The owner of Pornhub broke privacy law by allowing intimate content to be shared on its websites without the consent of the individuals depicted, according to an investigation by the Office of the Privacy Commissioner of Canada.
The investigation found the company’s policies to moderate content were inadequate and resulted in harm to those who had content posted without their knowledge.
The commissioner’s report found “significant problems that allowed highly sensitive and intimate content to be posted online without individuals’ knowledge or permission,” the privacy office said in a news release. “This has led to severe impacts on victims, including social stigmatization, psychological damage, financial loss, and even attempted suicide.”
The investigation into Aylo, the company that owns Pornhub, was slated for release in May, 2023. But Aylo launched a court challenge to seek a judicial review before publication. The Federal Court of Appeal denied the request.
The probe started in response to a complaint from a woman who learned her ex-boyfriend had uploaded an intimate video and other images of her to the company’s websites without her consent, and included her name.
Aylo took steps to remove the content at the woman’s request, according to the investigation, but that did not stop the video from being uploaded again. The complainant hired a professional takedown service, which removed content from at least 80 websites where it had been reposted more than 700 times.
“The complainant indicated that this permanent loss of control over her intimate images led her to withdraw socially, lose a job opportunity and live in a state of constant fear and anxiety that people might recognize her from images that they had seen online,” according to the privacy office.
Aylo had a legal obligation under the Personal Information Protection and Electronic Documents Act to first directly obtain consent from the complainant and did not do so, the investigation found. In many instances, the company instead relied on the person uploading a video to confirm that the featured individuals gave consent.
Aylo’s own evidence showed this method was inadequate, according to the privacy commissioner. The investigation found that approximately 70 per cent of uploaders who did not appear in the videos themselves failed to provide the company with any proof of consent.
A spokesperson for Aylo said the complaint dates back to 2015 and that the company has overhauled its processes. “To be clear, we have already developed practices and procedures that substantially address the concerns outlined in the report,” said Sarah Bain, the vice-president of public engagement and partner at Ethical Capital Partners, the Ottawa-based private equity firm that owns Aylo. That includes verifying government-issued identification for all people appearing in uploaded content.
Privacy commissioner Philippe Dufresne said at a press conference Thursday that Aylo’s policies are still inadequate. “There are gaps, and we have found that the measures that Aylo had in place both in 2015 and more recently are not sufficient,” he said.
The company still relies on the uploader of the content to provide proof of consent, rather than seek consent directly from the individuals who are shown in videos and other media, he said.
The privacy commissioner made a number of recommendations to Aylo for it to be compliant with the law, including to immediately stop publishing user-generated content until it directly obtains consent from all individuals.
The recommendations are not binding, but Mr. Dufresne said he could seek remedies in federal court. “We will be contemplating all available options, but certainly hope that Aylo will reconsider its position,” he said. (Bill C-27, which is before Parliament, would give the privacy commissioner the power to issue binding orders and financial penalties.)
Aylo, which owns some of the most popular adult websites in the world, has been under intense scrutiny since a New York Times story in 2020 said the company, then known as MindGeek, hosted non-consensual videos on its platforms, including child sexual-abuse material. The company responded by banning videos from unverified users and purging content. Payment processors such as Visa and Mastercard cut ties with Pornhub.
Ethical Capital Partners purchased MindGeek in March, 2023, and rebranded the company as Aylo in August to have a “fresh start.”
Joe Castaldo