YouTube ordered to turn over records on users

A billion-dollar court clash between old- and new-media giants took on unexpected privacy ramifications this week when a federal judge ordered YouTube to hand over the logon names and Internet addresses of every person who has viewed material on the Web's top video site encompassing tens of millions of people.

Viacom wants YouTube's logs to help determine if unauthorized material makes up a major share of what gets watched there.

The media giant, which owns the rights to such shows as "The Colbert Report" and "South Park," is suing YouTube and corporate parent Google for copyright infringement.

Viacom General Counsel Michael Fricklas pledged "unequivocally" Thursday not to use the data to learn the real names of YouTube users to sue them for uploading unauthorized clips, as the recording industry has done to people who illegally shared music online.

Viacom said a protective order dictated that only its outside lawyers and experts could access the raw data, and that it could be used solely to make the case against Google.

But the ruling by U.S. District Judge Louis Stanton in New York shocked privacy advocates.

They fear a broader effect from Stanton's finding that so-called Internet Protocol addresses — the unique numbers assigned to each computer or device connected to the Internet — need not be strictly protected because they aren't tied publicly to individual names.

"It's a very important privacy moment," said Marc Rotenberg, executive director of the nonprofit Electronic Privacy Information Center. "It will remind folks that companies like Google are sitting on top of a lot of personal information that they can't always control."

Viacom and YouTube are discussing a plan to replace the Internet addresses with codes, a move to prevent linking a YouTube logon name with a particular computer.

If that happens, Google has no plans to appeal, according to people working on the case who demanded anonymity because of the high financial stakes in the litigation.

Google had objected to Viacom's request for the data, arguing it would violate users' privacy. But Google drew fire from privacy groups because it has written elsewhere, when defending its long-term collection of data on users' Web surfing habits, that Internet addresses aren't "personally identifiable information."

In his written order, which covered a number of requests for evidence, Stanton cited a Feb. 22 posting to Google's official blog saying that in most cases, an Internet Protocol address "without additional information" — typically from an Internet service provider — can't identify an individual.

That's not always true, and people assuming their behavior will remain private sometimes use their legal names as logon handles.

In addition to a law that protects video renters from being identified, "there is a more fundamental constitutional issue about the right to view videos anonymously, read anonymously, receive information anonymously," said Kurt Opsahl of the nonprofit Electronic Frontier Foundation.

"IP addresses are the primary means for identifying individual speakers on the Internet," he said. "It's vital that they be protected and recognized as personally identifying information."

Both organizations believe that Google and other companies should collect less personal data, save it for shorter periods and alter it so that it can't be traced to individuals.

Authorities have mixed opinions on the sensitivity of IP addresses. In Europe, regulators decided the addresses were personal data subject to significant protection.

In U.S. court cases, companies suing over defamation on the Web often have to show they have a good case — and the anonymous critics get a chance to respond — before a service provider can be forced to turn over an IP address.

Google wants to keep individual histories to show more relevant videos and to comply with laws in other countries. An IP address could reveal that a viewer is in India, for example, and therefore by law must be kept from seeing a U.S. comic mocking Gandhi, a protected national hero.

Experts said that because Wednesday's ruling covered a broad range of requests and no consumer representatives were allowed to argue against the data release, it might not set a pattern for other judges.

But other copyright plaintiffs could sue and seek user IP addresses as a means to ferret out individual names, said Jennifer Urban, director of the University of Southern California's Intellectual Property and Technology Law Clinic.

Even if only the IP addresses change hands, Urban said, "It may be that the database is not kept as secure as it is here, or it's turned over and a party decides to leak the information."

If that happens, Urban said, "then the user's expectation that their information stays on a Google server will be completely undermined."

As it stands, the order could embolden other companies to engage in fishing expeditions against other targets, to "turn a company upside down" and extract data about people's online behavior, said Kenneth D. Freundlich, an entertainment lawyer in Beverly Hills, Calif.

Viacom lost several other attempts to force evidence out of Google, including a bid to get a look at the company's source code. But statistics about the prevalence of piracy that it could generate from even anonymous user data could provide a major boost to the case, legal experts said.

Los Angeles Times reporter Dawn Chmielewski contributed to this story.