As noted in my last episode of The Web Week in Review, a federal judge has ordered that Google turn over a significant amount of data to Viacom, as part of its $1bn copyright infringement lawsuit over claims of massive copyright infringement on YouTube.
This data details what videos individual users have viewed and includes their IP addresses.
Viacom intends to use the data to demonstrate that Google could not have been unaware of the massive copyright infringement taking place on YouTube, and to show that infringing content has been a primary contributor to YouTube's popularity and success.
This would provide a strong explanation for why Google has not dealt with the issue aggressively and has instead tried to hide behind the Safe Harbor provisions of the Digital Millennium Copyright Act.
Despite the fact that Viacom itself will reportedly not have access to the data and is under a strict confidentiality order that would expose it to significant penalties if violated, the ruling by United States District Court Judge Louis Stanton has copyright infringement apologists like the Electronic Frontier Foundation (EFF) and TechCrunch's Michael Arrington up in arms.
Instead of acknowledging that YouTube's position vis-à-vis copyright made it vulnerable to lawsuits from rights holders, and that Google's thirst for user data has made consumers vulnerable to disclosure of that data as part of those lawsuits, these apologists have focused their criticisms on the court.
Arrington went so far as to state that Judge Stanton is "utterly clueless," "doesn’t seem to care much about that law" and "is a moron."
The EFF was a bit classier in its response and argues that the court's order "erroneously ignores the protections of the federal Video Privacy Protection Act (VPPA)."
It is an interesting argument that demonstrates the subjectivity that arises when laws which were written before the advent of the internet are applied to contemporary legal disputes.
The VPPA was originally designed to protect consumers from the unauthorized disclosure of their video rental records. It states:
"A video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider shall be liable to the aggrieved person for the relief provided in subsection (d)."
What is a "video tape service provider"?
"...the term 'video tape service provider' means any person, engaged in the business, in or affecting interstate or foreign commerce, of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials, or any person or other entity to whom a disclosure is made under subparagraph (D) or (E) of subsection (b)(2), but only with respect to the information contained in the disclosure."
The EFF argues that YouTube is a "video tape service provider" because it is involved in the delivery of "audio visual materials".
On the surface, this seems to have some validity. But a deeper analysis raises questions.
First, one must consider the definition of a "consumer" under the VPPA:
"...the term 'consumer' means any renter, purchaser, or subscriber of goods or services from a video tape service provider."
Clearly, a YouTube user is not a "renter" or "purchaser" and I would argue that a YouTube user is not a "subscriber" either. All of those terms by definition imply some sort of financial relationship yet the YouTube service is provided without the exchange of any monetary consideration.
Second, Section B comes under the heading "Video Tape Rental and Sale Records." In my opinion, this once again demonstrates that the law was written to protect "consumers" who are engaged in some sort of business transaction related to the "rental" or "sale" of audio visual materials. YouTube does not "rent" or "sell" anything to consumers.
Third, in trying to determine whether or not the authors of the VPPA would have intended for the law to be applicable to a service like YouTube, it's worth considering that the law applies to those providers and consumers who are engaged in a legal business transaction.
A video store owner, for instance, can legally engage in the business of renting motion pictures to consumers because of the rights afforded under the "first sale doctrine," which "permits a person who owns a lawfully-made copy of a copyrighted work to sell or otherwise dispose of the copy."
Unlike a video store owner, Google, through YouTube, is alleged to be facilitating, supporting and encouraging the distribution of content that infringes copyright.
It does not own any rights to the content it distributes and as part of its DMCA defense, argues that it is merely a "host."
Thus, it's highly questionable as to whether users of YouTube could have believed that a law such as the VPPA would be applicable to their relationship with YouTube in the same fashion they would expect it to be applicable to their relationship with a video rental store, especially given the fact that no consideration is paid and Google makes no claims as to having control over the content which YouTube delivers.
Finally, Section E of the VPPA states:
"A person subject to this section shall destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to such information under subsection (b)(2) or (c)(2) or pursuant to a court order."
Because Google has no inherent need to store much of the data that it has been ordered to hand over to Viacom, given the fact that it doesn't have to keep track of "rentals" or "sales," one must question why Google has stored such data in the first place.
The answer is quite obvious - that data may be useful in helping Google monetize YouTube.
As far as I am concerned, however, Google and its apologists cannot have it both ways.
If Google wants to use the VPPA as a defense, it should have established its belief that the VPPA applied to YouTube by implementing a policy under which this data was destroyed soon after it was collected. Not collecting it in the first place, or anonymizing it at the time of collection, seems like an even better option.
It's worth pointing out that Google's official policy is to anonymize server logs after 18 months. While it's not clear if this policy has been applied to YouTube, if it was I would again argue that Google's actions show that it did not give priority to the VPPA.
At the end of the day, I believe it is highly unlikely that the authors of the VPPA would have ever intended the law to apply to a service like YouTube and the mere existence of the YouTube data in question demonstrates that Google never truly believed that the VPPA applied to YouTube.
Of course, legal observers can and will debate these issues ad nauseum.
But the practical implication of this current court order is perhaps the most important to consider - online privacy is a myth.
The websites you browse and the content you view are being tracked and stored in massive databases - whether you like it or not and whether you're aware of it or not.
This tracking is usually done by companies like Google, which seek to profit from the data collected, but the consequences of this behavior are far-reaching. As the Viacom court ruling demonstrates, these consequences often become apparent quite unexpectedly and ensnare millions of individuals without warning.
Frankly, I find that those who are dismayed by this court order would be better served by dealing with the source and encouraging companies like Google to implement better privacy protections, whether voluntarily or through legislation.
As Electronic Privacy Information Center director Marc Rotenberg acknowledges:
"Google retains too much information about users, and as a consequence, has placed privacy at risk."
Unfortunately, it's clear that many would rather not address this issue and instead have chosen to let users learn their privacy lessons the hard way, all the while pointing fingers at the parties who aren't truly responsible.