Mislav: Yes, the labels should be an early step, but there have already been some substantial efforts in that direction (see Rundle and Helton), so I focused my efforts in the paper on strategy. I would be happy to create another page on the wiki for more suggestions on what the final icon set should look like though if people are interested in participating in that discussion. As far as getting companies to adopt the machine-readable privacy statements, the shortest (and probably unlikeliest) method would be to get the FTC to require it. Barring that deus ex machina, I'm not sure we want to allow companies to exercise any kinds of controls since that would defeat the purpose of creating demand-side feedback on the suppliers. Creative Commons doesn't need publishing companies to tell them how to fashion their licenses, and if the Free World likes the idea of a Privacy Commons, I don't see why we would need companies to cooperate on the creation side, they can implement the privacy policies as they like (or else they probably wouldn't mean much to begin with).

Andre: I agree. Once I found Ghostery, I was somewhat back to the original core of my idea, which is to parse privacy policies by assessing the self-imposed legal limitations (which P3P has shown to be a Very Hard Problem) and supplementing that data with other known or admitted practices. Adoption still seems like a challenge, but I would agree that there is no reason for the free world not to leverage as much of these tools as possible into one package (with freely separable elements, of course). Your average user is just going to install the most popular add-on that does what they think they want it to do. This is probably why AdBlock? gets installed by most users, but EasyPrivacy? does not.

-- RickSchwartz - 04 May 2009