The Viacom-YouTube Privacy Order

The Senate Commerce Committee is conducting a hearing today on the privacy implications of online advertising. And a week ago today, a federal district court judge ordered YouTube to turn over to Viacom its records regarding what we have been watching on YouTube, including YouTube login IDs, IP addresses and the number of times a particular video has been watched. As I note in my recent draft paper—and if you are interested, see commentary on that by Josh Wright and Hanno Kaiser—as we see increasing efforts of online content providers to engage in behavioral advertising, we are going to need to work our way through the ramifications of the databases that make ad-targeting possible.

Viacom has sued YouTube, for, among other things, secondary copyright infringement, meaning, that Viacom claims that YouTube has helped facilitate copyright infringement by users of YouTube. To conclude that YouTube is liable on a secondary-liability theory turns first on finding a primary violation by users and then by showing that YouTube should be held liable for that violation under one of copyright’s approaches for attributing a violation by one person to a second person.

Of course, all of that turns on the underlying facts. For example, under the substantial non-infringing use test set forth in the Supreme Court’s 1984 decision in Sony, the trial court would need to understand the different uses of a particular tool (the VCR in Sony, the YouTube platform in the Viacom suit). One way of assessing that might be to look at the fraction of videos that were infringing as compared to all of the videos viewed on YouTube.

So Viacom has a legitimate interest in seeing YouTube’s viewing records. But of course viewers have a privacy interest in those records as well. Exactly how many views have I contributed to The Evolution of Dance, the, I gather, most-viewed video on YouTube (currently at 91,619,702 views)? (I have watched only because I teach copyright, not because it is quite funny.)

This isn’t abstract or speculative. Indeed, after the release of some information regarding then-Judge Bork’s viewing habits came out in his Supreme Court confirmation hearings, Congress passed the Video Privacy Protection Act of 1988, codified at 18 USC 2710. (See the background page on this provided by the Electronic Privacy Information Center.)

I am unaware of any decisions assessing whether an online video provider like YouTube is covered by the VPPA, but it is written in sufficiently media-neutral terms that it appears that YouTube would be covered. If so, that triggers a number of obligations. The VPPA requires the destruction of records containing personally identifiable information “as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected.” Personally identifiable information is, unsurprisingly, a defined term and “includes information which identifies a person is having requested or obtain specific video materials or services from a videotape service provider.”

We see a number of issues quickly. Exactly what is the purpose of collecting the information? That is the trigger for the destruction obligation. When the act was written, we were focusing on the local video store. They undoubtedly recorded the videos that I rented so that they could track me down if I failed to return them. They probably didn’t use the information for much beyond that, and once I had returned the video, the need for the record had probably come and gone. That should have triggered the destruction obligation.

But my local video store wasn’t doing anything interesting with the my video records. They weren’t using the records to match ads to content or to engage in collaborative filtering so as to tell me what videos I might find of interest. Contrast that with one of my favorites, Netflix. Netflix lets me pull up my entire viewing history. I can go back and see that our first Netflix rental was the definitive work in the genre “The Adventures of Elmo in Grouchland,” mailed to us on October 18, 2001. Obviously, different purposes might result in different retention periods and therefore different destruction obligations under VPPA.

We should return to the disclosure of the video records in the Viacom case. The district court found the privacy concerns “speculative” and seemingly concluded that VPPA wasn’t in issue, because the YouTube login IDs were “anonymous pseudonyms” and that the disclosure of the IP addresses wouldn’t allow reverse engineering of identity (see at pages 13 and 14 of the order if you are reading along).

I will leave the technical side of that to others (on this, see David Robinson here and Ryan Radia here). Focus instead on the collection and disclosure of this information and consider three approaches. First, YouTube might not collect the information at all. After all, unlike my 1990 video store, I don’t need to return videos at all. No collection means no risk of turnover in lawsuits like Viacom’s. For me, that is largely a non-starter. As the Netflix example suggests, there are many ways in which this information can be put to use that directly benefit consumers. That is certainly true of recommendation engines but also should be understand to be an advantage of targeted advertising. If we are going to use advertising to pay for content—and that seems to be the only way that we are willing to pay for content on the Internet—better for both sides to have better, more focused advertising.

A second approach is to collect the information but to focus on anonymity and make the information effectively anonymous to the collector. I gather that this is one of the approaches that Microsoft is suggesting as it seeks to compete on privacy. This approach would preserve the ability to match ads with a particular individual while not making it possible to actually identify the individual. Behavioral advertising may require systematic matching of information and user without necessarily requiring any actual knowledge of the user’s identity. I don’t understand the extent to which YouTube currently does this.

A third approach would focus on making the information anonymous to someone receiving the information. So even if YouTube knows my identity and my watching habits, is there some reason that needs to be disclosed to Viacom? YouTube could strip the data of identifiers or assign new, consistent identifiers that would not reveal actual YouTube identities. Either of those would help preserve the privacy of YouTube watchers.

In this situation, I am hard pressed to understand why Viacom needs actual YouTube identities to assess secondary liability. I am not even sure that it needs identities at all as opposed to relative volumes of views for copyrighted material and for legitimately-used material. But in any event having YouTube assign new fake identities systematically should be sufficient.

And now the question: should I go change my YouTube identity? I chose the incredibly imaginative rpicker. Maybe I should find a new one.

Comments

[Chris Newman]

I don’t understand why there is any doubt that Viacom needs to take this discovery in order to prosecute its lawsuit. In order to prove secondary liability it has to prove that there is direct infringement to which YouTube is contributing. You can be sure that YouTube is going to take the position that in order to prove direct infringement, Viacom has to identify specific infringing acts. Further, YouTube has asserted in its Second Affirmative Defense that "Plaintiffs' claims are barred in whole or part by licenses, express and implied, granted or authorized to be granted by Plaintiffs." It would seem difficult to evaluate the claim that Viacom granted licenses to users without knowing who those users are and what they were doing. Similarly, in order to evaluate YouTube’s fair use defense, don’t we have to look at the contents of each allegedly infringing video clip to see whether it qualifies as a fair use of the copyrighted material? And might the fair use analysis for a given clip not also turn in part on how many times the clip is viewed? I imagine Viacom would be happy to forego the exercise of identifying users and specific viewings if YouTube were to make some stipulations that rendered the info moot. I don’t see it happening, though. If I were representing YouTube I’d be doing my best to hold Viacom’s feet to the fire on these individualized issues, in part with the goal of defeating class certification. The fact that Viacom winds up looking like a privacy bully in seeking the info it needs is gravy, letting YouTube have it both ways: Viacom can’t prove its claims without personalized info, and can’t get that info because it violates privacy.

[tony]

dont shut down youtube please