Towards automatic negotiation of privacy contracts for Internet services

Concerns of users about the privacy of their data are becoming more important to providers of online services, as they develop into a major barrier for broad acceptance of applications, that gather data about their users. With P3P there exists a standard that, in the context of web-based applications, gives users some control over the gathering, use and relaying of their data. However, P3P still lacks a negotiation mechanism. This article outlines basic mechanisms that can be used to implement a privacy negotiation protocol. Our ideas extend the expressiveness of the P3P languages and provide means to improve their negotiation strategy to service users as well as to service providers. We also discuss open issues such as how to make sure that the negotiation will terminate.