have a few, simple, non-overlapping proposals for their site.

Scenario 8) Client posts information to a URI

The service requests a large binary file, or prefers to process data as it did with forms/CGI and wishes to have that information presented using POST.

1. User sends GET to service and requests proposal.
2. Service sends a proposal that includes a postURI.
3. User posts RDF/XML encoded information at the postURI.

The postURI is an implicit part of the realm. Consequently, information may be posted to the provided postURI under an agreementID even if the URI is not within the realm-URI.

3.2 P3P Requests

The user agent communicates to the server using standard HTTP methods such as "GET" or "POST". P3P uses the mandatory extension mechanism [MANDA] for transporting data between the agent and service. When placing an initial request to the server, the user-agent MAY include the p3p-opt-header to notify the server that the user agent is P3P-compliant. If the user-agent sends the OPT header, and the server implements the P3P protocol, then it MUST:

1. Send the OPT header that indicates that it understands P3P.
2. If it has a proposal that covers the page in question, it MUST send it.

p3p-opt-header

=

p3p-extension ";" "ns-" p3p-header-prefix

p3p-extension

=

`"` "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd" `"`

p3p-header-prefix

=

1*digit

3.3 Negotiation Primitives

The following table summarizes the meaning of the P3P primitives as well as their relations, content, and HTTP return codes. All primitives may be sent by a service or agent.

This section describes each of the operations and specifies who (user or service) can initiate the action and under what circumstances.

3.3.1 Success (OK)

This message is sent when a participant agrees to a proposal, or when a data transfer has succeeded. If the OK is sent in response to a proposal, the OK message includes the agreementID. If the OK is sent in response to a TXD message, the OK message includes the MD5 hash of the data that has been transferred.

3.3.2 Here's A Proposal (PROP)

At any time, either participant can send one or more proposals to the other, these are sent in the prop-msg. The proposal's terms aren't binding until the other side has agreed to them (by responding with the OK or TXD primitives). The proposal may be signed by the party that creates it if so desired. In addition the PROP MUST include the agreementID of a proposal previously received from the other party (this may help the other party keep track of the negotiation). If a site wishes to express that a data element is optional, it may do so within the proposal; the user agent will return the optional elements it feels appropriate. An agreement over a proposal with optional purposes or qualifiers is ambiguous; there is no clear way for the agent to express that one purpose was agreed to, but another was not. Consequently, optional purposes or qualifiers MUST be expressed through multiple unambiguous proposals.

If a proposal isn't automatically acceptable to the user agent, there are three options. The user agent must be programmed in some manner to decide which response is appropriate (including prompting a user for guidance):

1. Refuse (SRY) the proposal. This implies a desire to receive a new proposal from the service. Notice that there is a potential for an infinite loop if the user agent continues to send a SRY message should the same proposal be sent repeatedly. The user agent is responsible for maintaining sufficient state to detect this case and respond using one of the other techniques after it determines that a sufficient number of negotiation rounds have occurred; the service might, after all, choose to change its proposal if the agent appears sufficiently obstinate.
2. Return a Proposal of its own. This implies a refusal, but provides an alternate that the user considers acceptable if accepted by the service. The service has the right to assume that by making the offer the user is willing to accept it if the service does.
   Note: the creation of a counter-proposal by the user agent is not required for P3P1.0 compliance.
3. Walk away from the negotiation. There is no requirement that the user agent respond at all. The user agent may simply not send another request to the service.

If the proposal is acceptable to the user-agent, it should transmit the data to the service along with its OK. By transmitting the data under an agreementID, the user agent indicates that it has accepted the proposal. The TXD includes the agreementID of the accepted proposal, and the service can determine which optional data elements the user has sent by inspecting the data objects transmitted.

3.3.3 Sorry (SRY)

This message is sent in response to a proposal (PROP) or a data transfer (TXD). It indicates that the request could not be processed. The refusal includes two pieces of information: a reason code and agreementID. The reason code indicates what type of request is being refused and why it is being refused. Since multiple proposals may be sent, the agreementID is necessary to identify which request is being refused. The particular causes for refusing a proposal are given by the reason codes.

Finally, the SRY message can be used in response to a Transmit Data (TXD) message when the data transfer fails. The sender SHOULD NOT retry the TXD message.

Note: When a proposal is refused, P3P1.0 does not include a mechanism to specify exactly what portions of the proposal are unacceptable. A mechanism to indicate what part of a proposal is unacceptable may be included in a future version of the P3P protocol. In P3P1.0, a possible work-around for services or user agents which wish to do detailed negotiation is to send a counter-proposal, modifying or deleting those portions of the original proposal which were unacceptable. Implementers should be wary of the privacy implications of releasing user privacy preferences in either case.

3.3.4 Transmit Data (TXD)

After the receipt of a proposal, the user agent may send out the requested data. The user agent MUST include the agreementID(s) it believes it is operating under. The service MUST honor the agreements if they are valid. If the agreementID refers to an invalid or nonexistent agreement, the service MUST respond to the TXD with a SRY message, setting the response code to 430 (Unrecognized Agreement).

If the proposal requests optional elements, the TXD may not include all the requested data elements. It is up to the user agent to decide how many of these to transfer; the agreement MAY inform the user of the consequences (presumably rewards) of sending the optional items.

3.3.5 Ending negotiation with final

There is no primitive to end negotiation. Instead, this capability is provided through a qualifier on a P3P message. Any PROP or SRY message can set the final qualifier to 1. When a service receives a PROP with a final="1" qualifier, it MUST respond with either an OK or a SRY. The response MUST include a content-body, though it may be as simple as an HTML document which states that the requested object cannot be returned without an agreement. When a user-agent receives a PROP with the final="1" qualifier, it should understand that the service has presented its "final offer", and that further negotiation is likely to be pointless.

3.3.6 Syntax of Negotiation Primitives

p3p-content

=

OK-msg | PROP-msg | SRY-msg | TXD-msg

OK-msg

=

"<OK" message-attribute "/>" 

SRY-msg

=

"<SRY"
[" final=" yesno] ; default is 0 (No)
message-attribute "/>"

TXD-msg

=

"<TXD" message-attribute ">" data-xfer "</TXD>"

message-attribute

=

agreementid-attribute |  
reason-attribute |  
data-hash-attribute

agreementid-attribute

=

" agreeID=" `"` agreement-id `"`

reason-attribute

=

" r=" `"` reason-code `"`

data-xfer

=

<XML formatted data element name-value pairs>

agreement-id

=

<base64 of 128 bit MD5 digest of proposal as per RFC 1864>

data-hash-attribute

=

" dh=" `"` <base64 of MD5 digest of data-xfer> `"` 
; used to acknowledge the receipt of data

3.4 Reason Codes Definitions

Reason codes are optionally sent within P3P headers: every SRY message carries an implicit 400 reason code, and every other message carries an implicit 200 reason code; including a reason code in the message overrides these defaults. Reason codes can be divided into three main classes: success codes, rejection codes and error codes. A detailed explanation of these three classes follows.

3.4.1 Success codes

This class of reason code indicates that the request was successfully received, understood, and accepted.

200 OK

• This reason code can be sent in an OK or TXD message in response to a PROP or TXD message.  It is the default value reason code for OK, PROP and TXD messages.

3.4.2 Rejection codes

This class of reason codes indicates that the request was successfully received and understood, but not acceptable.  These codes MUST be sent only in a SRY message.

400 Other Rejection

• This reason code MAY be used in a SRY message when none of the other rejection codes defined below are appropriate. It is the default value reason code for SRY messages. User agents and services are encouraged to use one of the other rejection codes whenever possible.

430 Unrecognized Agreement

• This reason code MAY be sent on a SRY message in response to a PROP or a TXD message. This reason code MUST be sent by the recipient of a TXD when the agreementID does not reference a known and valid agreement.

431 Agreement Expired

• This reason code MAY be sent on a SRY message, in response to a PROP message. It indicates that the agreement referenced by the agreementID has expired.

432 Proposal Rejected

• This reason code MAY be sent on a SRY message, in response to a PROP message. It indicates that the proposal is unacceptable to the entity sending the SRY message.

433 Data Unavailable

• This reason code MAY be sent in a SRY message, in response to a PROP message. It indicates that the user-agent does not have the data that is being requested.

434 Data Not Accepted

• This reason code MAY be sent in a SRY message, in response to a TXD message. This can indicate that the receiver is unable to accept the offered information.

3.4.3 Error codes

This class of reason codes indicates that the request was not received successfully, or that the request was received but could not be understood. These codes MUST be sent only in a SRY message.

500 Other Error

• This reason code MAY be used in a SRY message when none of the other error codes defined below are appropriate. User agents and services are encouraged to use one of the other error codes whenever possible.

530 Invalid Format

• This reason code can be sent in a SRY message in response to any message. It indicates that the P3P message that was received was syntactically invalid or semantic garbage. For example, if a proposal includes incorrect syntax, or ambiguities or contradictions in its statements, the agent should reject such a proposal under the 530 reason code.

531 Data Transfer Unsuccessful

• This reason code can be sent in a SRY message in response to a TXD message. It indicates that a data transfer request was received, and it was syntactically valid, and covered by a valid agreement, but the data could not be stored for some reason.

reason-code

=

200 | 400 | 430 | 431 | 432 | 433 | 434 | 500 | 530 | 531

4. P3P Schema

This section describes the schema for 1) P3P proposals and 2) data transfer. A more complete English language description of the terms used in a proposal may be found within [HARMV].

4.1 Proposal

We would like to encode the following statement; it is one proposal, with two statements within which are logical ANDs. "Other disclosures" automatically apply to the whole proposal.

CoolCatalog, a member of PrivacyAssured, makes the following statement for the Web pages at http://www.CoolCatalog.com/catalogue/.

We collect your name, age, and gender to customize our entry catalog pages for the type of clothing you are likely to be interested in and for our own research and product development. We do not use this information in identifiable form. We also collect your shipping information so that we can send you your order; this of course is identifiable. We do not redistribute any of this information outside of our organization. We do not provide access capabilities to information we may have from you, but we do have retention and opt-out policies, which you can read more about at our privacy page  http://www.CoolCatalog.com/PrivacyPractice.html.

The following is a more formal description, where comments are preceded by a semicolon:

in proposal schema
CoolCatalog makes ;  entity
this statement for http://www.CoolCatalog.com/catalogue/ ;   realm
with assurance from PrivacyAssured

we read ; read is default
   (User.Name.First) ; required is default
   (User.Bdate.Year optional)
   (User.Gender)
    for the purpose of  (2 3) ; Customization of the Site to Individuals, R&D
    in (0) ; Non-Identifiable Form
    and the recipients are (0) ; only ourselves and agents
    with consequence of ("a site with clothes you'd
                                        appreciate.") ; optional
we read&write
    (User.Shipping.) ; this is a whole data set.
    for the purpose of (0) ; Completing the Current Transaction
    in (1) ; Identifiable Form
    and the recipients are (0) ; only ourselves and agents

access disclosure (3) ; no access to identifiable data
other disclosures (0,1) ; we make disclosures
         regarding changing agreement and retention
at http://www.CoolCatalog.com/PrivacyPractice.html

4.2 RDF Encoding of Proposal

The following RDF captures the information as expressed above. P3P proposals are statements that are properly expressed according to the syntax model of RDF as well as well-formed XML. However, there are two assumptions, used to make the proposal shorter, that slightly differentiate a P3P proposal from standard RDF. If the XML/RDF data is homogeneously P3P then:

1. the RDF namespace and <RDF:RDF> tag may be optionally omitted.
2. a tag without a prefix name space must be assumed  to be of the P3P namespace.

<?xml:namespace ns="http//www.w3.org/TR/1998/WD-P3P10-syntax#proposal.DTD" prefix="p3p"?>
<?xml:namespace ns="http://www.w3.org/TR/WD-rdf-syntax#" prefix="RDF"?>
<RDF:RDF><PROP realm="http://www.CoolCatalog.com/catalogue/" 
 entity="CoolCatalog" agreeID="94df1293a3e519bb"
 assurance="http://www.TrustUs.org">
  <USES>
  <STATEMENT purp="2,3" recpnt="0" id="0"
   consq="a site with clothes you'd appreciate.">
    <WITH><PREFIX name="User.">
     <REF name="Name.First"/>
     <REF name="Bdate.Year" optional="1"/>
     <REF name="Gender"/>
    </PREFIX></WITH>
  </STATEMENT>
  </USES>
  <USES>
  <STATEMENT action="read&write" purp="0" recpnt="0" id="1">
    <REF name="User.Shipping."/>
  </STATEMENT>
  </USES>
  <DISCLOSURE discURI="http://www.CoolCatalog.com/PrivacyPractice.html" 
   access="3" other="0,1"/>
</PROP></RDF:RDF>

4.2.1 The PROP element.

<PROP>

includes one or more statements. Each statement includes a set of disclosures as applied to a set of data elements.

agreeID

the agreementID (fingerprint of an accepted proposal)

final

signals the eventual conclusion of the negotiation

propURI

URI at which a proposal may be fetched

postURI

URI which information may be transmitted to

realm

the list of URIs to which the proposal applies.

entity

a text field used to describe the legal entity providing the service and entering into the agreement with the user agent.

assurance

a service that attests that the entity will abide by its proposal, follows guidelines in the processing of data, or other relevant assertions.

agrexp

the date on which an agreement, if reached, will expire. Default is 6 months. The agreement expiration is the last date when a user agent can transfer data to the service under the agreement. The service continues to be bound by the restrictions of the agreement for data collected under the agreement, even after the expiration. Proposals expire after the time indicated by the "EXPIRES" HTTP header. The default expiration is 1 hour. 

optional

indicates whether or not the proposal is optional (see Section 4.3.5).

The realm attribute defines the scope of the agreement. It is used by the user agent, for example, to determine whether to automatically transmit a ReturnID or whether to allow a data transfer request. If the proposal is not digitally signed, then each of the Realm URIs must "domain-match" [Kristol] the domain of the server. If the proposal is digitally signed, then the Realm is implicitly expanded to include the current request URI whenever a server outside the original Realm makes a digitally signed proposal referencing an existing agreement.

As noted above, the user agent uses the Realm to determine if the current request URI is subject to any existing agreements. The user agent automatically transfers the ReturnID with the request if a valid agreement requested the ReturnID. This provides a mechanism for the service to maintain state or capture visitor-level statistics.

