News release
Pornhub operator failed to obtain meaningful consent before allowing adult content to be posted on its websites
News conference: Privacy Commissioner of Canada Philippe Dufresne will hold a news conference at 4 p.m. TODAY, February 29, 2024. For details, please see the OPC’s media advisory.
GATINEAU, QC, February 29, 2024 – An investigation by the Office of the Privacy Commissioner of Canada (OPC) has found that the operator behind Pornhub and other popular pornographic sites contravened Canadian privacy law by enabling intimate images to be shared on its websites without the direct knowledge or consent of everyone depicted.
The OPC’s investigation into Aylo (formerly MindGeek), one of the world’s largest operators of pornographic sites, was launched in response to a complaint from a woman who discovered that her ex-boyfriend had uploaded an intimate video and other images of her to Aylo websites without her consent.
The investigation uncovered significant problems that allowed highly sensitive and intimate content to be posted online without individuals’ knowledge or permission. This has led to severe impacts on victims, including social stigmatization, psychological damage, financial loss, and even attempted suicide.
“The inadequate privacy protection measures on Pornhub and other Aylo sites have led to devastating consequences for the complainant and other victims of non-consensual disclosure of intimate images,” said Privacy Commissioner of Canada Philippe Dufresne.
“Privacy is a fundamental right,” said Commissioner Dufresne. “Given the enormous risks involved, Aylo must take steps to ensure that it only posts intimate images and videos with the direct knowledge and consent of everyone appearing in the content.”
The OPC investigation also found that when individuals asked Aylo to remove content that had been posted without their consent, they were faced with an extremely onerous and ineffective process.
In an investigation report that was released today, the Privacy Commissioner made several recommendations that are aimed at bringing Aylo into compliance with Canada’s federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA).
To date, the company has not committed to implementing any of the recommendations.
Aylo is based in Montreal. Its Pornhub site is reported to be the fourth most popular site in the world after Google, YouTube and Facebook.
The complainant learned that her ex-boyfriend had uploaded an intimate video and other images of her, along with her name and other identifying details, on various Aylo websites. Subsequently, she began receiving unsolicited social media messages from strangers around the world.
At the complainant’s request, Aylo initially took steps to remove the content but the company’s privacy protections did not prevent the video from being uploaded again and again on Aylo websites. From there, it could be downloaded and then potentially shared further.
The complainant hired a professional takedown service, which led to the removal of the highly sensitive content from approximately 80 websites, where it had been reposted more than 700 times. The material continued to resurface online in the years that followed.
The complainant indicated that this permanent loss of control over her intimate images led her to withdraw socially, lose a job opportunity, and live in a state of constant fear and anxiety that people might recognize her from images that they had seen online.
In many instances, Aylo relied on uploaders to confirm that the individuals who are featured in the content had consented to its upload – despite the company’s own evidence that this method was inadequate.
For example, approximately 70% of audited uploaders, who did not themselves appear in the videos that they uploaded, failed to provide the company with proof of the consent that they had committed to obtain – specifically, identification and consent forms for all individuals depicted in the content. In these cases, Aylo posted the content on Pornhub for millions of users to see and only took it down weeks later, after the audit period was complete.
The investigation found that Aylo had a legal obligation under PIPEDA to obtain the complainant’s consent and had failed to do so. Aylo’s consent model, which relied on the uploader to attest that they have obtained consent from each individual whose highly sensitive personal information is depicted in uploaded content, did not constitute reasonable efforts to ensure that meaningful consent had been obtained from those individuals.
The Privacy Commissioner recommended that Aylo:
- Immediately stop the collection, use and disclosure of user-generated intimate images, videos and associated personal information until it has implemented measures to ensure compliance with its privacy obligations under PIPEDA;
- Delete all content for which valid consent was not obtained directly from each individual depicted in the content and ensure that any third-party processors with whom it shared the content do the same;
- Adopt measures to ensure that express, meaningful and valid consent is obtained directly from each individual whose personal information is included in uploaded content;
- Implement measures to verify that consent is obtained from the individuals appearing in the content and that those individuals are of an age to provide such consent; and
- Simplify takedown processes.
While Aylo made changes to its consent practices in recent years, the company has not provided the OPC with evidence that it is obtaining meaningful consent directly from everyone appearing in images and videos that are posted on its websites.
The investigation report was scheduled for release in May 2023, but was delayed when Aylo launched legal proceedings which prevented the Privacy Commissioner from releasing it until today.
Further reading
Report of Findings: Investigation into Aylo’s (formerly MindGeek) compliance with PIPEDA
Contact information for mediaOffice of the Privacy Commissioner of Canada
Communications@priv.gc.ca
- Date modified: