User Content License
An OpenPrivacy Grassroots Initiative

Overview:

A User Content License (UCL) is an agreement between an Internet user and the company/individual whose web site the user is currently visiting. It provides a mechanism through which a user may inform the site she is visiting of the policies policies that must be used to protect her privacy and data. A UCL is a license or policy agreement which originates on the user's computer. Every time the user requests a web page the UCL is encoded and transferred to the server computer answering the query. At this point the server has a chance to 'opt-out' of this transaction.

Currently, when a user goes to a web site, they must agree to the privacy policy of that web site. This has a number of problems:

• Few users ever even read the privacy policy [1],[2] posted on a site, yet they are implicitly bound by its content in much the same way that "shrinkwrap" licenses bind users of software to the usually unread license agreements printed on them.
• Unlike shrinkwrap licenses, companies can change their web-based privacy policy at any time and may currently legally do so without needing to notify their existing user base [3]. Though a company may have strong privacy policies when they start up, they may later be acquired by an entity with different views or simply change their viewpoint themselves as the quantity - and thus the value - of their collected profile data grows. This can result in massive, but unfortunately legal, privacy violations.
• If a company files for bankruptcy it has little incentive to preserve your privacy. It might choose to maximize its worth by selling its customer database.
• Companies often keep credit card information within an internal database. If this system is cracked these numbers can be stolen. These are virtual gold mines for "black-hat" hackers on the Internet.

Technical:

    GET http://hailstorm.microsoft.com/ HTTP/1.0
    User-Agent: GNU/Linux and Mozilla
    UCL-User-License: UCL LICENSE/POLICY HERE
    UCL-About: http://ucl.openprivacy.org

A web site would see an encoded UCL such as:

"By responding to this HTTP request, you are accepting the practices described in this Privacy Notice. You will not give my information out to others and you understand that I maintain copyright on all original information and its compilation."

In order to be able to opt-out a web site must have a reliable mechanism to determine what policies are encoded here. The Platform for Privacy Preferences (P3P) [5] could be used to resolve this and related issues and we may add additional HTTP headers and payloads so that web sites have better mechanisms to opt-out.

Future Directions: