Everyone Knows What You're Watching on YouTube

YouTube has been making news this week, mostly about its recently-announced policy that makes "sexually suggestive" or "profane" content harder to access on the site. These new censorship policies which impact access to protected speech have triggered significant backlash among the YouTube user community as well as concerns that YouTube is suppressing some forms of content simply in order to "clean[] up its act to persuade Madison Ave. that the site is advertiser-friendly."

Another story, however, has slipped through the cracks thus far. The Bits blog on NYTimes.com just published an entry highlighting an egregious YouTube practice: When you "subscribe" to a "channel" on YouTube, which means asking YouTube to notify you when a specific person or company releases a new video, YouTube publicly announces this fact by putting your user information on that channel's page. [And, of course, if the verdict in the Lori Drew / MySpace case is upheld - which hopefully it won't be - it would actually be a federal crime to try to avoid this publicity by giving YouTube false information about your identity.] You're not informed about this when you sign up for an account or a channel. Even if you do find out, you can't hide your subscription; all you can do is unsubscribe and find another means to keep yourself updated about the content you want to follow.

In a nutshell, as the blog post stated, "that means that if you have some reason to want to follow videos from channels like Youth Suicide/Domestic Violence Health, ProstateCancerMD, Bankruptcy Attorneys or Best Resumes of New York, anyone in the world could find out."

It's not clear what led YouTube to implement this "feature," but neither obvious option is appealing. The first possibility is that YouTube simply failed to consider the privacy implications of publishing a list of every person who subscribes to a given channel. If so, then YouTube has some serious procedural issues to address: user privacy needs to be a primary facet of the design process of every feature, not an afterthought to be patched if and when someone notices a problem.

The other possibility is even more concerning: YouTube was aware of the possibility that this practice might reveal information that users rightly want to keep private but nonetheless decided to publish this information silently and by default, leaving only the option of unsubscribing entirely as a poor "opt-out" mechanism. Essentially, this would be a short-sighted "business' decision to maximize page views at the cost of user privacy which is likely to wind up hurting the company in the long run by eroding user trust.

Even if YouTube would like to incorporate more social networking features into its site, it has to learn from its mistakes and those of others, as Facebook did after its Beacon fiasco. The main lesson of Beacon, and one that Facebook has largely accepted, is that users need to be in charge of deciding whether and how to share their own information. By taking that choice out of users' hands, whether through a failure to consider privacy at the design stage or a conscious choice to ignore privacy considerations, YouTube missed the boat.

Fortunately, they can, and will, put privacy first if we demand it. Contact YouTube and tell them loud and clear that they should broadcast what you ask them to broadcast, and no more. And keep reading this blog as we continue to push for stronger legal protections to ensure that you, and not companies or the government, keep control over your viewing habits and your other private information.

Chris Conley is the Technology and Civil Liberties Fellow with the ACLU of Northern California.