Judge orders YouTube to expose user viewing habits and history

July 3, 2008 (Computerworld) A federal judge yesterday ruled that Google Inc. must turn over a YouTube logging database containing 12TB of data that includes user log-in IDs, IP addresses and video viewing habits to Viacom International Inc. The media and entertainment firm had sought the data — recorded once a user starts to watch a YouTube video — as part of its $1 billion copyright lawsuit against Google's video unit.

However, Judge Louis Stanton of the U.S. District Court for the Southern District of New York denied Viacom's request for access to YouTube search source code. Viacom had claimed that it needed the data "to compare the attractiveness of allegedly infringing videos with that of non-infringing videos," the order noted.

Google had argued that disclosing the log-in IDs and other data would raise user privacy concerns; the company contended that Viacom could determine viewing and video uploading habits of YouTube users based on log-in data and IP addresses. However, Stanton said that Google did not cite any legal reason not to disclose such information in civil court proceedings. Stanton dismissed Google's privacy concerns as "speculative."

In addition, the order cited a blog post written in February 2008 by Google engineer Alma Whitten noting that in most cases, an IP address alone cannot identify a user.

Kurt Opsahl, a senior staff attorney at the Electronic Frontier Foundation noted in a blog post that the ruling is "a setback to privacy rights, and will allow Viacom to see what you are watching on YouTube."

He also asserted that the order erroneously ignored the protections of the federal Video Privacy Protection Act (VPPA), which was passed after a newspaper disclosed Supreme Court nominee Robert Bork's video rental records.

"YouTube is a 'video tape service provider' under [the VPAA], because it is 'engaged in the business [of] delivery of ... audio-visual materials.' The VPPA protects 'personally identifiable information,' which is defined to include 'information which identifies a person as having requested or obtained specific video materials or services,'" Opsahl wrote. "This is exactly what is in the logging database."

He went on to note that the VPAA prohibits a court from ordering the disclosure of personally identifiable information unless it can show that the information cannot be gained by any other means. Consumers must also be given reasonable notice of a disclosure order and be provided with an opportunity to contest the claim. "Today's court order made no finding that Viacom could not be accommodated by any other means, nor were the YouTube users provided with notice and an opportunity to contest the claim," he wrote.