What is the preferred way to handle P3P for a young startup or a small (possibly academic) project? As I see it, there are seven relevant facts: 1. The intent of P3P is to make it so that you are personally, legally bound to enforce particular privacy guarantees. 2. The attempt to make a P3P standard has been abandoned for half a decade, and only one browser maker supports it, largely for historical reasons. Document…
If I read correctly, the article says that of the top 10000 sites 95% do have a valid P3P header. Does that make a decision any simpler for an aspiring startup?
No, he just said 5% had an invalid header, no claims were made about how many had valid headers. And unless he's actually audited any of the websites to see if what they're claiming in their P3P policies corresponds with how they actually use their cookies then how many sites have well formed headers is beside the point.