A federal judge Tuesday ruled that Google must turn over a YouTube logging database containing 12TB of data that includes user log-in IDs, IP addresses and video viewing habits to Viacom International. The media and entertainment firm had sought the data -- recorded once a user starts to watch a YouTube -- as part of its US$1 billion copyright lawsuit against Google's video unit.

Judge Louis Stanton denied Viacom's request for access to YouTube search source code. Viacom claimed that it needed the data "to compare the attractiveness of allegedly infringing videos with that of non-infringing videos," the order noted.

Google had argued that disclosing the data would raise user privacy concerns - contending that Viacom could determine viewing and video uploading habits of YouTube users based on log in data and IP addresses. However, Stanton said that Google did not cite any legal reason not to disclose such information in civil court proceedings. Stanton dismissed Google's privacy concerns as "speculative."

In addition, the order cited a blog post written in February 2008 by Google Engineer Alma Whitten noting that in most cases, an IP address alone cannot identify a user.

Kurt Opsahl, senior staff attorney at the Electronic Frontier Foundation, noted in a blog post Thursday that the ruling is "a setback to privacy rights, and will allow Viacom to see what you are watching on YouTube."
He also asserted that the order erroneously ignored the protections of the federal Video Privacy Protection Act (VPPA), which was passed after a newspaper disclosed Supreme Court nominee Robert Bork's video dental records.

"YouTube is a 'video tape service provider' under [VPAA], because it is 'engaged in the business [of] delivery of 'audio-visual materials.' The VPPA protects 'personally identifiable information,' which is defined to include 'information which identifies a person as having requested or obtained specific video materials or services,'" he noted. "This is exactly what is in the logging database."

Opsahl went on to note that the VPAA prohibits a court from ordering the disclosure of personally identifiable information unless it can show that the information cannot be gained by any other means. Consumers must also be given reasonable notice of a disclosure order and be provided with an opportunity to contest the claim. "Today's court order made no finding that Viacom could not be accommodated by any other means, nor were the YouTube users provided with notice and an opportunity to contest the claim," he wrote.

TechCrunch blogger Michael Arrington noted in a blog post Thursday that the consequences of the release of the YouTube database could be more serious than the results of AOL's 2006 release of subscriber search data.

"Handing over user names and a list of videos they've watched to a highly litigious copyright holder is extremely likely to result in lawsuits against those users that have watched copyrighted content on YouTube," he wrote. "[The judge] clearly doesn't understand that far more data is being transferred than is necessary to comply with Viacom's core stated concern, which is to understand the popularity of copyright infringing v. non-infringing material.

"Viacom has asked for far more data than that, and there's only one use for that data: to sue individual users (or shake them down via the threat of lawsuit, which has been perfected by the RIAA) who have watched a few music videos or television shows on YouTube," Arrington said.