Google must divulge the viewing habits of every user who has ever watched any video on YouTube, a US court has ruled.

The ruling comes as part of Google's legal battle with Viacom over allegations of copyright infringement.

Digital rights group the Electronic Frontier Foundation (EFF) called the ruling a "set-back to privacy rights".

The viewing log, which will be handed to Viacom, contains the log-in ID of users, the computer IP address (online identifier) and video clip details.

While the legal battle between the two firms is being contested in the US, it is thought the ruling will apply to YouTube users and their viewing habits everywhere.

Viacom, which owns MTV and Paramount Pictures, has alleged that YouTube is guilty of massive copyright infringement....

A federal judge yesterday ruled that Google Inc. must turn over a YouTube logging database containing 12TB of data that includes user log-in IDs, IP addresses and video viewing habits to Viacom International Inc. The media and entertainment firm had sought the data -- recorded once a user starts to watch a YouTube -- as part of its $1 billion copyright lawsuit against Google's video unit.

However, Judge Louis Stanton of the U.S. District Court for the Southern District of New York denied Viacom's request for access to YouTube search source code. Viacom had claimed that it needed the data "to compare the attractiveness of allegedly infringing videos with that of non-infringing videos," the order noted.

Google had argued that disclosing the log-in IDs and other data would raise user privacy concerns; the company contended that Viacom could determine viewing and video uploading habits of YouTube users based on log-in data and IP addresses. However, Stanton said that Google did not cite any legal reason not to disclose such information in civil court proceedings. Stanton dismissed Google's privacy concerns as "speculative."

In addition, the order cited a blog post written in February 2008 by Google engineer Alma Whitten noting that in most cases, an IP address alone cannot identify a user.

Kurt Opsahl, a senior staff attorney at the Electronic Frontier Foundation noted in a blog post that the ruling is "a setback to privacy rights, and will allow Viacom to see what you are watching on YouTube."

He also asserted that the order erroneously ignored the protections of the federal Video Privacy Protection Act (VPPA), which was passed after a newspaper disclosed Supreme Court nominee Robert Bork's video rental records.

"YouTube is a 'video tape service provider' under [the VPAA], because it is 'engaged in the business [of] delivery of ... audio-visual materials.' The VPPA protects 'personally identifiable information,' which is defined to include 'information which identifies a person as having requested or obtained specific video materials or services,'" Opsahl wrote. "This is exactly what is in the logging database."

He went on to note that the VPAA prohibits a court from ordering the disclosure of personally identifiable information unless it can show that the information cannot be gained by any other means. Consumers must also be given reasonable notice of a disclosure order and be provided with an opportunity to contest the claim. "Today's court order made no finding that Viacom could not be accommodated by any other means, nor were the YouTube users provided with notice and an opportunity to contest the claim," he wrote....

...The court’s order grants Viacom's request and erroneously ignores the protections of the federal Video Privacy Protection Act (VPPA), and threatens to expose deeply private information about what videos are watched by YouTube users. The VPPA passed after a newspaper disclosed Supreme Court nominee Robert Bork's video rental records. As Congress recognized, your selection of videos to watch is deeply personal and deserves the strongest protection.

The Logging database contains:

for each instance a video is watched, the unique “login ID” of the user who watched it, the time when the user started to watch the video, the internet protocol address other devices connected to the internet use to identify the user’s computer (“IP address”), and the identifier for the video.

Google correctly argued that “the data should not be disclosed because of the users’ privacy concerns,” citing the VPPA, 18 U.S.C. § 2710. However, the Court dismissed this argument with no analysis, stating “defendants cite no authority barring them from disclosing such information in civil discovery proceedings, and their privacy concerns are speculative.”

In a footnote, the Court references the VPPA, noting that the federal law “prohibits video tape service providers from disclosing information on the specific video materials subscribers request or obtain.” It is possible that the reference to "video tapes" in the VPPA was confusing. However, the Act is not limited to the technology available at the time of its enactment.

To the contrary, the act refers to “prerecorded video cassette tapes or similar audio visual materials.” A YouTube video may not be a videotape, but certainly qualifies as audio visual material. Thus, YouTube is a “video tape service provider” under the act, because it is “engaged in the business [of] delivery of … audio visual materials.” The VPPA protects “personally identifiable information,” which is defined to include “information which identifies a person as having requested or obtained specific video materials or services.” This is exactly what is in the Logging database.

Accordingly, pursuant to this federal law, the Court may not order the production of “personally identifiable information”:

in a civil proceeding [except] upon a showing of compelling need for the information that cannot be accommodated by any other means, if—

(i) the consumer is given reasonable notice, by the person seeking the disclosure, of the court proceeding relevant to the issuance of the court order; and
(ii) the consumer is afforded the opportunity to appear and contest the claim of the person seeking the disclosure.

Today’s court order made no finding that Viacom could not be accommodated by any other means, nor were the YouTube users provided with notice and an opportunity to contest the claim.

Instead, the Court focused on some statements made by Google on its blog:

We . . . are strong supporters of the idea that data protection laws should apply to any data that could identify you. The reality is though that in most cases, an IP address without additional information cannot.

The Court also stated that Google did “not refute that the ‘login ID is an anonymous pseudonym that users create for themselves when they sign up with YouTube’ which without more ‘cannot identify specific individuals.’”

As an initial matter, this is factually insufficient. If any single one of the YouTube users in the Logging database picked a Login ID that does identify that user (i.e. if my YouTube login was kurtopsahl), then the Logging database' information about viewing habits is protected by the VPPA, even if others pick anonymous pseudonyms.

Furthermore, even Google’s IP address statement only asserts that “in most cases” the IP address is not identifiable, certainly not in all cases. Putting aside whether a Google Public Policy blog's statement on an unrelated topic can waive the privacy rights of YouTube users, the statement means that at least some YouTube users are identifiable, and must be protected by the VPPA.

In any event, the court ordered production of not just IP addresses, but also all the associated information in the Logging database. Whatever might be said about 'an IP address without additional information,' the the AOL search history leak fiasco shows that the material viewed by a user alone can be sufficient to identify the user, even with neither a login nor an IP address....