






22 Answers 22



What's happening


the evil eye
(source: piskvor.org)




How to solve it

Create a p3p policy






Link to the policy




Send the compact header with responses


HTTP/1.1 200 OK 
// ... other headers and content











  • 4
  • 34
  • 7
  • 1

I've spend a large part of my day looking into this P3P thing and I feel the need to share what I've found out.

I've noticed that the P3P concept is very outdated and seems only to be really used/enforced by Internet Explorer (IE).

The simplest explanation is: IE wants you to define a P3P header if you are using cookies.

This is a nice idea, and luckily most of the time not providing this header won't cause any issues (read browser warnings). Unless your website/web application is loaded into an other website using an (i)Frame. This is where IE becomes a massive pain in the ***. It will not allow you to set a cookie unless the P3P header is set.

Knowing this I wanted to find an answer to the following two questions:

  2. What do other companies do?

My findings are:

  1. No one cares. I'm unable to find a single document that suggests this technology has any legal weight. During my research I didn't find a single country around the world that has adopted a law that prevents you from putting the word "Potato" in the P3P header
  2. Both Google and Facebook put a link in their P3P header field referring to a page describing why they don't have a P3P header.

The concept was born in 2002 and it baffles me that this outdated and legally unimplemented concept is still forced upon developers within IE. If this header doesn't have have any legal ramifications this header should be ignored (or alternatively, generate a warning or notification in the console). Not enforced! I'm now forced to put a line in my code (and send a header to the client) that does absolutely nothing.

In short - to keep IE happy - add the following line to your PHP code (Other languages should look similar)


Problem solved, and IE is happy with this potato.

  • 6
    Indeed, the issue has changed significantly since 2008, when this was posted. The Web has moved on, and the consensus on P3P has settled on "nobody cares anymore." Good to know what IE does with invalid input in this case. – Piskvor left the building May 10 '13 at 8:47
  • 19
    Oh man, this is one of those hidden internet explorer gems! HttpContext.Current.Response.AddHeader("p3p", "CP=\"Internet Explorer Was Programmed By Idiots\""); That one works for me! – Michiel Cornille Nov 29 '13 at 10:29
  • 6
  • 5
  • 1
    Oh this needs to be higher! I spent hours trying to get cookies working in an IE 11 iframe. Trying all sorts of P3P combinations and getting various results depending on cookie type/expiration. Finally putting Potato in my P3P solved it. haha! – dtbaker Oct 28 '14 at 12:29




No policy file was neccesary at all.


  • 10
  • 28
  • Found a nice blog entry that explains the problem here: aspnetresources.com/blog/frames_webforms_and_rejected_cookies – Helo Jan 28 '11 at 13:17
  • 6
  • 3



CP="my compact p3p policy"





| improve this answer | |


/// <summary>
/// </summary>
/// <remarks>
/// </remarks>
public class P3PAttribute : ActionFilterAttribute
    /// <summary>
    /// </summary>
    public override void OnActionExecuting(ActionExecutingContext filterContext)


Example use:

public class HomeController : Controller
    public ActionResult Index()
        ViewData["Message"] = "Welcome!";

        return View();

    public ActionResult About()
        return View();
| improve this answer | |


| improve this answer | |

Anyone having this problem in node.js.


npm install p3p

I am using express so I add it in app.js

First require that module in app.js

var express = require('express');
var app = express();
var p3p = require('p3p');

then use it as middleware



You will get more info at:


| improve this answer | |




| improve this answer | |


| improve this answer | |
  • 23
    Yes, if you only care that it works on your computer. Not entirely practical to suggest this to every visitor. – Piskvor left the building Apr 19 '09 at 18:14


  • 1
  • 1
  • 2


| improve this answer | |
  • 1
    Good point. Note that at the time this question was posted, support for session storage was nonexistent, especially in IE. But the times, they are a-changing ;) – Piskvor left the building Jun 13 '12 at 13:42

I was investigating this problem with regard to login-off via Azure Access Control Services, and wasn't able to connect head and tails of anything.

Then, stumbled over this post https://blogs.msdn.microsoft.com/ieinternals/2011/03/10/beware-cookie-sharing-in-cross-zone-scenarios/

In short, IE doesn't share cookies across zones (eg. Internet vs. Trusted sites).