PROP-msg

=

`<?xml:namespace ns="http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd" prefix="P3P"?>`
( short-proposal | long-proposal |
(`<?xml:namespace ns="http://www.w3.org/TR/WD-rdf-syntax#" prefix="RDF"?>`
<RDF:RDF>" (short-proposal | long proposal ) "</RDF:RDF>"))

The short-proposal is sent when a site wishes to assume that an agent is aware of the agreement or wishes to refer the agent to a complete proposal at the propURI.

short-proposal

=

( "<PROP agreeID=" `"` quoted-string `"` ">" |
  "<PROP propURI=" quoted-URI ">" )
 "</PROP>"

The longer proposal includes all of the necessary attributes.  

long-proposal

=

"<PROP"
[" final=" yesno] ; default is 0 (No)
[agreementid-attribute]
[" agrexp=" `"` datetime `"`] ;default is six months
" realm=" `"` URI *(" " URI) `"`
" entity=" quoted-string  
[(" assurance=") quoted-URI]
[" postURI=" quoted-URI]
[" optional=" yesno] ;default is 0 (No)
">"
1*statement-block 
disclosure
"</PROP>" 

schemaURI

= 

`"` "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd " `"`

quoted-string

=

`"` string `"`

strin

=

<[UTF-8] string (with " and & escaped)>

quoted-URI

=

`"` URI `"';`

URI

=

<URI as per RFC 2068 [URI]>

datetime

= 

<date/time as per section 3.3 of RFC 2068>  

4.2.2 Processing Realms and URI's

Schemes:

P3P is designed around the HTTP and related schemes (such as HTTPS). The protocol may be extended in the future covering data enchange and negotiation using other schemes, such as FTP or NNTP. Specifically in the case of HTTP and HTTPS, agreements reached using HTTP implicitly cover URI requests that use the HTTPS scheme (but not vice versa). For example, if a user reaches an agreement with realm="http://www.romulus.com/", then "https://www.romulus.com" is considered part of the realm. However, if the user reached a agreement with realm="http://www.romulus.com/", then "https://www.romulus.com" is not subject to the agreement.

entity

The entity attribute references a domain name and path that can be associated with the legal entity making the representation of the privacy practices contained in the proposal. In the absence of digital signatures, this is the only mechanism for tracking down the legal entity via the weak identification mechanisms provided by the domain name registry's and the records of the organization responsible for that domain name. In addition, the entity attribute is used as the "root" domain to which the URI's in the realm must domain-match [KRISTOL] when a certificate is not used as the realm attribute. In addition, the URI of the customer request must domain-match the entity attribute.

realm

The realm attribute representing the set of URI's that are used to determine whether a given URI for an HTTP request is subject to a particular agreement. The realm is one or more URI's that domain-match the entity attribute or a URI pointing to a digital certificate representing the set of URI's for which the agreement will be binding. Consider the following scenario:

1. User requests page http://www.romulus.com.
2. Service returns proposal for realm= "http://maps.romulus.com/ http://www.romulus.com/" and entity="romulus.com" (notice that www.romulus.com and maps.romulus.com domain-match [KRISTOL] the root of the domain of the request URI, romulus.com). The proposal requests PUID (ID.PUID), the nickname of the user (User.Name.Nickname), her home address (User.Home.Postal.), year and month of her birthday (User.Bdate.Year and User.Bdate.Month) for non-identifiable use for the purpose of site administration and tailoring the user's experience
3. User accepts proposal and reaches agreement with agreementID=X
4. User visits maps.romulus.com which falls within the realm of agreementID=X, and automatically transmits PUID to maps.romulus.com.

4.2.3 The STATEMENT element

<STATEMENT>

purposes and their qualifiers as applied to data elements.

purp

purposes for data processing relevant to the Web.

recpnt

an organizational area, or domain, beyond the service provider and its agents where data may be distributed.

id

is data used in a way that is personally identifiable -- including linking it with identifiable information about you from other sources?

action

read the data, or read and write 

source

allows information to be solicited through other ways (e.g. forms) rather than a native P3P agent interface 

statement-block

= 

"<USES>"
"<STATEMENT" 
[" action=" `"` action `"`]
[" purp=" `"` purpose *("," purpose) `"` ] ; default is 0 (No)
[" id=" yesno] ; default is 0 (No)
[" recpnt=" `"` recipients *("," recipients) `"` ]  ; default is 0 (No)
[" consq=" quoted-string]
[" source=" `"` ("agent"|"form"|URI) `"`] ; default is agent
">"
*(datablock)
"</STATEMENT>"
"</USES>"

purpose

=

"0" | ; Completion and Support of Current Activity
"1" | ; Web Site and System Administration
"2" | ; Customization of the Site to Individuals
"3" | ; Research and Development
"4" | ; Contacting Visitors for Marketing of Services or Products
"5" [" (" string ")"] ; Other Uses

recipient

= 

"0" | ; only ourselves and our agents
"1" | ; organizations following our practices
"2" | ; organizations following different practices
"3"   ; unrelated third parties or public forum

id

=

yesno ; default is 0 (No)

action

=

("r" | "rw") ; r=read, rw=read&write, default is read

4.2.4 The source attribute

This attribute allows information to be solicited through a form rather than a native P3P agent interface. This is accomplished by relating the element names of a proposal with the form INPUT names of the associated HTML form (HTTP content). The HTML-client/P3P-agent may also wish to auto-fill values when appropriate.

A P3P element is solicited when:

1. the source attribute is equal to "form" and one of the elements in the form is the abstract data element Form.Data_
2. the HTML form field INPUT names correspond to data element  names in the proposal.

Permissible values of this field are:

agent the default value, the P3P agent must solicit the user.
form solicitation happens through the form implicit in the associated HTML content
URI information is solicited by the resource at the given URI.

For example, a service wishes to have the solicitation under their own presentational control. Also, let us presume that the service will want to receive the data through the post mechanism described in scenario 8.

<?xml:namespace ns="http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd" prefix="P3P"?>
<?xml:namespace ns="http://www.w3.org/TR/WD-rdf-syntax#" prefix="RDF"?>
<RDF:RDF><PROP realm="http://www.CoolCatalog.com/catalogue/" 
 entity="CoolCatalog" agreeID="94df1293a3e519bb"
 assurance="http://www.TrustUs.org"
 postURI="http://www.CoolCatalog.com/cgi-bin"/>
   <USES>
   <STATEMENT action="rw" purp="2,3" recpnt="0" id="0"
    source="form"
    consq="a catalogue of shoes that fit you.">
     <WITH><PREFIX name="Cool." dataschema="http://www.CoolCatalog.com/productschema.html">
     <REF name="ShoeSize"/>
     </PREFIX></WITH>
     <REF name="Form.Data_"/>
   </STATEMENT>
   </USES>
</PROP></RDF:RDF>
...
Content-Type: text/html
Content-Length: 110
<html><body> 
<h1>Welcome to Cool Catalogue</h1>
<p>We'd love to have the following information to 
   customize our online catalogue to you.</p>

<form method="POST" action="http://www.CoolCatalog.com/cgi-bin">
  <p><input type="submit" value="Submit" name="B1"><input
  type="reset" value="Reset" name="B2">First Name<input type="text" name="P3P_User_First"
  size="20" value="Your Name Here"> Shoesize <input type="text" name="Cool.ShoeSize"
  size="20" value="9 1/2"></p>
</form>

</body></html>

4.2.5 The DISCLOSURE element

<DISCLOSURE>

Simple disclosures regarding service access capabilities, and binary values as to whether the entity makes disclosures regarding changing the agreement (opt-out) for data already collected and how long data is retained.

discURI

URI of the natural language privacy statement of the proposal

access

the ability of the individual to view identifiable information and address questions or concerns to the service provider.

other

does the site make its policy regarding change_agreement and retention known at its discURI?

disclosure

=

"<DISCLOSURE"
" discURI=" quoted-URI
" access=" `"` access-disclosure `"`
[" other=" `"` 
   other-disclosure *("," other-disclosure) `"`]
"/>"

access-disclosure

=

"0" | ; Identifiable Data is Not Used
"1" | ; Identifiable Contact Information
"2" | ; Other Identifiable Information
"3"   ; None

other-disclosure

=

["0" | ; change agreement
 "1" ] ; retention

We refer to the P3P Harmonized Vocabulary Specification (http://www.w3.org/TR/1998/WD-P3P10-harmonization) for a more complete explanation of the semantics of the above disclosures.

