Internet Explorer 6 Cookie Privacy Settings on Windows XP

Internet Explorer 6 (IE6) on Windows XP introduced a dedicated Privacy tab within Internet Options that managed cookie acceptance through a customizable slider mechanism. Governed by the Platform for Privacy Preferences (P3P) standard, these settings allowed users to control how first-party and third-party cookies were handled based on whether websites published compact privacy policies and required user consent for personal data tracking.

The Privacy Slider Settings

Cookie handling in IE6 was controlled via a six-level slider located under Tools > Internet Options > Privacy. Each preset applied specific rules depending on cookie origin and P3P compliance:

  • Block All Cookies: Blocks all incoming cookies from both first-party and third-party websites. Existing cookies already stored on the computer cannot be read by web servers.
  • High: Blocks third-party cookies that do not possess a compact P3P privacy policy or that use personally identifiable information (PII) without explicit user consent. It also blocks first-party cookies that use PII without implicit consent.
  • Medium High: Blocks third-party cookies lacking a compact privacy policy or using PII without explicit consent. First-party cookies using PII without implicit consent are also blocked.
  • Medium (Default): Blocks third-party cookies that lack a compact privacy policy or use personal information without implicit consent. First-party cookies that use PII without implicit consent are restricted (deleted when the browser closes).
  • Low: Accepts first-party cookies regardless of policy. Blocks third-party cookies that do not have a compact privacy policy or that use personal information without implicit consent.
  • Accept All Cookies: Saves and permits all cookies on the system, regardless of origin or privacy policy compliance.

IE6 strictly differentiated between where cookies originated:

  • First-Party Cookies: Associated directly with the domain currently visited in the address bar. These were treated more leniently by default to prevent breaking website functionality such as shopping carts and session logins.
  • Third-Party Cookies: Associated with external domains (such as embedded advertising banners or tracking scripts) distinct from the site being viewed. These faced stricter evaluation against P3P policies across most slider levels.

The P3P Standard

IE6 evaluated cookies against the Platform for Privacy Preferences (P3P) framework. Websites were expected to deploy machine-readable P3P headers detailing their data collection practices. If a site lacked a valid compact P3P policy header, or if its declared policy indicated it tracked personally identifiable data without user consent, IE6 rejected or downgraded the cookie according to the active slider level. A visual eye icon with a red warning badge appeared on the IE6 status bar whenever a cookie was suppressed.

Advanced Overrides and Site Management

Beyond the standard slider presets, IE6 provided granular controls:

  • Advanced Privacy Settings: Users could check "Override automatic cookie handling" to manually set rules for First-Party and Third-Party cookies independently (options included Accept, Block, or Prompt). This menu also included an option to "Always allow session cookies," ensuring transient session handling remained functional.
  • Per-Site Management: Through the Sites button (or "Edit" in some service packs), users could create an explicit whitelist or blacklist by entering specific domain names to either "Allow" or "Block" cookies, entirely bypassing the global slider level.