• by Wendy Davis , Staff Writer @wendyndavis, July 3, 2008

Privacy advocates are condemning a federal judge's ruling ordering Google to give Viacom information about which users watched what videos on YouTube.

Viacom had asked for the information as part of its $1 billion copyright infringement lawsuit against video-sharing site YouTube. Viacom aims to show that a large proportion of clips watched on the site are pirated.

The judge in the case, Louis Stanton, ruled in Google's favor in significant respects. He ruled that Google need not reveal its search formula or its details of its ad platform. But he also ruled that Viacom could obtain data about users' activity on YouTube, including their screen names and IP addresses.

He held that such logs didn't compromise users' privacy because screen names are pseudonymous. Additionally, he wrote, IP addresses alone can't identify users. To support the latter proposition, he quoted Google's public policy blog, which argued that IP addresses should not be considered personally identifiable information.

Pundits lost no time in criticizing that holding. "I say this with the utmost respect, but Judge Stanton is a moron. And Google simply cannot hand this data over without facing a class action lawsuit of staggering proportions," writes Michael Arrington of TechCrunch.

The Electronic Frontier Foundation also takes Stanton to task. "The Court's erroneous ruling is a set-back to privacy rights, and will allow Viacom to see what you are watching on YouTube. We urge Viacom to back off this overbroad request and Google to take all steps necessary to challenge this order and protect the rights of its users," the group said in a statement.

In fact, whether IP addresses should be considered personally identifiable is a subject of huge debate. Regulators in Europe have indicated that IP addresses are personal data. Google, which stores uses' search queries by IP address, contests that notion, arguing that in most cases, IP addresses can't in themselves be used to identify specific users. Google says it needs to keep IP logs of search requests to improve its search engine and to fight click fraud.

In the U.S., privacy advocates and search engines have faced off on this issue, but without any resolution.

The EFF and other observers have pointed to AOL's "Data Valdez" -- the data breach that occurred when an employee posted three months' worth of search queries for 650,000 users -- as proof that IP addresses can reveal identity. But there, it wasn't the IP addresses that revealed people's identities; rather, it was the substance of the searches. The IP addresses had been "anonymized," but people's identities were ascertainable because they typed their names or addresses or other key information into the query box.

With YouTube, it's not clear that simply knowing what videos were watched will reveal people's identity the same way that learning their search history could. Still, it could happen. Additionally, as the EFF points out, YouTube users didn't have the opportunity to come into court and oppose Viacom's request. For that reason alone, Stanton should rethink his decision.