• by Wendy Davis  @wendyndavis, July 7, 2008

For years, privacy advocates have said that Google retains more information about its users than is wise. Now, some advocates say that a decision last week in a copyright infringement lawsuit proves they were right.

"From the privacy perspective we're feeling like we've got a big, 'I told you so,' " said Marc Rotenberg, executive director of the Electronic Privacy Information Center.

Last week, U.S. District Judge Louis Stanton ordered Google to disclose records showing which users watched particular videos on YouTube as part of Viacom's $1 billion copyright infringement lawsuit. (Stanton ruled in Google's favor on other key issues, holding that the company need not reveal its search formula or details of its ad program.)

Viacom intends to use the data about viewing habits to show that pirated clips are popular with users. The records that Stanton ordered turned over include YouTube users' IP addresses, which some advocates say should be considered personally identifiable information because they can be used to discover people's names. In Europe, some privacy regulators have said that IP addresses are personal data.

Google has steadfastly said it needs to retain information about users' IP addresses to improve the quality of its code and also to guard against click fraud. The company maintains that it keeps the information secure and would never willingly divulge it.

But Rotenberg, along with other advocates, has often noted that the decision might be taken out of Google's hands. And, they say, that's exactly what happened in the Viacom litigation.

"Google keeps too much data about their users," Rotenberg said. "There will be circumstances such as discovery orders and search warrants where Google will have to turn that data over."

Meanwhile, the digital rights group Electronic Frontier Foundation is condemning the decision, calling it a setback for privacy rights and urging Google to challenge it.

Kurt Opsahl, a lawyer with the group, told Online Media Daily Thursday that the organization is weighing whether to get involved. "A motion to intervene is certainly possible," he said. "We're considering all options, but have not yet decided on the best course of action."

Google said Thursday it was not going to seek reconsideration of the court's order, but will try to preserve users' rights. "We will be asking Viacom to respect users' privacy and allow us to anonymize the logs before producing them under the court's order," Google senior litigation counsel Catherine Lacavera said.

But people's identities can be found from even "anonymized" IP addresses, especially if they've provided clues by, say, conducting searches on their own names or other identifying information. Two years ago, after AOL released search query logs for 650,000 users, The New York Times figured out a user's identity and run an article profiling her within days.

Viacom Thursday also issued a statement seeking to allay concerns. The company said all material turned about YouTube users will be handled confidentially.