So, if your IFrame target and html page are in different zone's P3P won't help with anything.

| improve this answer | |


| improve this answer | |




| improve this answer | |

You can also combine the p3p.xml and policy.xml files as such:


    <POLICY-REF about="#policy1">
    <POLICY discuri="" name="policy1">
          <DATA ref="#dynamic.clickstream"/>
          <DATA ref="#dynamic.http"/>


<VirtualHost *:80>
  ServerName mydomain.com

  DocumentRoot /home/ubuntu/sites/shared/w3c/

  ProxyRequests off
  ProxyPass /w3c/ !
  ProxyPass /
  ProxyPassReverse /
  ProxyPreserveHost on



You can test it all with the W3C validator

| improve this answer | |
  • Does this send the header with 304 requests? Some versions of IE will actually delete cookies if you send a P3P header with a 304. – Joshua Jun 27 '14 at 18:09
  • Sorry, I do not know since I no longer work on this code. If its a problem you can probably force the status code in Apache to 200. – Kris Jul 2 '14 at 16:36

If you own the domain that needs to be embedded, then you could, before calling the page that includes the IFrame, redirect to that domain, which will create the cookie and redirect back, as explained here: http://www.mendoweb.be/blog/internet-explorer-safari-third-party-cookie-problem/

This will work for Internet Explorer but for Safari as well (because Safari also blocks the third-party cookies).

| improve this answer | |

I know it's a bit late to put my contribution on this subject but I lost so many hours that maybe this answer will help somebody.

I was trying to call a third party cookie on my site and of course it was not working on Internet Explorer 10, even at a low security level... don't ask me why. In the iframe I was calling a read_cookie.php (echo $_COOKIE) with ajax.

And I don't know why I was incapable of setting the P3P policy to solve the problem...

During my search I saw something about getting the cookie in JSON working. I don't even try because I thought that if the cookie won't pass through an iframe, it will not pass any more through an array...

Guess what, it does! So if you json_encode your cookie then decode after your ajax request, you'll get it!

Maybe there is something I missed and if I did, all my apologies, but i never saw something so stupid. Block third party cookies for security, why not, but let it pass if encoded? Where is the security now?

I hope this post will help somebody and again, if I missed something and I'm dumb, please educate me!

  • Interesting...so you're decoding the cookie in JS? – Piskvor left the building Dec 14 '12 at 9:01

This finally worked for me (after a lot of hastle and generating some policies using IBMs policy generator). You can downlod the policy generator here: http://www.softpedia.com/get/Security/Security-Related/P3P-Policy-Editor.shtml

I was not able to download the generator from the official IBM website any more.

I created these files in the root folder of my Web-App

/w3c/policy.html (Human readable format)
  1. Index.php: Just send an additional header:
header('P3P: policyref="/w3c/p3p.xml", CP="ALL DSP NID CURa ADMa DEVa HISa OTPa OUR NOR NAV DEM"');
  1. Content of p3p.xml
        <POLICY-REF about="/w3c/policy.p3p#App">
  1. Content of my policy.html file

<STYLE type="text/css">
title { color: #3333FF}
<title>Privacy Statement for YOUR COMPANY NAME</title>
<h1 class="title">Privacy Policy</h1>
<!-- "About Us" section of privacy policy -->
<h2>About Us</h2>
<p>This is a privacy policy for YOUR COMPANY NAME.
Our homepage on the Web is located at <a href="YOURWEBSITE">
This policy does not tell users where they can go to exercise their opt-in or opt-out options.
<p>We invite you to contact us if you have questions about this policy.
You may contact us by mail at the following address:
<p>You may contact us by e-mail at 
<a href="mailto:info@YOURMAIL.de">
You may call us at TELEPHONENUMBER.
<!-- "Privacy Seals" section of privacy policy -->
<h2>Dispute Resolution and Privacy Seals</h2>
<p>We have the following privacy seals and/or dispute resolution mechanisms.
Contact us for further information
<!-- "Additional information" section of privacy policy -->
<h2>Additional Information</h2>
<!-- "Data Collection" section of privacy policy -->
<h2>Data Collection</h2>
<p>P3P policies declare the data they collect in groups (also referred to as "statements").
This policy contains 1 data group.
<hr width="50%" align="center">
<h3>Group "App control data"</h3>
<p>We collect the following information:
<li>HTTP cookies</li>
<p>This data will be used for the following purposes:</p>
<li>Completion and support of the current activity.</li>
<li>Web site and system administration.</li>
<li>Research and development.</li>
<li>Historical preservation.</li>
<li>Other purposes<p>Control Flow of the application</p></li>
<p>This data will be used by ourselves and our agents.
<p>The data in this group has been marked as non-identifiable. This means that there is no
<p>The following explanation is provided for why this data is collected:</p>
<blockquote>This cookie data is only used to control the application within an iframe (e.g. a Facebook App)</blockquote>
<!-- "Use of Cookies" section of privacy policy -->
<p>Our site makes use of cookies.
Cookies are used for the following purposes:
<li>Site administration
<li>Completing the user's current activity
<li>Research and development
(Control Flow of the application)
<!-- "Compact Policy Explanation" section of privacy policy -->
<h2>Compact Policy Summary</h2>
<p>The compact policy which corresponds to this policy is:
<p>The following table explains the meaning of each field in the compact policy.
<center><table width="80%" border="1" cols="2">
<tr><td align="center" valign="top" width="20%"><b>Field</b></td><td align="center" valign="top" width="80%"><b>Meaning</b></td></tr>
<tr><td align="left" valign="top" width="20%"><tt>CP=</tt></td>
<td align="left" valign="top" width="80%">This is the compact policy header; it indicates that what follows is a P3P compact policy.</td></tr>
<tr><td align="left" valign="top" width="20%"><tt>ALL</tt></td>
Access to all collected information is available.
<tr><td align="left" valign="top" width="20%"><tt>DSP</tt></td>
The policy contains at least one dispute-resolution mechanism.
<tr><td align="left" valign="top" width="20%"><tt>NID</tt></td>
The information collected is not personally identifiable.
<tr><td align="left" valign="top" width="20%"><tt>CURa</tt></td>
The data is used for completion of the current activity.
<tr><td align="left" valign="top" width="20%"><tt>ADMa</tt></td>
The data is used for site administration.
<tr><td align="left" valign="top" width="20%"><tt>DEVa</tt></td>
The data is used for research and development.
<tr><td align="left" valign="top" width="20%"><tt>HISa</tt></td>
The data is used for historical archival purposes.
<tr><td align="left" valign="top" width="20%"><tt>OTPa</tt></td>
The data is used for other purposes.
<tr><td align="left" valign="top" width="20%"><tt>OUR</tt></td>
The data is given to ourselves and our agents.
<tr><td align="left" valign="top" width="20%"><tt>NOR</tt></td>
The data is not kept beyond the current transaction.
<tr><td align="left" valign="top" width="20%"><tt>NAV</tt></td>
Navigation and clickstream data is collected.
<p>The compact policy is sent by the Web server along with the cookies it describes.
For more information, see the P3P deployment guide at <a href="http://www.w3.org/TR/p3pdeployment">http://www.w3.org/TR/p3pdeployment</a>.
<!-- "Policy Evaluation" section of privacy policy -->
<h2>Policy Evaluation</h2>
<p>Microsoft Internet Explorer 6 will evaluate this policy's compact policy whenever it is used with a cookie.
<p><b>Note:</b> this evaluation is currently experimental and should not be considered a substitute for testing with a real Web browser.
<p><b>Satisfactory policy</b>: this compact policy is considered <em>satisfactory</em> according to the rules defined by Internet Explorer 6.

