Or Best Offer: A Privacy Policy Negotiation Protocol

Privacy policy languages, such as P3P, allow websites to publish their privacy practices and policies in machine readable form. Software agents designed to protect users\´ privacy follow a "take it or leave it" approach that is inflexible and gives the server ultimate control. Privacy policy negotiation is one approach to leveling the playing field by allowing a client to negotiate with a server to determine how that server collects and uses the client\´s data. We present a privacy policy negotiation protocol, "or best offer", that includes a formal model for specifying privacy preferences and reasoning about privacy policies. The protocol is guaranteed to terminate within three rounds of negotiation while producing policies that are Pareto-optimal, and thus fair to both the client and the server.