4.3 Data Transfer

4.3.1 Referencing data: the <REF> tag

References to data sets/elements are all enclosed within a statement using the <REF> tag. The <REF> tag has the following attributes: name, dataschema, value, optional, type, typeschema, short, long, category and size.

• The name attribute is a string denoting the name of a data element/set. Sets and elements are syntactically distinguished by the presence of a trailing dot after the set name. For instance, to indicate the set User.Home, the string User.Home. is used. For convenience, names of data sets/elements are case unsensitive (so, for example, User.Home. is equivalent to USER.HOME or user.home). Moreover, in names no number character can appear soon afterwards a dot.
• The dataschema attribute is a URI denoting the name of the data schema the data element/set specified in name belongs to. A missing dataschema attribute, which is equivalent to an empty string, means that the dataschema is the basic one referenced by the current P3P version.
• The value attribute is a string denoting the actual value of the data element specified in the name attribute. In the case of a data element request, the value attribute is missing.
• The optional attribute can be "0" or "1". "0" indicates that the data element is required, while "1" indicates that the data element is not required. The default is 0. The optional field is used only in the case of a data element request.

The following five attributes are only used when a new (not defined in the P3P1.0 base) data element or set is referenced.

• The type attribute is a string denoting the type of a data element/set.
• The typeschema attribute is a URI denoting the data schema where the type specified in the type attribute is defined.
• The short attribute is a string denoting the short display name of the data element/set.
• The long attribute is a string denoting a longer description of a data element/set.
• The category attribute is a string denoting the categories of a data element.
• The size attribute denotes the maximum number of bytes that are needed to store the data element. The default value of 0 indicates that the data element can be arbitrarily large.

data-reference

=

"<REF" " name=" quoted-string [" dataschema=" quoted-URI] 
[" optional=" yesno] [" value=" quoted-string] 
[" type="quoted-string] [" typeschema=" quoted-URI] 
[" template=" yesno] [" category=" categories] 
[" short=" quoted-string] [" long=" quoted-string]
[" size=" `"` 1*digit `"`] ; default is 0 (unlimited size)
"/>"

As an example, to request the user's shipping address city, all the elements of the data set User.Business. and (optionally) all the elements of the data set User.Home.Telecom.Phone.   the service would send the following references inside a P3P proposal:

<REF name="User.Shipping.Postal.City"/>
<REF name="User.Home.Telecom.Phone." optional="1"/>
<REF name="User.Business."/>

If the user agrees to returning the city and business information and only the international phone code of her home phone number, she returns the following inside the txd tag:

<REF name="User.Shipping.Postal.City" value="Boston"/>
<REF name="User.Home.Telecom.Phone.IntCode" value="1"/>
<REF name="User.Business.Postal.Street" value="12 Main St."/>
<REF name="User.Business.Postal.City" value="Cambridge"/>
... (the other values of User.Business.) ...

4.3.2 Prefixing references: <WITH><PREFIX>

In a set of data references, many element names may share a common parent. For instance, "User." is a common occurrence in the references directly above. The <WITH><PREFIX> tags can be used to associate a string prefix to every attribute of the <REF> tag. Consequently, this can be used to  shorten the length of the names or to reference new data sets and elements. If a sequence of <REF> tags is enclosed by the <WITH><PREFIX> tags, then the block is equivalent to one where the enclosing <WITH><PREFIX> tags are omitted, and the value of each attribute of a <REF> tag is prefixed by the corresponding value of the attribute of the <PREFIX> tag. For instance, the above example could be rewritten as:

<WITH><PREFIX name="User.">
  <REF name="Shipping.Postal.City" value="Boston"/>
  <REF name="Home.Telecom.Phone.IntCode" value="1"/>
  <REF name="Business.Postal.Street" value="12 Main St."/>
  <REF name="Business.Postal.City" value="Cambridge"/>
  ... (the other values of User.Business.) ...
</PREFIX></WITH>

The <WITH><PREFIX> tags can be nested; the prefixes have to be added proceeding from the innermost <WITH><PREFIX> ... </PREFIX></WITH> combination (here, innermost means that there are no other <WITH><PREFIX> tags within). So, the above example could be rewritten even more compactly in the following way:

<WITH><PREFIX name="User.">
  <REF name="Shipping.Postal.City" value="Boston"/>
  <REF name="Home.Telecom.Phone.IntCode" value="1"/>
  <WITH><PREFIX name="Business.Postal.">
    <REF name="Street" value="12 Main St."/>
    <REF name="City" value="Cambridge"/>
    ... (the other values of User.Business.Postal.) ...
  </PREFIX></WITH>
  ... (the other values of User.Business.) ...
</PREFIX></WITH>

Note: use of two tags (<WITH><PREFIX>) in place of one (just <PREFIX>) is technically due to the fact we are employing the RDF encoding.

datablock

=

*datareference |
( *datareference 
  "<WITH><PREFIX" " name=" quoted-string [" dataschema=" quoted-string] 
  [" optional=" quoted-string] [" value=" quoted-string] 
  [" type=" quoted-string] [" typeschema=" quoted-string] 
  [" template=" yesno] [" category=" quoted-string] 
  [" short=" quoted-string] [" long=" quoted-string]
  ">" 
  datablock
  "</PREFIX></WITH>"
  datablock )

4.3.3 The category attribute

Categories are attributes of data elements which provide hints to users and user agents as to the intended uses of the data. Categories are vital to making P3P user agents easier to implement and use; they allow users to express more generalized preferences and rules over the exchange of their data. Categories are often included when defining a new element or referring to form data.

Membership of data elements in categories is generally disjoint; most data elements should belong to just one category. However data elements may belong to more than one category when necessary. In addition, a data set belongs to all of the categories to which its elements belong. Base data elements have all been assigned a default category in the P3P specification. When a service proposes a new data element, the proposal should include the default category or categories for the element, however the user and/or user agent retains final control over the category assignment.

categories

=

`"` *(data-category ",") data-category `"`

data-category

=

"0" | ; Physical Contact Information
"1" | ; Online Contact Information
"2" | ; Unique Identifiers
"3" | ; Financial Account Identifiers
"4" | ; Computer Information
"5" | ; Navigation and Click-stream Data
"6" | ; Transaction Data
"7" | ; Preference Data
"8" | ; Demographic and SocioEconomic Data
"9"   ; Content

For a more detailed explanation of the above categories, see the P3P Harmonized Vocabulary Specification.