  1. Content of policy.p3p
<?xml version="1.0"?>
    <!-- Generated by IBM P3P Policy Editor version Beta 1.12 built 2/27/04 1:19 PM -->

    <!-- Expiry information for this policy -->
    <EXPIRY max-age="86400"/>

    discuri="ABSOLUTE URL TO policy.html"
    <!-- Description of the entity making this policy statement. -->
<DATA ref="#business.name">COMPANY NAME</DATA>
<DATA ref="#business.contact-info.online.email">info@YOURMAIL.eu</DATA>
<DATA ref="#business.contact-info.online.uri">YOURWEBSITE</DATA>
<DATA ref="#business.contact-info.telecom.telephone.number">YOURPHONENUMBER</DATA>
<DATA ref="#business.contact-info.postal.organization">FIRSTNAME LASTNAME</DATA>
<DATA ref="#business.contact-info.postal.street">STREET</DATA>
<DATA ref="#business.contact-info.postal.city">CITY</DATA>
<DATA ref="#business.contact-info.postal.stateprov">STAGE</DATA>
<DATA ref="#business.contact-info.postal.postalcode">POSTALCODE</DATA>
<DATA ref="#business.contact-info.postal.country">Germany</DATA>

    <!-- Disclosure -->

    <!-- Disputes -->
        <DISPUTES resolution-type="service" service="YOURWEBSITE CONTACT FORM" short-description="Dispute">
            <LONG-DESCRIPTION>Contact us for further information</LONG-DESCRIPTION>
    <!-- No remedies specified -->

    <!-- Statement for group "App control data" -->
        <EXTENSION optional="yes">
            <GROUP-INFO xmlns="http://www.software.ibm.com/P3P/editor/extension-1.0.html" name="App control data"/>

    <!-- Consequence -->

    <!-- Data in this statement is marked as being non-identifiable -->

    <!-- Use (purpose) -->
    <PURPOSE><admin/><current/><develop/><historical/><other-purpose>Control Flow of the application</other-purpose></PURPOSE>

    <!-- Recipients -->

    <!-- Retention -->

    <!-- Base dataschema elements. -->
    <DATA ref="#dynamic.cookies"><CATEGORIES><navigation/></CATEGORIES></DATA>

<!-- End of policy -->
  • It goes to the parent window server dir or an iframe server dir? – JackTheKnife Dec 22 '16 at 18:38



| improve this answer | |

For anyone trying to get the P3P Compact Policy working with static content:

It is only possible if you are able to send custom server-side response headers with the static content.

For a more detailed explanation see my answer here: Set P3P code in HTML


In Rails 3.2 I am using:

class ApplicationController < ActionController::Base  

  before_filter :set_p3p  

    # for IE session cookies thru iframe  
    def set_p3p  

I got this from: http://dot-net-web-developer-bristol.blogspot.com/2012/04/setting-p3p-header-in-rails-session.html

| improve this answer | |


| improve this answer | |
  • 1
