As ZDNet's Mary Jo Foley notes, however, Google isn't the only company that was discovered to be taking advantage of the P3P loophole. Researchers from Carnegie Mellon University's CyLab say they alerted Microsoft to the vulnerability in 2010, and just two days ago the director of the lab, Lorrie Faith Cranor, wrote about about the issue again on the TAP blog (sponsored by Microsoft, incidentally), detailing how Facebook and others also skirt IE's ability to block cookies. Indeed, Facebook readily admits on its site that it does not have a P3P policy, explaining that the standard is "out of date and does not reflect technologies that are currently in use on the web," and that "most websites" also don't currently have P3P policies. On that matter, Microsoft said in a statement to Foley that the "IE team is looking into the reports about Facebook," but that it has "no additional information to share at this time."
Update: Google's Senior Vice President of Communications and Policy, Rachel Whetstone has now issued a statement in response to Microsoft's blog post. It can be found in full after the break.
Microsoft omitted important information from its blog post today.
Microsoft uses a "self-declaration" protocol (known as "P3P") dating from 2002 under which Microsoft asks websites to represent their privacy practices in machine-readable form. It is well known - including by Microsoft - that it is impractical to comply with Microsoft's request while providing modern web functionality. We have been open about our approach, as have many other websites.
Today the Microsoft policy is widely non-operational. A 2010 research report indicated that over 11,000 websites were not issuing valid P3P policies as requested by Microsoft.