Hacker News Reader

>Seriously I have to go lookup what each of these acronyms are in order to figure out how my privacy is being violated?

No, you don't. This is mentioned in the article.

I came to the comments to say pretty much the same thing. While it's a good idea in theory, P3P is a terrible standard. It's hard to implement because there are so many acronyms and no easy reference for them.

As mentioned in the article, IE has had the basic implementation of blocking 3rd party cookies if you don't use P3P for a while. I've always wanted to use honest P3P headers but it's such a PITA to generate them correctly site-by-site. Many frameworks include a generic P3P header by default with little or no mention in documentation so that's what I end up using.

I spent many hours read specs, tutorials, and trying out P3P generators to no avail. Finally I decided it's not worth my time and just used default framework P3P headers.

> There is no real enforcement behind it

You could say the same thing about robots.txt.

...and you would be correct.

"What guarantees do I even have that you are obeying P3P and not simply sending it to make me feel good."

This sounds like the perfect job for a legion of lawyers.