The company behind Pornhub and other popular pornographic sites broke Canadian privacy law by allowing intimate images to be shared on its websites without the direct knowledge or consent of everyone depicted, the federal privacy commissioner has ruled.
The Office of the Privacy Commissioner’s (OPC) investigation into Aylo (formerly MindGeek), one of the world’s largest operators of pornographic sites, was launched in 2020 after a woman discovered that her ex-boyfriend had uploaded an intimate video and other images of her to Aylo websites without her consent.
Under its normal practice at the time, MindGeek didn’t seek the complainant’s consent to collect, use, and disclose her intimate images, the report says. Instead, the company relied exclusively on her ex-boyfriend to attest that she had consented to the video being distributed on MindGeek’s websites.
The investigation found that Aylo had a legal obligation under the Personal Information Protection and Electronic Documents Act (PIPEDA) to obtain the complainant’s consent, and had failed to do so.
The OPC made a number of recommendations that Aylo should follow to improve its processes for dealing with uploaded content. However, so far Aylo has not committed to implementing any of the recommendations.
“While Aylo made changes to its consent practices in recent years,” the commission said in a statement, “the company has not provided the OPC with evidence that it is obtaining meaningful consent directly from everyone appearing in images and videos that are posted on its websites.”
The OPC report was ready to be released last May. However, Aylo went to court and tried to block its release. It lost the challenge in a ruling issued today by the Federal Court of Appeal, which is why the report was released this afternoon.
“In its response to our preliminary report, MindGeek expressly disagreed with our findings,” the final report says, and the OPC agreed to add new facts and legal arguments from MindGeek. But, the final report says, “ultimately, MindGeek did not accept responsibility and take the necessary corrective measures to redress the significant privacy harms that we uncovered in our investigation, and has yet to offer any commitments in response to our recommendations.”
The investigation uncovered significant problems that allowed highly sensitive and intimate content to be posted online without individuals’ knowledge or permission. This has led to severe impacts on victims, including social stigmatization, psychological damage, financial loss, and even attempted suicide, the OPC says.
“The inadequate privacy protection measures on Pornhub and other Aylo sites have led to devastating consequences for the complainant and other victims of non-consensual disclosure of intimate images,” said Privacy Commissioner Philippe Dufresne.
MindGeek was founded in Montreal, and still has about 1,000 employees there. In March, 2023 it was bought by Ethical Capital Partners, a Canadian private equity firm. The company’s name changed to Aylo six months later.
The incident is an example of why Canadian law needs to be updated. While MindGeek did take down the images after the woman complained, however, says the report, the content, which could be easily downloaded by users at the click of a button, continued to be re-uploaded, both on MindGeek and on other websites (including sites unrelated to pornography). Various strangers from around the world, who had seen the video online, contacted her on Facebook using information contained in the video’s title and tags, such as her name, mother’s maiden name, university and sorority, the report says.
Ultimately, the woman had to hire a professional takedown service, which led to the removal of more than 700 instances of her intimate images on more than 80 websites. The material continued to resurface on several websites until at least 2020, and is likely still available online.
The permanent loss of control over her intimate images has had a devastating effect on the complainant, says the report, who alleged that it caused her to withdraw from her social life, lose an employment opportunity, and live in a constant state of fear and anxiety.
The government this week announced a proposed Online Harms Act that would give a Digital Safety Commission the power to order such images be removed from designated web sites within 24 hours or face large financial penalties.
Parliament is also in the middle of debating an overhaul of PIPEDA called the Consumer Privacy Protection Act (CPPA, also known as Bill C-27) that would give the OPC broader powers.
At a news conference, Dufresne noted that under the CPPA he would have the power to order Aylo to fix its operations, including immediately deleting content where persons in uploaded images or videos haven’t given express consent to be published. That would probably be the bulk of the content on all Aylo sites. However, under PIPEDA, Dufresne can only make recommendations.
With the publication of the report, he hopes Aylo “will reconsider” its silence on the recommendations.
Dufresne has one more card to play: He can ask the Federal Court to order the company to comply.
The commission recommends:
— Aylo stop allowing the upload of intimate content without first obtaining meaningful consent directly from each individual appearing in that content;
— delete all content that it previously collected without obtaining such consent;
— implement a privacy management program to ensure that it is accountable for information under its control.
— and recommended that Aylo agree to enter into a compliance agreement with the OPC and to be subject to oversight by an independent third-party reporting to the office for five years.
The commission will give Aylo time to consider its position, Dufresne said. But, he noted, the company has known about the recommendations for some time. Dufresne said he’s “looking for quick action.”
Other social media sites “should take note” of the report’s principles on what kind of consent should be obtained for allowing users to post sensitive material, Dufresne added.
This case is about “image-based abuse,” Dufresne said, and would be considered so under Bill C-63. But, he added, “this abuse is also a serious privacy violation and organizations have obligations under [current] privacy law to prevent and remedy such violations.”
“it is difficult to imagine a more serious privacy violation than the non-consensual sharing of intimate images or videos, because it touches the most sensitive personal information and leads to some of the most devastating harms to the victim’s dignity, reputation, health and well-being.”
And while Aylo deleted the images after the woman complained, that didn’t stop Aylo/MindGeek users from uploading them over and over again from their computers, he pointed out.
“Our investigation uncovered a concerning lack of privacy protections given the vast amount of highly sensitive information under Aylo’s control,” Dufresne told reporters.
“Alyo had a legal obligation to obtain the complainant’s consent directly from her, and failed to do so. We found that Aylo’s consent model, which relied on the uploader to attest that they had obtained consent from each person who appears in uploaded content did not constitute reasonable efforts to ensure that meaningful consent had been obtained.”
At one point, Dufresne said, Aylo said users of its site had to provide documentation within two weeks after uploading that they had consent for posting of all persons in images. However, the commissioner added, Alyo employees told his office that in 70 per cent of cases, documentation was not provided. He understands Aylo has since changed its uploading policy and has dropped the two-week deadline.
Aylo’s website says it offers adult entertainment “on some of the internet’s safest platforms.”
Only users who have been ID-verified and authenticated by a third-party digital ID company can upload content to Aylo content-sharing platforms, the company says. It now digitally fingerprints materials that violate its policies to mitigate the ability for unwanted content to return to Aylo platforms. “Aylo platforms provide easy-to-use, robust systems for flagging, reviewing, and removing illegal material reported by users,” the website says.
