Privacy policy languages, such as P3P, allow websites to publish their privacy practices and policies in machine readable form. Currently, software agents designed to protect users' privacy follow a "take it or leave it" approach that is inflexible and gives the server ultimate control.??Privacy policy negotiation is one approach to leveling the playing field by allowing a client to negotiate with a server to determine how that server collects and uses the client's data.??We present a privacy policy negotiation protocol, "Or Best Offer", that includes a formal model for specifying privacy preferences and reasoning about privacy policies.??The protocol is guaranteed to terminate within three rounds of negotiation while producing policies that are Pareto-optimal, and thus fair to both the client and the server.
Index Terms:
P3P, privacy, negotiation, protocol, privacy policy, privay policy negotiation protocol, game theory, pareto optimality, utility, preference models
Citation:
Daniel D. Walker, Eric G. Mercer, Kent E. Seamons, "Or Best Offer: A Privacy Policy Negotiation Protocol," policy, pp.173-180, 2008 IEEE Workshop on Policies for Distributed Systems and Networks, 2008