Article ID: 324013 - Last Review: July 7, 2008 - Revision: 5.2

How to configure IIS to use Platform for Privacy Preferences (P3P)

View products that this article applies to.

System TipThis article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled.

This article was previously published under Q324013

We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 7.0 running on Microsoft Windows Server 2008. IIS 7.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx (http://www.microsoft.com/technet/security/prodtech/IIS.mspx)

For more information about IIS 7.0, visit the following Microsoft Web site:

http://www.iis.net/default.aspx?tabid=1 (http://www.iis.net/default.aspx?tabid=1)

SUMMARY

This step-by-step article describes how to configure your Internet Information Services (IIS) Web site to support Platform for Privacy Preferences (P3P). You can view privacy policy information by using Microsoft Internet Explorer 6.0 or later versions.

NOTE: To follow the steps in this article, you must already have the following:

Full privacy policy for the site in an XML file, according to the P3P specification.
A policy reference file in XML format with a file name of P3p.xml, according to the P3P specification. This policy reference file must refer to the full privacy policy for your Web site.
The compact codes for the privacy policy, to be added as mini headers.

For more information about how to create the full privacy policy, policy reference, and compact codes, visit the following World Wide Web site:

http://www.w3.org/P3P (http://www.w3.org/P3P)

For more information about full privacy policy, policy reference, and compact codes, visit the following Microsoft Developer Network (MSDN) Web site:

http://msdn2.microsoft.com/en-us/library/ms537341.aspx (http://msdn2.microsoft.com/en-us/library/ms537341.aspx)

NOTE: Based on your privacy policy, the compact codes for your Web site may be different from the example in this article.

Back to the top

Configure P3P headers on an IIS Web site

For more information about how to create custom headers in IIS 7.0, visit the following Microsoft Web site:

http://technet2.microsoft.com/windowsserver2008/en/library/0a9b040d-8cd9-4f81-b876-8d23c572ac9d1033.mspx?mfr=true (http://technet2.microsoft.com/windowsserver2008/en/library/0a9b040d-8cd9-4f81-b876-8d23c572ac9d1033.mspx?mfr=true)

Click Start, point to Programs, click Administrative Tools, and then click Internet Services Manager to open the Internet Services Manager (ISM).
Select the Web site on which you want to implement P3P.
Right-click the Web site, and then click Properties.
In the Web site property sheet, click the HTTP Headers tab.
In the Custom HTTP Headers box, click Add.
In the Custom Header Name text box, type p3p.
In the Custom Header Value text box, add your compact codes. For example, to have the following mini header for your site
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
type the following in the Custom Header Value text box:
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Click OK two times.
Open Windows Explorer, and then select the content folder for the site. For the default Web site in a default installation of IIS, select C:\Inetpub\Wwwroot.
Create a new folder and name it W3c.
Copy the policy reference file (P3p.xml) to the W3c folder.
Copy the full privacy policy file to the designated folder, as coded in the policy reference file.

Back to the top

Troubleshooting

To make sure that the privacy report is served by IIS, follow these steps:

Open Internet Explorer 6.0 or later.
Locate the site.
On the View menu, click Privacy Report.
Select your site from the list.
Click Summary to view the privacy report. If P3P is configured correctly, you can see the full privacy report. If you receive the following error, P3P configuration was not successful:
Could not find a privacy policy for http://sitename. To view this site's privacy policy, contact the Web site directly.
When you are finished viewing the report, click OK, and then click Close.