Caught in the Web
Viacom’s billion-dollar lawsuit against Google’s YouTube has enormous implications for the flow of information online. At stake is the degree to which websites will have to monitor and restrict the material that users post for others to peruse -- a community approach to content that’s at the heart of social media sites such as YouTube, MySpace and Facebook. But last week, a pretrial ruling in the case caused a furor for reasons that had nothing to do with copyrights.
Granting a request from Viacom, District Judge Louis L. Stanton in New York ordered YouTube to turn over all the data it had collected about what its users watched. As it turns out, YouTube has kept extensive records of all its users’ viewing histories, including the Internet addresses of the computers they were on at the time. And the data include not just the videos watched on youtube.com but also the YouTube clips embedded on other sites. Although the revelation might have come as a surprise to users, YouTube’s privacy policy says the company “may record information about your usage,” including the videos watched, the time spent on the site and the clips uploaded. It adds, “If you are logged in, we may associate that information with your account.”
Privacy advocates hit the panic button, saying the combination of user names and Internet addresses could provide enough information to identify individual users. Although Stanton imposed strict limits on the data, the disclosure nevertheless raised the specter of Viacom trying to identify and sue those who uploaded clips from its TV programs without permission. To their credit, Viacom and Google have been scrambling to comply with the order without disclosing the identities of any users. Yet the lawsuit illustrates how YouTube threatens its users’ privacy simply by collecting and retaining so much data. Just because Viacom isn’t interested in users’ identities doesn’t mean that other copyright holders, law enforcement agencies or aggrieved parties won’t be.
Stanton’s order is a reminder that websites shouldn’t retain personally identifiable data any longer than the law or their services require. Google argues that the data enable it to improve its services, combat fraud and personalize offerings. Its approach, though, reflects an engineer’s habit of hoarding information for the sake of as-yet-unimagined features, not the cautious practices of a privacy-conscious company. If YouTube really needs to keep months’ worth of data about what users do, the least it can do is remove the links to who’s doing it. In the meantime, users should remove the links themselves by following instructions on the site for erasing their viewing histories.
