Pornhub owner broke law by not getting ‘valid’ consent for content: watchdog

Canada’s privacy watchdog says the operator of Pornhub and other pornographic websites broke the law by allowing intimate images and video of a woman to be shared on its platforms without obtaining the woman’s consent.

The privacy commissioner’s final report on its years-long investigation into Montreal-based Aylo, formerly known as MindGeek, released Thursday found “significant” issues with the way the company obtains consent for the uploading of amateur pornographic content, which the office says had “devastating” effects on the complainant and other victims that Aylo has refused to take responsibility for.

“I call this ‘image-based abuse,'” Privacy Commissioner Philippe Dufresne said at a press conference following the report’s release.

The investigation was launched after a complaint from a woman whose ex-boyfriend had uploaded an intimate video and other images of her to Aylo websites without her permission in 2015.

Despite getting the company to remove the video and images from its platforms, the report says the woman’s images had been shared to several other unassociated websites “and is likely still available online” despite her employing a professional takedown service.

“The permanent loss of control over her intimate images has had a devastating effect on the Complainant, who alleged that it caused her to withdraw from her social life, lose an employment opportunity and live in a constant state of fear and anxiety,” the report says.

1:51 Trudeau says Liberals “stand against” Canadian digital ID

The report says Aylo did not seek out the woman’s consent for her intimate images to be shared, instead relying on the uploader — her ex-boyfriend — to assure that he had obtained her consent. The privacy commissioner said that consent model “does not constitute reasonable efforts to ensure that meaningful consent has been obtained from those individuals,” and that updates to Aylo’s consent practices since 2020 “have not remedied this contravention.”

Dufresne said given the enormous risks involved, Aylo must take steps to ensure it only posts intimate images and videos with the direct knowledge and consent of everyone appearing in the content.

A preliminary report delivered to Aylo in December 2022 made several recommendations aimed at bringing Aylo into compliance with Canada’s federal private-sector privacy law, including obtaining appropriate consent, deleting material that was uploaded without that consent, and implementing a privacy management program.

Dufresne also sought to enter into a compliance agreement with Aylo that would set up an independent oversight system for five years.

“Ultimately, MindGeek did not accept responsibility and take the necessary corrective measures to redress the significant privacy harms that we uncovered in our investigation, and has yet to offer any commitments in response to our recommendations,” the report said.

Dufresne told reporters that his office was considering all available options to get Aylo to comply with his recommendations, including taking the case to the Federal Court of Canada.

2:20 B.C. government, tech sites discuss online accountability

In a statement to Global News, Aylo said the company has “already developed practices and procedures that substantially address the concerns outlined in the report.”

“We take harm to anyone very seriously,” the company said. “Day in and day out, Aylo’s Trust & Safety and engineering teams work collaboratively with law enforcement, advocacy groups and other stakeholders to prevent online abuse and to hold those abusers to account.”

Aylo said it has undertaken a “comprehensive overhaul” of its trust and safety procedures in the decade since the original incident that launched the privacy commissioner’s investigation. Current processes include “the verification by government-issued ID of all persons appearing in content uploaded to our platform,” it said.

But Dufresne’s report cites an interview with an Aylo director who estimated that uploaders of content they are not featured in “fail to provide the required identification and consent forms for depicted individuals in approximately 70 per cent of cases.”

The final report was set to be released nearly a year ago, in May 2023, but was delayed as Aylo unsuccessfully pursued legal action to prevent its release.

Aylo is a global company but its primary operations are based in Montreal, where it employs over 1,000 people.