By: Dale C. Campbell and Serena Crouch, Third Year Law Student at McGeorge School of Law

Internet users and privacy advocates across the nation fear they are losing the continuing battle to protect internet privacy rights.  A court decision in a lawsuit between Viacom and YouTube.com is the most recent battlefield regarding data likely to provide the video viewing habits of millions around the world.  

In March 2007, Viacom sued YouTube and Google, Inc. in the United States District Court, Southern District of New York, seeking at least $1 billion in damages for alleged copyright infringement.  Viacom claims that YouTube built its business by willfully offering Viacom’s copyright protected material such as episodes of “The Daily Show with Jon Stewart” and the cartoon “SpongeBob SquarePants.”  Viacom claims that neither YouTube nor its users are licensed to upload its material in the manner it is being used.

Viacom recently sought a court order requiring YouTube to produce various documents, one of which was YouTube’s Logging database.  Each time a video is watched, the Logging database records the login ID of the viewer, the IP address of the computer being used, and the time it was watched. Viacom requested this information to prove that Viacom’s protected videos are being watched in a higher proportion than the non-protected videos on YouTube.  With this information, Viacom hopes to prove that YouTube is gaining a financial benefit, one prong necessary to prove YouTube is vicariously liable for its users’ infringement of Viacom’s copyrighted material.  Viacom also hopes the information can be used to bar YouTube’s defense that its website is capable of substantial non-infringing uses.

YouTube opposed Viacom’s request, claiming the request was unduly burdensome because it would be expensive and time-consuming for YouTube to determine which information in the database is privileged or work product material.  However, the Court rejected that argument, holding that YouTube failed to rebut Viacom’s argument that the content of the database does not need to be viewed for privileged information because it simply records the number of times each video was viewed by members of the public.  The Court also ruled that production of the database would not be unduly burdensome because the contents, while containing twelve terabytes of information, could be copied onto a few over-the-counter hard drives.  Therefore, the burden on YouTube did not outweigh Viacom’s need for the information.  

YouTube made a second argument that disclosure of the information violated the rights of third parties because the contents of the database would disclose the viewing habits of its users. YouTube, however, did not provide independent evidence concerning how the database could be used to identify specific users. In response, Viacom argued that the login ID of YouTube’s users is an anonymous pseudonym that users create themselves and could not identify any specific individual without more information. Viacom even cited Google’s own representations on its website that, “[i]n most cases, an IP address without additional information cannot [identify its user].”  As a result, the Court found YouTube’s concern regarding privacy rights was speculative and did not outweigh Viacom’s need for the information.

The Court also noted in passing that YouTube had cited the Video Privacy Protection Act (VPPA), which prohibits videotape service providers from disclosing personal information of its customers.  However, the Court paid little attention to the law and, in fact, only mentioned it in a single footnote.  While some have argued that the Court ignored the VPPA because it narrowly interpreted the statute to apply only to videotape cassette service providers, it seems that even a broad interpretation to encompass videos on the internet would still not have benefited YouTube since YouTube failed to establish that the Logging database actually contained personal information of the viewers.

Internet privacy advocates, such as Electronic Frontier Foundation, argue that this ruling is a “set-back to privacy rights.”  The opinion of the Court, however, does not appear to overrule the VPPA nor does it appear to set a new legal precedent for future cases.

For any disclosure of information to fall under the VPPA, the provider must disclose personally identifiable information of its customers.  The Court’s ruling is based on a finding that YouTube and Google failed to meets its burden of proving that YouTube’s Logging database contains any personally identifiable information.

Privacy advocates are properly concerned that an IP address is the first step needed to identify a specific person.  Once an IP address is obtained, a computer expert can determine the internet service provider and then subpoena the internet service provider to obtain the name of the person assigned the specific IP address.  Also, Electronic Frontier Foundation has made the argument that a user’s login ID can identify a specific person if the creator, for example, decides to use their name as their login ID.

While all these arguments are correct, YouTube and Google failed to make these arguments in opposition to Viacom’s request for production of its Logging database.  In fact, YouTube failed to refute Viacom’s argument that a user’s login ID is anonymous and, without more information, cannot identify a specific person.  YouTube also failed to provide expert information that an IP address in some cases cannot identify a person, while in other cases, with a few simple steps, can be used to identify a specific person.

The Court was mindful of third parties’ rights to privacy, but found, in this case, that the Logging database did not contain such information. The Court never stated that personally identifiable information should not be protected nor did it overrule the VPPA.  It simply stated, in its brief discussion, that YouTube and Google failed to prove that their Logging database contains personally identifiable information.

Our internet privacy rights have not been fully eroded . . . yet.  Individuals should not fear the possibility of companies suing them individually by using this ruling to obtain their personal information and viewing habits.  The Court’s ruling is based on the type of information in YouTube’s Logging database and the arguments (or lack thereof) presented by both sides.  Individuals and privacy advocates should not critique the Court for granting Viacom’s motion, rather advocates should be concerned that YouTube and Google did not make a convincing argument that the information stored in their Logging database contains personally identifiable information.  The Logging database is being produced because YouTube and Google failed to meet its burden, not because the Court has cut new ground in reducing privacy rights or overruled the VPPA.