I think the reasoning of P3P was that a site would declare what it uses the information for, and if it was found otherwise the liars would be dealt with by conv

I think the reasoning of P3P was that a site would declare what it uses the information for, and if it was found otherwise the liars would be dealt with by conventional legal means. Theoretically that should work well for legitimate companies with a lot to lose, and not so much for malicious sites with nothing to lose that work outside the law anyway. But what do you know, big sites like Google and Facebook have circumvented these P3P rules and will probably not suffer at all, even though they are clearly violating the standard to force their cookies through. But "we need to get our cookies through" is no excuse for circumvention. About 10 years ago I worked on a site that put together a P3P policy, it was a nightmare. Like many other sites, we needed multiple P3P policies. Your ecommerce site probably has different things it stores compared to your marketing pages, for example, and you certainly don't want your marketing or blog pages saying that you are storing name/address/credit-card and scaring the crap out of people wondering how you are even getting that info off their system. You can still find the decade-old tools over at p3ptoolbox.org that help you build a P3P policy, God forbid you try to build it by reading the spec. It also seems ironic that p3ptoolbox.org doesn't have a P3P policy and hasn't been updated since 2005.