Wendy Seltzer points out that Wednesday's discovery order in Viacom v. YouTube, which requires Google to release the login names and IP addresses of every person who has ever viewed or embedded a YouTube video may be in contradiction to the Video Privacy Protection Act which prohibits a "video tape service provider" from disclosing "personally identifiable information." The act defines "video tape service provider" as "any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials."
It would seem difficult to argue that video-on-demand is not "similar" to video cassette rental. Google did cite this law in their argument, but the judge then cited a blog posting by one Google's own engineers that argued IP addresses are not personal because they are usually assigned dynamically. That may be true in theory, but in practice most DHCP servers hand out the same address each time a given user requests one. Many people exploit this property to host web sites on their cable modems and the address can stay the same for months, if not longer.
I suspect Google has decided not to appeal this order because if the information in their logs was held to be personally identifiable, the law would prohibit Google from retaining the data any longer than a year, a topic on which their privacy policy in conspicuously silent.
Comments
You can follow this conversation by subscribing to the comment feed for this post.