4.3.4 Client side writes: the action attribute

Services have the capacity to ask that information be written to the user repository. Consider a P3P agent receiving the following request as part of a proposal:

<STATEMENT action="r" purp="2" id="0"/>
    <REF name="ID.PUID"/>
    <REF name="User.Name.First"/>
</STATEMENT>
<STATEMENT action="rw" purp="2" id="0">
    <REF name="FineShoes.shoesize"
     dataschema="http://www.FineShoes.com/Schema1.0" />
</STATEMENT>

The user could be prompted, asked if she agrees to this proposal, and then shown a form like interface with the User.Name.First auto-filled (assuming she's entered that before) and a blank field for FineShoes.shoesize. The user would enter this information and transmit it (TXD).

The user sends:

<TXD r="200" agreeID="94df1293a3e519bb">
<REF name="User.Name.First" value="Josephine"/>
<REF name="ID.PUID" value="1234567"/>
<REF name="FineShoes.Shoesize"  dataschema="http://www.FineShoes.com/Schema1.0" value="7"/>
</TXD>

Whenever the attribute "rw" is applied to a data element, and a new value is provided by the user, the user agent must attempt a write to the data repository. If that attempt fails, the agent should return the appropriate response code. This auto-write eliminates the need for the service to retransmit information back to the user agent. However, the service may send a (TXD) at any time. For instance, even though the user provided their shoesize as 7, the service wishes to convert it into European shoe sizes and write that value instead.

4.3.5 Unambiguous Optional Elements and Purposes

A desired feature of P3P is the ability of a service to optionally request actions over elements (read&write capabilities) or indirectly apply optional qualifiers (purposes, recipients, identifiable usage) to an element.

An optional action (read or read&write) over an element is easy to represent. Optional elements are denoted by the optional attribute of the <REF> tag. Those elements that are optionally solicited for reading or writing but which are not acceptable to the client are simply not acted upon: data is not returned or written.

Representing an optional qualifier is problematic. If the element is needed for concluding the transaction, but is optionally requested for direct marketing, simply returning the element is an ambigous representation of what the user agreed to. Consequently, in order to avoid ambiguity the following requirement MUST be followed:

• If an element is optional, it may only appear once within a proposal.
• Otherwise, optional qualifiers must be represented through the use of multiple, unambigous proposals.

For example, if a service requires shipping information for completing the transaction and would like to optionally use all of this data for marketing purposes, it should send the following two proposals.

<?xml:namespace ns="http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd" prefix="P3P"?>
<?xml:namespace ns="http://www.w3.org/TR/WD-rdf-syntax#" prefix="RDF"?>
<PROP agreeID="1e3a5d71297d104f>"
 realm="http://www.CoolCatalog.com/catalogue/">
  <USES>
   <STATEMENT purp="2" id="1"
    consq="We can ship your order to your door step">
      <REF name="User.ShipTo."/>
   </STATEMENT> </USES>
 <DISCLOSURE text="http://www.CoolCatalog.com/PrivacyPractice.html"
 access="3" other="0,1"/>
</PROP>
<PROP agreeID="2e3a5d71297d104f"
 realm="http://www.CoolCatalog.com/catalogue/"
optional="1"> ; note optional is in header.
  <USES>
   <STATEMENT purp="4" id="1"
    consq="We will send you our world-renown catalogue!">
      <REF name="User.ShipTo."/>
   </STATEMENT> </USES>
 <DISCLOSURE text="http://www.CoolCatalog.com/PrivacyPractice.html"
 access="3" other="0,1"/>
</PROP>

When employing multiple proposals to represent a complex privacy policy, the following rules need be followed:

1. When a proposal contains only optional elements, the optional flag for the entire proposal MUST be set to 1.
2. When a site sends multiple proposals to a user, if the user wishes to enter into an agreement with that site he or she should return the agreementIDs for one or more of the non-optional proposals and zero or more of the optional proposals. If they agree only to an optional proposal, the site may deny them access to that realm.

In our example, if the user only agrees to the proposal for using the shipping information for the completion of the transaction, it would return the information under that agreement ID.

<TXD r="200" agreeID="1e3a5d71297d104f" />
<WITH><PREFIX name="User.ShipTo.">
      <REF name="Postal.Name" value="Josephine Hound"/>
      ...
      <REF name="Telecom.Phone.Number" value="2532442"/>
</PREFIX></WITH>

Note that this solution results in the transmission of potentially redundant information in multiple proposals and data transfers. However this is preferable to the greater complexity and latency of requiring clients to send back which parts of anmbigous proposal they agreed to.

4.4 Creating New Data Sets

4.4.1 Data Definition

Within a proposal, new data elements and data sets can be created. This occurs when a reference to an unknown data element or data set is encountered by the user agent. In such an event, if the user agrees, the new data elements are created within the user's repository. In order to create a new data element, the agent needs the following: its name, the data schema it belongs to,  the category, the data type (and, in case, the data schema where the type has been defined), and the short display name.

Also, a service may optionally provide a more detailed description of the data element in the form of a special schema statement. This information can be provided in two ways:

1. inline within the <REF> tags, using the corresponding attributes category, type, typeschema, short (see the next subsection); or
2. outline, within the definition of the data schema provided by the dataschema attribute.

If information is inline and the origin server URI does not match the dataschema URI, the information in the main data schema MUST be checked in order to verify the consistency of the information. Otherwise, the information in the main data schema MAY be checked in order to verify consistency of the information. In case of a mismatch, a 530 reason code (Invalid Format) must be returned. If for any other reason the user is unable to reconstruct the needed information, a 433 reason code (Data Unavailable) must be returned.

4.4.2 Data Schema Format

The format of a new data schema is a special statement of the form

<?xml:namespace ns="http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd" prefix="P3P"?>
<?xml:namespace ns="http://www.w3.org/TR/WD-rdf-syntax#" prefix="RDF"?>
<PROP><USES><STATEMENT>
  ....
</STATEMENT></USES></PROP>

A data block is enclosed within the <data> tags and contains references to the data elements. References can be made using the <REF> tag and its attributes:

• name (to define the name of the data element)
• category (to define the category)
• type (to define the type)
• typeschema (to define the data schema where the type is defined)
• short (to define the short display name, no more than 63 characters.)
• long (to provide a longer description of the data item, no more than 511 characters)
• sizelong (to provide the maximum size in bytes of the data item)

Like in the data transfer, the <PREFIX> tag can be used to shorten the schema definition, by associating a common prefix to many <REF> attributes.

For every data element, all of the information except long is mandatory. If one of the attributes is missing, it is presumed to be present with an empty string. In the case of the typeschema, the empty string value has the special meaning that the type schema coincides with the value of the dataschema attribute.

