Court Approves Anonymization of YouTube Logs in Viacom Case

« More Address Book Shenanigans From Yet Another Social Networking Service | Main | The "Post-Private" Society »

July 15, 2008

Court Approves Anonymization of YouTube Logs in Viacom Case

“Defendants and plaintiffs in two related copyright infringement lawsuits against YouTube have reached a deal to protect the privacy of millions of YouTube watchers during evidence discovery, a spokesman for Google said on Monday.

“Earlier in July, a New York federal judge ordered Google to turn over YouTube user data to Viacom and other plaintiffs to help them prepare a confidential study of what they argue are vast piracy violations on the video-sharing site.

“Google said it had now agreed to provide plaintiffs’ attorneys for Viacom (NYSE: VIA) and a class action group led by the Football Association of England a version of a massive viewership database that blanks out YouTube username and Internet address data that could be used to identify individual video watchers.

More accurately, Google will be providing the database, only with IP addresses and usernames replaced by “unique values.” Here’s the agreement direct from the court papers:

“When producing data from the Logging Database pursuant to the Order, Defendants shall substitute values while preserving uniqueness for entries in the following fields: User ID, IP Address and Visitor ID. The parties shall agree as promptly as feasible on a specific protocol to govern this substitution whereby each unique value contained in these fields shall be assigned a correlative unique substituted value, and preexisting interdependencies shall be retained in the version of the data produced.”

The EFF has greeted the agreement with appropriate caution, reminding us all of AOL’s disastrous log dump:

“As we know from the AOL search history debacle, this alone is not enough to ensure privacy. However, the stipulation also provides that the parties ‘shall not engage in any efforts to circumvent the encryption’ — that is, they are not allowed to try and reverse-engineer real identities from the unique identifiers — which should be sufficient if the parties abide by this promise.”

(Link)