Google and Viacom have reached an agreement (pdf) to mask user IDs and IP addresses of YouTube visitors in the evidence the search engine will turn over to Viacom as part of a lawsuit concerning clips of Viacom’s shows to appear on the video-sharing site. Both companies faced a huge uproar after a federal judge ordered (pdf) the search engine to turn over to Viacom every record of every video watched by YouTube users worldwide, including users’ names and IP addresses. An IP address is a unique 32-bit numeric address that identifies a computer on a network. The new agreement reads:
When producing data from the Logging Database pursuant to the Order, Defendants shall substitute values while preserving uniqueness for entries in the following fields: User ID, IP Address and Visitor ID. The parties shall agree as promptly as feasible on a specific protocol to govern this substitution whereby each unique value contained in these fields shall be assigned a correlative unique substituted value, and preexisting interdependencies shall be retained in the version of the data produced.
It will be much more difficult to identify individual YouTube users without user IDs and IP addresses. However, privacy problems remain. In this case, Viacom and Google agreed to protect YouTube users’ privacy. But, what about the next case? The legal precedent now allows this massive privacy violation, which could be exploited by the next plaintiff seeking this type of data. The best protection would be for Google and other sites not to gather and retain the various types of personal data.
The agreement is a good start, however. As is Viacom’s recent letter to the Electronic Frontier Foundation, where Viacom promises “that we will notify you [EFF], in advance, if, for some unforeseen reason we believe that these protections need to be modified in a way that reduces the level of public privacy protections so that you have an opportunity to discuss any concerns you may have or lodge any appropriate objections with the court.”