For example, suppose the company HyperSpeed wants to build the following data schema:

car.model
car.color
car.built.year
car.built.where. (of basic type Postal.)
car.price
bike.model
bike.color
bike.built.year
bike.built.where. (of basic type Postal.)
bike.price

Then, it could just place the following code at http://www.HyperSpeed.com/models-schema

<?xml:namespace ns="http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd" prefix="P3P"?>
<?xml:namespace ns="http://www.w3.org/TR/WD-rdf-syntax#" prefix="RDF"?>
<PROP><USES><STATEMENT>
<WITH><PREFIX name="car." short="Car" category="7" size="63">
 <REF name="model" type="Text" short="Model"/>
 <REF name="color" type="Text" short="Color"/>
 <WITH><PREFIX name="built." short="Construction data">
  <REF name="year" type="Number" short="Year"/>
  <REF name="where." type="Postal."/>
 </PREFIX></WITH>
</PREFIX></WITH>
<REF name="bike." type="car." typeschema="http://www.HyperSpeed.com/models-schema" short="Bike "/>
</USES></STATEMENT></PROP>

Note that every time a data set is created, it can be implicitly used as a type, just like the car. case above. However, in some situations one may wish to define a type without creating a specific element within the user's repository. This can be accomplished by using the template attribute in the <REF> . Setting the value to yes, template="1" (default is 0), means that the corresponding data element is part of a type definition only, and is not actually representing a data element with an associated value. For example, HyperSpeed might want to define a GenericModel. type of general utility, and then instantiating it with car. and bike. This could be done with the following schema:

<?xml:namespace ns="http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd" prefix="P3P"?>
<?xml:namespace ns="http://www.w3.org/TR/WD-rdf-syntax#" prefix="RDF"?>
<PROP><USES><STATEMENT>
<WITH><PREFIX name="GenericModel." template="Yes" category="7" size="63">
 <REF name="model" type="Text" short="model"/>
 <REF name="color" type="Text" short="color"/>
 <WITH><PREFIX name="built." short="Construction data">
  <REF name="year" type="Number" short="Year"/>
  <REF name="where." type="Postal."/>
 </PREFIX></WITH>
</PREFIX></WITH>
<REF name="car." type="GenericModel." typeschema="http://www.HyperSpeed.com/models-schema" short="Car"/>
<REF name="bike." type="GenericModel." typeschema="http://www.HyperSpeed.com/models-schema" short="Bike"/>
</USES></STATEMENT></PROP>

5. Base Data Set and Data Types

5.1 Required (Base) Data Elements and Sets

The following are the base data elements and sets. These data elements and sets (as named) may not be modified or deleted by either the service or the user agent. However the user can provide any arbitrary value. For instance the agent may return no value or a value that differs depending on the active persona. We expect that in the future, there will be demand for the creation of other data sets and elements. Obvious applications include catalogue, payment, and agent/system attribute schemas. (An extensive set of system elements is provided in a white paper draft and are based on http://www.w3.org/TR/NOTE-agent-attributes.)

Each table below specifies a set, the elements within the set, the category associated with the element, its type, and the display name shown to users. More than one category may be associated with an element. However, we have designed the base categories such that the base elements do no overlap or belong to more than one category when possible. We recommend that data schema designers do the same.

The ID. data set includes elements used to uniquely identify a user to a single service.

TUIDs are used for the purpose of retaining state for a given session. PUIDs are used to retain state over multiple sessions. Neither of these terms imply that users are personally identifiable nor that they are required to share a single unique identifier with multiple sites. Rather, each ID should be unique such that if both Jane's and Adam's user agents create an ID for interaction with the Cool.Com site, each of their IDs will be unique at Cool.Com .

The User. data set includes general information about the user. 

Note, that this data set includes elements that are actually sets of data themselves. These sets are defined in the data types subsection of this document. The short display name for an individual element contained within a data set is defined as the concatenation of the short display names that have been defined for the set and the element, separated by commas. For example, the short display name for User.Home.Postal.PostalCode would be "User's Home Contact Information, Postal Address Information, Postal Code". User agent implementations may prefer to develop their own short display names rather than using the concatenated names when prompting users for information.

5.2 Data Types

The Date. type is a structured type that specifies a date.

The PersonName. type is a structured type that specifies information about the naming of a person.

The PhoneNum. type is a structured type that specifies the characteristics of a phone number.

The Info. type is a structured, redirected, type to other types. This is done so that requests for data need not collect information they do not need even if they wish to use the abbreviate set notation in a request.  

 
The Postal. type is a structured type that specifies a postal mailing address.

The Telecom. type is a structured type that specifies telecommunication information about a person.

The Online. type is a structured type that specifies telecommunication information about a person.  

 
This specification uses the following primitive data element datatypes, we reference specifications in keeping with [XML1.0], [HTTP1.1], and [XML-Data] as ordered.

5.3 Abstract Elements

In some cases, there is the need for data elements that do not have associated data values, for instance when we just want to reference HTTP data collection activity that is not collected through P3P methods. We call such special elements abstract. When abstract elements appear within the same statement as other elements, this asserts that once the data is collected through the abstract method, the service will likely wish to read or write that information to the specific elements within the user's repository in the future. Abstract elements are syntactically distinguished by the fact their name ends with an underscore "_".

The above abstract elements allow a service to declare the collection of data by means other than a request for a P3P data transfer.

These elements are often implicit in navigation or Web interactions. They should be used with categories to describe the type of information collected through these methods. "Form.Data_" includes information collection methods controlled by the service, such as HTML forms or Java(script) interfaces. "Form.SearchText_" is a specific type of form solicitation used for searching and indexing sites. Consequently, if the only form fields on a search engine page are search fields, it need only disclose that data element.

6. Appendices

6.1 Appendix 1: References (Normative)

[DSIG]

Y. Chu, P. DesAutels, B. LaMacchia, P. Lipp. "DSig 1.0 Signature Labels Specification: Using PICS 1.1 Labels for Making Signed Assertions," World Wide Web Consortium. 03-April-1998. (Recommendation)

[HARMV]

J. Reagle. "P3P Harmonized Vocabulary Specification,"  World Wide Web Consortium. 30-March-1998. (Working Draft)

[HTTP1.0]

T. Berners-Lee, R. Fielding, H. Frystyk Nielsen, "RFC 1945 -- Hypertext Transfer Protocol -- HTTP/1.0," W3C/MIT, UC Irvine, W3C/MIT, May 1996.

[HTTP1.1]

R. Fielding, J. Gettys, J.C. Mogul, H. Frystyk, T. Berners-Lee, "RFC 2068 -- Hypertext Transfer Protocol -- HTTP/1.1," UC Irvine, Digital Equipment Corporation, MIT.

[ISO3166]

"ISO3166: Codes for The Representation of Names of Countries." International Organization for Standardization, December, 1993.

[MANDA]

H. Frystyk Nielsen, P. Leach, S. Lawrence. "Mandatory Extensions in HTTP." January 1998. (draft-frystyk-http-mandatory).

[MD5]

R. Rivest. "RFC 1321 -- The MD5 Message-Digest Algorithm," MIT. April 1992.

[MIME]

N. Freed, N. Borenstein. "MIME (Multipurpose Internet Mail Extensions) Part One: Mechanisms for Specifying and Describing the Format of Internet Message Bodies." November 1996.

[nameS]

T. Bray, D. Hollander, A. Layman. "Namespaces in XML." World Wide Web Consortium. 18-May-1998. (Working Draft)

[RDF]

O. Lassila, R. Swick. "Resource Description Framework (RDF) Model and Syntax Specification,"  World Wide Web Consortium. 16-February-1998. (Working Draft)

[SSL]

A. Freier, P. Karlton,  P. Kocher. "SSL 3.0 Specification." (http://home.netscape.com/eng/ssl3/index.html)

[STATE]

Network Working Group, D. Kristol, Bell Laboratories, Lucent Technologies; Category: Standards Track  HTTP State Management Mechanism. (ftp://ftp.isi.edu/in-notes/rfc2109.txt)

[URI]

T. Berners-Lee, R. Fielding, and L. Masinter. "Uniform Resource Identifiers (URI): Generic Syntax and Semantics." 1997. (Work in progress; see updates to RFC1738.)

