Statement by the Privacy Commissioner of Canada following an investigation into Pornhub operator Aylo

February 29, 2024

Privacy Commissioner of Canada Philippe Dufresne issued the following statement following the conclusion of his Office’s investigation into a complaint against Aylo (formerly MindGeek), which operates Pornhub and other popular pornographic websites.

(Check against delivery)

---

The distribution of intimate images and videos without consent is a growing societal problem. With a simple click of a button, someone’s intimate content can be instantly uploaded and made available to millions of people all over the world on the internet.  

The non-consensual disclosure of such highly sensitive and intimate content, whether it be personal images or videos, can have extremely harmful consequences for victims.

I call this “image-based abuse” because that is what it is. A form of abuse using your image.

This form of abuse would be considered harmful content under the newly tabled Online Harms Bill C-63.

But this abuse is also a serious privacy violation and organizations currently have obligations under privacy law to take reasonable steps to prevent and remedy such violations.

Indeed, it is difficult to imagine a more serious privacy violation than the non-consensual sharing of intimate images or videos because it touches some of the most sensitive personal information and leads to some of the most devastating harms to the victim’s dignity, reputation, health and well-being.

Today, I am releasing the results of my investigation into Montreal-based Aylo, following a complaint from a woman whose ex-boyfriend had uploaded an intimate video and other images of her, along with other identifying information, to Pornhub and other Aylo-owned websites without her knowledge or consent. Following these non-consensual uploads, she subsequently began receiving unsolicited messages from strangers around the world.

At the complainant’s request, Aylo initially took steps to remove the content but the company’s privacy protections did not prevent the video from being uploaded again and again on Aylo websites. From there, it could be downloaded and then potentially shared further.

The complainant ultimately hired a professional takedown service and this led to the removal of her images from approximately 80 websites, where they had been reposted more than 700 times. Even after that, the material continued to resurface online.

This permanent loss of control over her intimate images led the complainant to live in a state of constant fear and anxiety.  

Our investigation uncovered a concerning lack of privacy protections given the vast amount of highly sensitive information under Aylo’s control, and found that the company had contravened Canada’s federal private sector privacy law.

Our key finding is that Aylo had a legal obligation to obtain the complainant’s consent directly from her and had failed to do so.

We found that Aylo’s consent model – which relied on the uploader to attest that they had obtained consent from each person who appears in uploaded content – did not constitute reasonable efforts by Aylo to ensure that meaningful consent had been obtained from those persons.

We also found that when individuals whose images had been posted without consent asked Aylo to remove the content, they were faced with an extremely onerous and ineffective process that exacerbated the emotional toll on those victims.

I made a number of recommendations, including:

• That Aylo immediately stop sharing user-created intimate content until it adopts changes to comply with privacy law, including measures to obtain express, meaningful consent directly from each individual who appears in uploaded content;
• That Aylo adopt measures to verify that consent is obtained from the individuals appearing in the content and that those individuals are of an age to provide consent; and
• That Aylo delete all content for which valid consent had not been obtained directly from each individual.

Aylo has disagreed with these findings and refused to commit to implementing my recommendations.

While Aylo made changes to its consent practices in recent years, the company has not provided my Office with evidence that it is obtaining meaningful consent directly from everyone appearing in images and videos that are posted on its websites.

When my report of findings was nearing completion last May, Aylo launched a judicial review application with the Federal Court seeking to challenge our findings and recommendations and prevent us from finalizing and releasing the report. Aylo was ultimately unsuccessful and this is why I am able to issue this final report today.

In conclusion, the inadequate privacy protection measures on Pornhub and other Aylo sites have led to devastating consequences for the complainant and other victims of non-consensual disclosure of intimate images. This must be addressed now.

Privacy is a fundamental right. In today’s digital world, where information is shared instantaneously and, in many cases, lives online forever, organizations need to ensure that valid consent is obtained – especially when dealing with content as personal and highly sensitive as intimate images and videos.