Re: Implementing p3p

You have a choice. If you have two policies, the policy for the=20
listserv pages should mention the listservs AND the web server logs and=20=

cookies (if you use cookies on those pages). The other policy would not=20=

mention the listservs. It is easier to administer a single policy that=20=

discloses all your practices in one policy. However, if you want to=20
make it clear that you don't collect PII anywhere except on the=20
listserv pages than you will want to have two policies.

I hope that helps!

Lorrie


On Feb 24, 2004, at 1:09 PM, Hamblin, Shelia wrote:

> Hello,
>
> I am trying to implement p3p on our federal website, but I am not sure=20=

> how best to do it.=A0 We collect the usual web logs and we set session=20=

> cookies, but we also have pages that allow people to join listservs.=A0=20=

> The question I have is should I combine all of these into one policy,=20=

> or separate them?=A0 If I combine them, then I have to choose (in the=20=

> <ACCESS> field) whether we collect personally identifiable information=20=

> or not, which for the most part we don't.=A0 If I create a separate=20
> policy for the listservs, then this policy does not discuss the web=20
> logs or cookies on our site.=A0 Other federal agencies seem to be =
using=20
> only one policy, but I'm not sure if this is correct.=A0 Any help is=20=

> great appreciated.
>
> Thanks,
> Shelia Hamblin
> US Department of Education
> OCIO/Development Services Group
> (202) 205-2140
>
--
Lorrie Faith Cranor <http://lorrie.cranor.org/>
(Note, as of Dec 2003 I'm at Carnegie Mellon University)
P3P Specification Working Group Chair <http://www.w3.org/p3p/>
Book: Web Privacy with P3P <http://p3pbook.com/>