[UTF-8]

F. Yergeau. "RFC 2279 -- UTF-8, a transformation format of ISO 10646." January 1998.

[UUID]

The Open Group. "Universal Unique Identifier. Appendix CAE Specification C706." DCE 1.1: Remote Procedure Call. 1997.

[VCARD]

"vCard - The Electronic Business Card Version 2.1." Internet Mail Consortium, September 18, 1996.

[XML]

T. Bray, J. Paoli, C. M. Sperberg-McQueen. "Extensible Markup Language (XML) 1.0 Specification," World Wide Web Consortium. 10-February-1998. (Recommendation)

[XML-Data]

A. Layman et al. "XML-Data"World Wide Web Consortium. 05-January-1998. (Note)

Appendix 2: Fingerprints and Canonicalization (Normative)

P3P uses fingerprints (Message Digest, Hash) as a means of identifying proposals and data sets. These fingerprints yield a fixed size value resulting from the application of a hash function to a set of data. Fingerprints are easily computed, but even small modifications to the original information result in a different fingerprint value. Consequently, fingerprints are often used as methods of assuring information integrity. We use the MD5 digest algorithm for P3P fingerprints. This yields a 128-bit value which will be encoded and exchanged in P3P communications. Both agent and service can use these fingerprints to reference a given proposal and to ensure the integrity of the transaction (validating proposal against fingerprint).

The process for generating a fingerprint is fairly straight forward. For fingerprints to be identical, the data fingerprinted by sender and recipient must be identical. Our goal is to render the data to be fingerprinted into a standard form (canonicalized) such that the effect of any reformatting by intermediaries is nullified. After this is done, we use the canonicalized version of the proposal to generate the fingerprint. Given the same proposal, both the service and agent should be able to arrive at the same fingerprint value.

Proposal canonicalization rules

• the first element in a proposal is the <PROP...> element
• all elements are upper case, and begin with the "<" character, all leading spaces must be removed.
• there must be no space between the "<" and the element name
  • for opening elements the element name, in lower case immediately follows the left bracket "<"
  • for closing elements, the left bracket is immediately followed by right slash "/" and then the element name in lower case.
• for elements with attributes
  • one space is inserted between the name of the element and attribute
  • attribute names must be lowercase followed immediately by one equals symbol "="and then immediately by the quoted attribute data; the attribute data is converted to lowercase in case the attribute is name, otherwise it is taken as literal and must not be reformatted or altered in any way
• if present, the closing right slash symbol "/" must immediately follow the final quote in attribute data
• all elements must be closed by a right bracket ">" immediately following the right slash "/" or the quoted attribute data
• all right brackets ">" must be followed by CRLF
• the proposal ends with the </PROP> element

As an example, consider the following XML:

<rdf:rdf><PROP agreeID="94df1293a3e519bb" 
 realm="http://www.CoolCatalog.com/catalogue/" entity="CoolCatalog" 
 assurance="http://www.TrustUs.org">
  <USES>
  <STATEMENT consq="A site with clothes you'd appreciate."
   purp="2,3" recpnt="0" id="0">
    <WITH><PREFIX name="User.">
      <REF name="Name.First"/>
      <REF name="Bdate.YEAR" optional="1"/>
      <REF name="Gender"/>
    </PREFIX></WITH>
  </STATEMENT>
  </USES>
  <USES>
  <STATEMENT action="rw" purp="0" recpnt="0" id="1">
    <REF name="User.shipping."/>
  </STATEMENT>
  </USES>
  <DISCLOSURE discURI="http://www.CoolCatalog.com/PrivacyPractice.html" 
   access="3" other="0,1"/>
</PROP></rdf:rdf>

After canonicalization, it would look like:

<PROP agreeID="94df1293a3e519bb" realm="http://www.CoolCatalog.com/catalogue/" entity="CoolCatalog" assurance="http://www.TrustUs.org">
<USES>
<STATEMENT consq="A site with clothes you'd appreciate." purp="2,3" recpnt="0" id="0">
<WITH>
<PREFIX name="user.">
<REF name="name.first"/>
<REF name="bdate.year" optional="1"/>
<REF name="gender"/>
</PREFIX>
</WITH>
</STATEMENT>
</USES>
<USES>
<STATEMENT action="rw" purp="0" recpnt="0" id="1">
<REF name="user.shipping."/>
</STATEMENT>
</USES>
<DISCLOSURE discuri="http://www.CoolCatalog.com/PrivacyPractice.html" access="3" other="0,1"/>
</PROP>

Generating the MD5 fingerprint

Once the proposal is canonicalized, we use the MD5 algorithm to generate the P3P fingerprint. This section provides an overview of MD5 and an explanation of how a MD5 digest is encoded.

MD5 Overview

The MD5 hash algorithm is defined in

The MD5 Message Digest Algorithm, R.L. Rivest, RFC 1321, April 1992

The MD5 algorithm (Message Digest 5) is a cryptographic message digest algorithm.

MD5 was designed by Ron Rivest, who is also the `R' in `RSA' in 1991. MD5 is described in RFC1321. C source code is included with the RFC. It is basically MD4 with "safety-belts" and while it is slightly slower than MD4, it is more secure. The algorithm consists of four distinct rounds, which have a slightly different design from that of MD4. Message-digest size, as well as padding requirements, remains the same. Den Boer and Bosselaers [B. den Boer and A. Bosselaers. Collisions for the compression function of MD5. In Advances in Cryptology - Eurocrypt '93, pages 293-304, Springer-Verlag, 1994.] have found pseudo-collisions for MD5 (see RSA FAQ Question 98), but there are no other known cryptanalytic results.

The MD5 algorithm takes as input a message of arbitrary length and produces as output a 128-bit "fingerprint" or "message digest" of the input. It is conjectured that it is computationally infeasible to produce two messages having the same message digest, or to produce any message having a given prespecified target message digest. The MD5 algorithm is intended for digital signature applications, where a large file must be "compressed" in a secure manner before being encrypted with a private (secret) key under a public-key cryptosystem such as RSA or PGP.

For further information on MD5, see:

• RSA Labs FAQ -- Q94: What is a Hash Function?
• RSA Labs FAQ -- Q101: What Other Hash Functions Are There? 

P3P Encoding

Computing the MD5 digest yields 4 32-bit values. All values are encoded using the standard base-64 representation of a byte-array containing the two's-complement representation of the value to encode. The first byte in this array is the high-order byte. The minimal number of bytes necessary is used to represent a certain value, so no leading zero-bytes are allowed.

The BNF below shows how a MD5 digest is encoded for P3P communications.

resource-hash     = '"base64-string encoding of 128 bit MD5 message
                      digest of the information resource."'
base64-string     = as defined in RFC-1521, section 5.2.

Appendix 3: XML DTDs (Non-normative)

Hypertext versions of the DTDs can be found below. Note, the path of the URIs does not actually point to the URI specified, rather to its HTML version. However, the path in the URI as specified below is the one used in examples in this specification.

http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd

http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/practices.dtd

http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/categories.dtd

Appendix 4: Line-flow Scenario (Non-normative)

This scenario is based on scenarios 1/5 and 3 and includes negotiation.

