YouTube, Viacom Fight Over Users

Court Order for Viewer Data on YouTube Stirs Privacy Concerns
By DON CLARK, JESSICA E. VASCELLARO and JAMIE HELLER
July 5, 2008; WSJ

A federal-court order that requires Google Inc. to provide information
about videos watched on YouTube is renewing concerns about online
privacy.

At issue: A YouTube database that records each time a video is watched
and pairs that with two kinds of information about people who viewed
it.

People who put videos on the site, or comment on videos or want to do
other activities such as view mature content have to sign up for an
account on the site. Under the judge's order, Google would have to
deliver the log-in names that users created to sign up for those
accounts. For the many people without accounts, Google stores -- and
would have to provide -- numbers called IP addresses that some privacy
experts fear can be linked with individual users.

Viacom Inc., pressing a copyright case against Google, the parent of
YouTube, is seeking the data to help prove how often its copyright-
protected videos are watched, compared with amateur content on
YouTube. That data could bear on the plaintiff's argument that its
copyright-protected content helps draw users to YouTube, leading to a
financial benefit for Google.

Google has resisted providing the information on privacy grounds,
arguing that it would allow Viacom to "likely be able to determine the
viewing and video uploading habits of YouTube's users," according to
court papers. After the ruling, Google asked Viacom for permission to
obscure information that might help personally identify YouTube users
before Google complies with the order.

In New York, U.S. District Judge Louis Stanton wrote that the privacy
concerns were "speculative" and argued that the YouTube database was
needed for Viacom's case because it is the only existing record of
"how often each video has been viewed during various time periods."

A Viacom spokesman said Thursday that the data the company has
requested from Google don't identify users personally and "will be
used exclusively for the purpose of proving our case against YouTube
and Google." He added that the data "will be handled subject to a
court protective order and in a highly confidential manner."

The episode highlights a debate over whether IP addresses -- the IP
stands for Internet protocol -- can be effectively used to track
activity on the Internet that users think is private. Though
additional information is usually needed to link those numbers to
individuals, privacy experts say the process is easy enough to cause
concerns for consumers.

"On the surface, it looks like the IP address is not personally
identifiable," said Larry Ponemon, chairman of the Ponemon Institute,
a research firm in Traverse City, Mich., that studies privacy issues.
"But it could in fact haunt you in the future."

In keeping records on what its users do on its sites, Google isn't
alone: Most Web sites have access to users' addresses, and many
collect even more information through sign-in procedures. But Google's
scope of activity -- and the volume of user information it can collect
-- makes it a particular target for concern about just how securely
Web companies can keep personal data.

"We realize that there's this giant vault of private information held
by Google and YouTube and other companies, and [the ruling] makes very
clear that any federal judge in the country can order access to it,"
says Tim Wu, a professor at Columbia Law School and co-author of the
book "Who Controls the Internet?" "The stuff people look for when
they're online is pretty embarrassing, about the most revealing
stuff."

Many YouTube users don't have accounts. In cases where a user doesn't
have to sign up for an account, the IP address associated with the
visitor is known, as well as possibly other information about the
user's preferences and behavior delivered through a file Google stores
on the user's browser known as a "cookie." Google also would need to
deliver those IP addresses under the order.

IP addresses can be generated in several ways, and in some cases these
addresses aren't directly associated with individuals. For example,
many Internet-service providers have a limited number of IP addresses
that are assigned to users each time they log on. In that situation,
the IP address provided to Viacom wouldn't be sufficient to identify
an individual -- unless the company was able to get information from
the service provider about what user was assigned a particular IP
address at a certain time.

Also, IP addresses can be assigned based on each PC card that allows
the machine to connect to local networks and the Internet -- such as
an employee might do at the workplace. But users' online activity
through their companies' networks is often routed through devices that
may assign one IP address to a large group of users. In that case, the
address provided to Viacom would only be sufficient to say that a user
at a company or organization viewed a video, not which individual
there.

Likewise, user information would tend to be protected if they logged
on from a cafe or other public place with wireless Internet
capability, which typically assigns IP addresses as users log on --
addresses that don't stay with the users after they log off.

For such reasons, Internet companies have often taken the position
that IP addresses aren't "user identifiable" information that should
cause privacy concerns. Indeed, Judge Stanton quoted from a Google
blog posting on the issue: People at Google "are strong believers that
the data protection laws should apply to any data that could identify
you. The reality is though that in most cases an IP address without
additional information cannot," wrote Alma Whitten, a Google software
engineer, in February.

The judge also rejected the idea that sharing the log-in names of
users with YouTube accounts would pose a privacy concern, since they
are generally pseudonyms that users make up.

Some lawyers and civil-liberties groups were harshly critical of the
judge's reasoning. Marc Rotenberg, executive director of the
Electronic Privacy Information Center, noted that IP addresses in the
past have been combined with information that people are searching for
to closely identify individuals. In other cases, just linking IP
addresses with a small group of people is sufficient; Mr. Ponemon
cites an incident where congressional staff members were found to be
anonymously editing Wikipedia entries as a case in point.

Another issue: whether the judge correctly analyzed the situation in
view of the Video Privacy Protection Act, which was designed to
protect viewer habits that could be disclosed as part of video-rental
records. Kurt Opsahl, a senior staff attorney at the San Francisco-
based Electronic Frontier Foundation, argued that he didn't. Besides
the issue of IP addresses, Mr. Opsahl criticized the judge's
conclusion about log-in names. "There are plenty of people who use
their real names as their log-in IDs," he said.
[Copyright]

Wendy Seltzer, a law professor and a fellow at Harvard's Berkman
Center for Internet & Society, argued that "this is the wrong legal
conclusion from the facts." She said the ruling could set off many new
requests for information by plaintiffs in such cases. "It should make
us as the public think twice about whether we need new and better
privacy laws," she added.

Google has plenty of company in storing sensitive information and
worries about potential leaks. In 2006, Time Warner Inc.'s AOL
accidentally released the search data of 650,000 users, and the logs
were circulated online. In that case, some data were linked with
search information to identify users. In November, the social-
networking site Facebook drew the ire of privacy advocates when it
rolled out a new feature that tracks user behavior off its site. In
response, Facebook modified the feature -- used for sharing activities
like what movies you have rented back with friends on Facebook -- to
allow users to turn it off completely.

Privacy concerns about online video, a relatively new sector of the
Internet, have bubbled up as usage has exploded and the amount of
content swelled. Besides which videos people watch, what users search
for also can reveal sensitive information.

Google, the clear leader in the online video, is at the center of the
storm. Google sites, which include YouTube, were the top U.S. video
property in April, according to comScore, with more than 4.1 billion
videos viewed, or 38% of all videos.

--Merissa Marr contributed to this article.
.

Loading