• PC World
• »Security

A federal judge's order that Google Inc. turn over 12TB of data on YouTube users and their video-viewing histories to Viacom International Inc. has sparked concerns about potential privacy violations. But according to some privacy advocates, the concerns voiced about the ruling ignore an important point -- namely, what is Google doing collecting and retaining all that data in the first place?

Viacom had asked the court for access to the information stored in the logging database as part of a $1 billion copyright infringement lawsuit filed last year against Google and its YouTube LLC video-sharing unit. U.S. District Judge Louis Stanton last week agreed with Viacom's claim that the video-viewing data could help the media and entertainment company "compare the attractiveness" of videos that allegedly infringe on its content copyrights against the appeal of those that don't do so.

Google argued that handing over the data, which also includes user log-in IDs and IP addresses, would enable Viacom to determine what YouTube users are watching and uploading. And Stanton's ruling prompted some privacy advocates to side with Google and criticize the judge for essentially giving Viacom unbridled access to what should be private viewing records.

Although such concerns are legitimate, the whole issue stems from Google's policy of capturing the viewing data, said Marc Rotenberg, executive director of the Electronic Privacy Information Center (EPIC) in Washington. "Google has a business practice of retaining all the search queries of YouTube viewers," Rotenberg said. "It is this practice that puts consumer data at risk."

The end result, he added, "is exactly what were warning about" during a court dispute between Google and the U.S. Department of Justice over Internet search data two years ago.

In that case, the DOJ subpoenaed Google to turn over records on millions of search queries that the government said it needed as part of an effort to defend the Child Online Protection Act from legal challenges. EPIC supported Google's ultimately successful effort to oppose the subpoena, Rotenberg said. But, he added, the privacy group cautioned even then that as part of the discovery proceedings in criminal or civil cases, Google could at any time be asked to turn over users' personal data.

Google's continuing habit of storing highly detailed search data so the information can be analyzed for targeted marketing purposes poses a "real concern" for U.S. residents, Rotenberg said. As the decision in the Viacom case demonstrates, "companies can't always control who has access to this sort of data," he noted.

Furthermore, Google's argument that the IP addresses stored in the YouTube logging database represent personally identifiable information is at odds with the company's previously stated views on that issue, according to Rotenberg. In cases such as its dispute with the DOJ, Google argued that IP addresses and the other search-related data was practically useless in helping anyone to identify an individual, Rotenberg said. Stanton made the same point in his July 2 ruling in favor of Viacom.

"There is a clear contradiction in Google's position, that they will assert privacy interests when it is in their favor to do so," Rotenberg said.

Jeff Chester, executive director of the Center For Digital Democracy, a not-for-profit advocacy group in Washington, agreed with Rotenberg that privacy advocates should be equally critical of Google as they are of Stanton's decision on the YouTube viewing data.

"Google is collecting huge amounts of information about YouTube users in order to expand its targeted advertising business," Chester said. Pointing to Google's recent acquisition of DoubleClick Inc. as a marker of the company's aspirations, Chester asked, "Why is Google -- and almost every other leading broadband video provider -- tracking and analyzing our online viewing habits?" Chester asked. The goal clearly is to deliver highly targeted marketing campaigns based on the Internet viewing habits and search queries of individual users, he said.

While companies such as Google have argued in the past that the data they collect isn't personally identifiable, it is "antiquated" to think of personal data as simply consisting of information such as names, birth dates, street addresses and Social Security numbers, Chester said. In the online world, IP addresses, Web-site cookies and other tracking data can help narrow down a person's identity more than may typically be assumed, he added. Some of the tracking methods being used by Google and other online companies "make Nielsen's look like it was developed in the Stone Age," Chester quipped.