The company behind Pornhub and other popular pornographic sites broke Canadian privacy law by allowing intimate images to be shared on its websites without the direct knowledge or consent of everyone depicted, the federal privacy commissioner has ruled.
The Office of the Privacy Commissioner’s (OPC) investigation into Aylo (formerly MindGeek), one of the world’s largest operators of pornographic sites, was launched in 2020 after a woman discovered that her ex-boyfriend had uploaded an intimate video and other images of her to Aylo websites without her consent.
Under its normal practice at the time, MindGeek didn’t seek the complainant’s consent to collect, use, and disclose her intimate images, the report says. Instead, the company relied exclusively on her ex-boyfriend to attest that she had consented to the video being distributed on MindGeek’s websites.
The investigation found that Aylo had a legal obligation under the Personal Information Protection and Electronic Documents Act (PIPEDA) to obtain the complainant’s consent, and had failed to do so.
The OPC made a number of recommendations that Aylo should follow to improve its processes for dealing with uploaded content. However, so far Aylo has not committed to implementing any of the recommendations.
“While Aylo made changes to its consent practices in recent years,” the commission said in a statement, “the company has not provided the OPC with evidence that it is obtaining meaningful consent directly from everyone appearing in images and videos that are posted on its websites.”
The OPC report was ready to be released last May. However, Aylo went to court and tried to block its release. It lost the challenge, which is why the report was released today.
“In its response to our preliminary report, MindGeek expressly disagreed with our findings,” the final report says, and the OPC agreed to add new facts and legal arguments from MindGeek. But, the final report says, “ultimately, MindGeek did not accept responsibility and take the necessary corrective measures to redress the significant privacy harms that we uncovered in our investigation, and has yet to offer any commitments in response to our recommendations.”
The investigation uncovered significant problems that allowed highly sensitive and intimate content to be posted online without individuals’ knowledge or permission. This has led to severe impacts on victims, including social stigmatization, psychological damage, financial loss, and even attempted suicide, the OPC says.
“The inadequate privacy protection measures on Pornhub and other Aylo sites have led to devastating consequences for the complainant and other victims of non-consensual disclosure of intimate images,” said Privacy Commissioner Philippe Dufresne.
MindGeek was founded in Montreal, and still has about 1,000 employees there. In March, 2023 it was bought by Ethical Capital Partners, a Canadian private equity firm. The company’s name changed to Aylo six months later.
The incident is an example of why Canadian law needs to be updated. While MindGeek did take down the images after the woman complained, however, says the report, the content, which could be easily downloaded by users at the click of a button, continued to be re-uploaded, both on MindGeek and on other websites (including sites unrelated to pornography). Various strangers from around the world, who had seen the video online, contacted her on Facebook using information contained in the video’s title and tags, such as her name, mother’s maiden name, university and sorority, the report says.
Ultimately, the woman had to hire a professional takedown service, which led to the removal of more than 700 instances of her intimate images on more than 80 websites. The material continued to resurface on several websites until at least 2020, and is likely still available online.
The permanent loss of control over her intimate images has had a devastating effect on the complainant, says the report, who alleged that it caused her to withdraw from her social life, lose an employment opportunity, and live in a constant state of fear and anxiety.
The government this week announced a proposed Online Harms Act that would give a Digital Safety Commission the power to order such images be removed from designated web sites within 24 hours or face large financial penalties.
Parliament is also in the middle of debating an overhaul of PIPEDA called the Consumer Privacy Protection Act (CPPA, also known as Bill C-27) that would give the OPC broader powers.
The OPC recommended:
— Aylo stop allowing the upload of intimate content without first obtaining meaningful consent directly from each individual appearing in that content;
— delete all content that it previously collected without obtaining such consent;
— implement a privacy management program to ensure that it is accountable for information under its control.
— and recommended that Aylo agree to enter into a compliance agreement with the OPC and to be subject to oversight by an independent third-party reporting to the office for five years.
MORE TO COME
The post Pornhub operator broke Canadian privacy law, watchdog rules first appeared on IT World Canada.