Method and system for protecting internet users' privacy by evaluating web site platform for privacy preferences policy

• US 20050257250A1
• Filed: 07/01/2005
• Published: 11/17/2005
• Est. Priority Date: 11/30/2001
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Paya, Cem, Mitchell, Darren, Dujari, Rajeev, Schwieterman, Frank M., Goldfeder, Aaron R., Purpura, Stephen J.
• Granted Patent: US 7,614,002 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system and method that evaluates privacy policies from web sites to determine whether each site is permitted to perform operations (e.g., store, retrieve or delete) directed to cookies on a user'"'"'s computer. Various properties of each cookie and the context in which it is being used are evaluated against a user'"'"'s privacy preference settings to make the determination. An evaluation engine accomplishes the evaluation and determination via a number of criteria and considerations, including the cookie properties, its current context, the site, the zone that contains the site, and any P3P data (compact policy) provided with the site'"'"'s response. The user privacy preferences are evaluated against these criteria to determine whether a requested cookie operation is allowed, denied or modified. A formalized distinction between first-party cookies versus third-party cookies may be used in the determination, along with whether the cookie is a persistent cookie or a session cookie.

Claims

1. In a client computer connected to a remote site, a system comprising:

a mechanism that receives a response from the remote site, the response including a request directed to a cookie operation and policy information;

a browser component that handles the response, including recognizing the requested cookie operation;

a cookie mechanism configured to locally perform operations on cookies; and

an evaluation engine, the evaluation engine invoked to determine whether the cookie mechanism should perform the requested operation based on an evaluation of criteria available to the client computer including the policy information.

2. The system of claim 1 wherein the evaluation engine accesses a per-site database to obtain information corresponding to at least some of the criteria.

3. The system of claim 1 wherein the evaluation engine evaluates the cookie to determine whether it is a persistent or session cookie.

4. The system of claim 1 wherein the evaluation engine evaluates the cookie with respect to the remote site to determine whether it is a first party or a third party cookie.

5. The system of claim 1 wherein the evaluation engine obtains information corresponding to a zone for the remote site to determine whether the cookie mechanism should perform the requested operation.