Can P3P address embedded content?
Embedded content are all the images and things, that are loaded together with a document (e.g. an HTML-page). Normally, the embedded content comes from the same server, as the main document. This content can easily be addressed by the so called “realm”, to which a certain policy applies. Things get much more complicated, when an author embedd’s content from a site, where he has no control over the privacy policy. A perfect example to this issue are banner-ads, which come from a different server than the one serving the HTML-page. The policy-reference file would allow also to make a statement about this embedded content, if there is control of the author of a page over the privacy policy, which applies to the embedded content. In absence of control over the embedded content, the user agent will first verify the privacy-policy attached to this embedded content by a head request, before requesting the content itself. For this (Head-) request, the “Safe Zone” applies.
