Search


  • Categories


  • Archives

    « Home

    MediaPost: Court: IP Addresses Are Not ‘Personally Identifiable’ Information

    MediaPost reports on a recent decision (pdf) from a federal district court in Washington, where the court ruled that IP addresses are not considered “personally identifiable information.” This decision comes a year after Google and Viacom faced a huge uproar after a federal judge ordered (pdf) the search engine to turn over to Viacom every record of every video watched by YouTube users worldwide, including users’ names and IP addresses. In the end, the companies agreed to mask the IP addresses and user IDs. An IP address is a unique 32-bit numeric address that identifies a computer on a network.

    “In order for ‘personally identifiable information’ to be personally identifiable, it must identify a person. But an IP address identifies a computer,” U.S. District Court Judge Richard Jones said in a written decision.

    Jones issued the ruling in the context of a class-action lawsuit brought by consumers against Microsoft stemming from an update that automatically installed new anti-piracy software. In that case, which dates back to 2006, consumers alleged that Microsoft violated its user agreement by collecting IP addresses in the course of the updates. The consumers argued that Microsoft’s user agreement only allowed the company to collect information that does not personally identify users. Microsoft argued that IP addresses do not identify users because the addresses don’t include people’s names or addresses. The company also said that it did not combine IP addresses with other information that could link them to individuals. […]

    Eric Goldman, director of the High Tech Law Institute at Santa Clara University, points out that the European Union considers IP addresses to be personal information. Last year, the EU said that search engines should expunge users’ IP addresses as soon as possible.

    Additionally, a court in New Jersey ruled last year that Internet service providers can’t disclose users’ IP addresses without a subpoena, on the theory that people expect their IP addresses will be kept private.

    3 Responses to “MediaPost: Court: IP Addresses Are Not ‘Personally Identifiable’ Information”

    1. MediaPost: Court: IP Addresses Are Not ‘Personally Identifiable’ Information | Real Rumors Says:

      […] MediaPost: Court: IP Addresses Are Not ‘Personally Identifiable’ Information 08.07.2009 | Posted in Computer World MediaPostreports on a recent decision (pdf) from a federal district court in Washington, where the court ruled that IP addresses are not considered “personally identifiable information.” This decision comes a year after Google and Viacom faced a huge uproar after a federal judge ordered (pdf) the search engine to turn over to Viacom every record of every video watched by YouTube users worldwide, including users’ names and IP addresses. In the end, the companies agreed to mask the IP addresses an Read the original: MediaPost: Court: IP Addresses Are Not ‘Personally Identifiable’ Information […]

    2. Jay Says:

      If anyone cared to resolve the host name of my static IP address, they would see that it in fact does identify a person … my wife. I’ve never used a proxy, VPN, or any kind of IP spoofing software, but considering the data that people are able to glean off my internet usage, I’m much more inclined to do so. Well, I haven’t read Judge Jones’s opinion, but based on the info above, I feel he’s wrong. IP addresses do identify a computer, which in turn can be then used to identify the person(s) using that computer. It doesn’t take any great leap of logic to see the potential for abuse here.

      Anyway, Melissa, would it be possible to change your blog settings to show more of the articles’ contents or perhaps in full? It’s a bit frustrating only to get a dozen lines before seeing that “read more” link, especially when that link only gives you a few more lines. Not a huge deal, but it would certainly make me happier when I read your blog — something I do often. :)

      Thx,
      J

    3. Privacy Lives Says:

      Hi Jay,

      The opinion is very odd. The plaintiffs directed the judge to Microsoft’s own Web security glossary, which included IP addresses in its definition of “personally identifiable information.” The judge, however, supported Microsoft’s contention that “because the security glossary is not part of the [End User License Agreement] or incorporated by reference therein, the security glossary is irrelevant to construing the contract claim.” He held, “Furthermore, the court finds that Microsoft’s interpretation of ‘personally identifiable information,’ in the absence of any definition, is the only reasonable interpretation.” And Microsoft claims in this lawsuit that IP addresses cannot identify a person.

      I’m sorry the blog setup is frustrating, but it’s the only way for me to keep six items on the home page without creating a really long home page.

      Thanks for commenting!