MediaPost reports on a recent decision (pdf) from a federal district court in Washington, where the court ruled that IP addresses are not considered “personally identifiable information.” This decision comes a year after Google and Viacom faced a huge uproar after a federal judge ordered (pdf) the search engine to turn over to Viacom every record of every video watched by YouTube users worldwide, including users’ names and IP addresses. In the end, the companies agreed to mask the IP addresses and user IDs. An IP address is a unique 32-bit numeric address that identifies a computer on a network.
“In order for ‘personally identifiable information’ to be personally identifiable, it must identify a person. But an IP address identifies a computer,” U.S. District Court Judge Richard Jones said in a written decision.
Jones issued the ruling in the context of a class-action lawsuit brought by consumers against Microsoft stemming from an update that automatically installed new anti-piracy software. In that case, which dates back to 2006, consumers alleged that Microsoft violated its user agreement by collecting IP addresses in the course of the updates. The consumers argued that Microsoft’s user agreement only allowed the company to collect information that does not personally identify users. Microsoft argued that IP addresses do not identify users because the addresses don’t include people’s names or addresses. The company also said that it did not combine IP addresses with other information that could link them to individuals. […]
Eric Goldman, director of the High Tech Law Institute at Santa Clara University, points out that the European Union considers IP addresses to be personal information. Last year, the EU said that search engines should expunge users’ IP addresses as soon as possible.
Additionally, a court in New Jersey ruled last year that Internet service providers can’t disclose users’ IP addresses without a subpoena, on the theory that people expect their IP addresses will be kept private.