A user directs their Web browser to go to home page of CoolCatalog. She has never been there before; she requests a P3P proposal as part of the request by advertising that her browser understands P3P.

GET / HTTP/1.1
Accept: */*
User-Agent: BugblatterBeast/3.02 (RT-11; English)
Host: www.CoolCatalog.com
OPT: "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd"; ns-42

CoolCatalog sends a proposal, including privacy practices, disclosures, and the data elements to which they apply. In this instance, the service asks to be given the PUID as part of the returnID automatically in the future and requests the user's gender from the user repository.

HTTP/1.1 409 Agreement required
Server: Marvin/2.0.1
OPT: "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd"; ns-1944
1944-P3P1.0: <?xml:namespace ns="http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd" prefix="P3P"?>
<?xml:namespace ns="http://www.w3.org/TR/WD-rdf-syntax#" prefix="RDF"?>
<PROP realm="http://www.CoolCatalog.com/" entity="CoolCatalog" 
 assurance="http://www.TrustUS.org" />
  <USES>
  <STATEMENT purp="2" id="0" recpnt="0" consq="a personalized site!"/> 
    <REF name="Web.PUID"/>
    <REF name="User.Gender"/>
  </STATEMENT>
  </USES>
  <DISCLOSURE text="http://www.CoolCatalog.com/PrivacyPractice.html" 
   access="3" other="0,1"/>
</PROP>
</P3P>
Content-Type: text/html
Content-Length: 110

<html><body>
<h1>HTTP/1.1 409 Agreement Required</h1>
<p>We need an agreement before we can continue.</p>
</body></html>

[Note that the proposal is split across multiple lines for readability; over the network, a CRLF pair would be added only after the </PROP>. We will use this in the example lineflows below as well.]

The user refuses this proposal. Imagine that the agreementID (hash) of the above proposal is "e3a5d71297d104f1"; the user's next HTTP request would look like the following:

GET / HTTP/1.1
Accept: */*
User-Agent: BugblatterBeast/3.02 (RT-11; English)
Host: www.CoolCatalog.com
OPT: "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd "; ns-1776
1776-P3P: <SRY r="432" agreeID="e3a5d71297d104f1" />

The site offers a new proposal, this time it requests the automatic returnID, and from the user's repository the first name and optional age, both for the purposes of customizing the site.

HTTP/1.1 409 Agreement required
Server: Marvin/2.0.1
OPT: "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd"; ns-1492
1492-P3P1.0: <?xml:namespace ns="http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd" prefix="P3P"?>
<?xml:namespace ns="http://www.w3.org/TR/WD-rdf-syntax#" prefix="RDF"?>
<PROP realm="http://www.CoolCatalog.com/" entity="CoolCatalog" 
 assurance="http://www.TrustUs.org"/>
  <USES>
  <STATEMENT purp="2" id="0" consq="a personalized site!">
    <WITH><PREFIX name="User.">
      <REF name="Name.First"/>
      <REF name="Bdate.Year" optional="1"/>
    </PREFIX></WITH>
    <REF name="Web.PUID"/>
  </STATEMENT>
  </USES>
  <DISCLOSURE text="http://www.CoolCatalog.com/PrivacyPractice.html" 
  access="3" other="0,1"/>
</PROP>
</P3P>
Content-Type: text/html
Content-Length: 110

<html><body>
<h1>HTTP/1.1 409 Agreement Required</h1>
<p>We need an agreement before we can continue.</p>
</body></html>

The user agrees only to the provision of the automatic returnID and first name for customization only, and sends the data. Assume that the agreementID of the above proposal is "94df1293a3e519bb".

GET / HTTP/1.1
Accept: */*
User-Agent: BugblatterBeast/3.02 (RT-11; English)
Host: www.CoolCatalog.com
OPT: "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd"; ns-1861
1861-P3P1.0: <TXD r="200" agreeID="94df1293a3e519bb" >
 <REF purp="2" name="User.Name.First" value="Josephine"/>
 <REF purp="2" name="User.PUID" value="1234567"/>
</TXD>

At this point, the service would return the CoolCatalog homepage.

HTTP/1.1 200 OK 
Server: Marvin/2.0.1
OPT: "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd"; ns-1950
1950-P3P: <OK DH="s24fd20kuqexg5xk" />
Content-Type: text/html
Content-Length: xxx
[content of the CoolCatalog homepage]

The user returns to the site a day later, sending the returnID automatically.

GET / HTTP/1.1
Accept: */*
User-Agent: BugblatterBeast/3.02 (RT-11; English)
Host: www.CoolCatalog.com
OPT: "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd "; ns-2001
2001-P3P: <TXD agreeID="94df1293a3e519bb" >
 <REF name="User.PUID" value="1234567"/>
</TXD>

However, the server again needs the user's first name, so it asks for it under the previous agreement.

HTTP/1.1 409 Agreement required
Server: Marvin/2.0.1
OPT: "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd"; ns-2010
2010-P3P: <PROP agreeID="94df1293a3e519bb"/>
</PROP>
</P3P>
Content-Type: text/html
Content-Length: 70

<html><body>
<h1>HTTP/1.1 400 Agreement Required</h1>
</body></html>

The user returns herfirst name and PUID.

GET / HTTP/1.1
Accept: */*
User-Agent: BugblatterBeast/3.02 (RT-11; English)
Host: www.CoolCatalog.com
OPT: "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd"; ns-1968
1968-P3P1.0: <TXD agreeID="94df1293a3e519bb" >
 <REF name="User.Name.First" value="Josephine"/>
 <REF name="User.PUID" value="1234567"/>
</TXD>

The service would then respond with their homepage, as before:

HTTP/1.1 200 OK 
Server: Marvin/2.0.1
OPT: "http://www.w3.org/TR/1998/WD-P3P10-syntax-19980702/proposal.dtd"; ns-1950
1950-P3P1.0: <OK DH="s24fd20kuqexg5xk" />
Content-Type: text/html
Content-Length: xxx
[content of the CoolCatalog homepage]

Appendix 5: ABNF Notation (Non-normative)

The formal grammar of P3P is given in this specification using a slight modification of the ABNF defined in http://info.internet.isi.edu/in-notes/rfc/files/rfc2234.txt . The following is a simple description of the ABNF.

name = (element) 

where <name> is the name of the rule, <elements> is one or more rule names or terminals combined through the operands provided below. Rule names are case-insensitive. 

(element1 element2)

elements enclosed in parentheses are treated as a single element, whose contents are strictly ordered.

<a>*<b>element

at least <a> and at most <b> occurrences of the element.

(1*4<element> means one to four elements.)

<a>element

exactly <a> occurrences of the element.

(4<element> means exactly 4 elements.)

<a>*element

<a> or more elements

(4*<element> means 4 or more elements.)

*<b>element

0 to <b> elements.

(*5<element> means 0 to 5 elements.)

*element

0 or more elements.

(*<element> means 0 to infinite elements.)

[element]

optional element, equivalent to *1(element).

([element] means 0 or 1 element.)

"string" or 'string'

matches a literal string matching that given inside the double quotes.

Other notations used in the productions are:

; or /* ... */

comment.

Appendix 6: Working Group Contributors (Non-normative)

This work was based on other documents, specifically the

• P3P Protocol White Paper
• P3P Harmonized Vocabulary Specification

as well as the :

• P3P Grammatical Model and Data Design Model Working Draft
• P3P Architecture Working Draft