Sites using Attribute Exchange or Simple Registration (to get the user's email address, etc) must include the site's privacy policy url in the openid.sreg.policy_url request parameter, as documented in Section 3 of the Simple Registration spec:
http://openid.net/specs/openid-simple-regi...ion-1_1-01.htmlUnfortunately, the authors of the Attribute Exchange spec forgot to include the Privacy Policy request parameter in the Attribute Exchange 1.0 spec, so you'll still need to use SREG to pass us the privacy policy, even if you're using AX. The next version of the AX spec will include a way for sites to include their privacy policy.
The privacy policy URL must be contained within the openid.realm of the request, and must also return HTTP 200. (The Yahoo OP will fetch the privacy policy to make sure that it's a valid page)