Report on Pornhub alleges privacy law breach
Pornhub's parent company breached Canada's privacy law when it allowed porn to be posted on its platforms without the consent of the subject, who then faced an “extremely onerous and ineffective” process to have it removed.
That's according to a report published Thursday by Privacy Commissioner Philippe Dufresne, who said his three year investigation into Montreal-founded porn giant Aylo (formerly known as Mindgeek) uncovered “significant problems” with the company's privacy policies.
Specifically, it found that the company repeatedly failed to verify that uploaders of intimate content had obtained “meaningful consent” from each participant before making the content available to millions of viewers.
“The investigation uncovered significant problems that allowed highly sensitive and intimate content to be posted online without individuals' knowledge or permission. This has led to severe impacts on victims, including social stigmatization, psychological damage, financial loss, and even attempted suicide,” reads the report.
Aylo owns and operates the world's biggest adult entertainment website Pornhub, as well as a host of other major sites that produce or stream pornography, including Youporn and Brazzers.
Canada's Office of the Privacy Commissioner (OCP) only has the power to issue non-binding recommendations in its reports, though he can then ask the Federal Court to issue an order requiring a targeted organization to correct its privacy practices.
For nearly a year Aylo had sought to block the publication of the report in the courts. The company had argued the commissioner's report extended beyond his jurisdiction because it said the content on its websites had little connection to Canada, and the investigation was not conducted fairly.
The commissioner's threeyear investigation began following a complaint by an Ontario woman in 2020 that the company “collected, used, and disclosed private intimate videos and images without consent.”
Details of the investigation and the subsequent legal dispute are detailed in hundreds of pages of redacted Federal Court of Appeal files reviewed by National Post.
In April last year, weeks before the OPC planned on publishing its final investigation into Aylo (then still called Mindgeek), two of the company's subsidiaries filed an application in the Federal Court asking a judge to prohibit the commissioner from publishing the report.
The contents of the final report had until Thursday been covered by a publication ban and confidentiality order.
Aylo argued that Dufresne's investigation and recommendations “grossly exceeded” his power and that the investigation process was unfair, so the report should never be made public.
In a May affidavit, Michael Maguire, a director in the commissioner's office, wrote that the investigation “raised serious concerns about the privacy practices of a major organization in the online space, whose reach extends to millions of individuals daily,” referring to Aylo. Maguire works as the OPC'S director of compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's private sector privacy law.
“The Commissioner's recommendations are likely to have a broad impact on individuals and extend well beyond the Complainant,” Maguire noted.
The OPC also said in a court document filed last week that a preliminary version of Dufresne's report provided to Aylo in December 2022 alleged that the porn giant's operations “contravene several provisions” of PIPEDA.
In its Federal Court lawsuit, Aylo noted that “the Commissioner's recommendations impugn most of the (company's) collection, use, and disclosure of electronic information, despite virtually all of such activities having no connection to Canada.”
In an affidavit filed in court, the director of one of Aylo's subsidiaries Andreas Andreou said the company “disputed” conclusions and recommendations contained in the OPC'S report, but did not specify which ones.
The culmination of the court battle comes as a House of Commons committee is set to study a Senate bill that would compel Canadians to prove they are over 18 years old before accessing online porn.
Proposed solutions include a service that scans users' face to estimate their age or a digital ID system, both potentially forcing individuals to entrust sensitive private information to third parties.
In multiple lawsuits and media reports, Aylo and Pornhub have been accused of hosting child pornography, videos depicting sexual assaults, and “revenge porn” (content posted without the subject's consent). Aylo has repeatedly denied those claims.
In December, Pornhub's parent company admitted to receiving revenue derived from sex trafficking as part of a deferred prosecution agreement it signed with the U.S. Attorney's Office.
According a statement by the U.S. government, Aylo websites hosted and made money for years from porn videos produced by a Girlsdoporn, a company that deceived women into filming pornographic content and then posted it without their consent. When the victims asked the company to take down the videos, Aylo did not remove them all immediately, the statement added.
“Motivated by profit, Aylo Holdings knowingly enriched itself by turning a blind eye to the concerns of victims who communicated to the company that they were deceived and coerced into participating in illicit sexual activity,” the FBI'S assistant director-in-charge James Smith said in the statement.
Aylo said at the time that it had received written consent forms purportedly signed by victims of Girlsdoporn but was unaware that they were the product of coercion and fraud.
The company also said the government “did not find that Aylo or its affiliates violated any federal criminal laws prohibiting sex trafficking or the sexual exploitation of minors, including child pornography.”
In a statement to National Post before the Privacy Commissioner's report was published, a spokesperson for Aylo's owner said the company has implemented “comprehensive safeguards” to “prevent and eliminate illegal materials” for its sites.
“We take harm to anyone very seriously,” said Sarah Bain, vice-president of public engagement for Ethical Capital Partners, the private equity firm that purchased Mindgeek in March 2023 and rebranded it as Aylo in August 2023.
“Day in and day out, Aylo's Trust & Safety and engineering teams work collaboratively with law enforcement, advocacy groups and other stakeholders to prevent online abuse and to hold those abusers to account,” Bain said in the statement.
In its lawsuit and supporting legal documents, Pornhub's parent company argued that the commissioner's investigation is aimed at its worldwide commercial activities, the “vast majority” occurring outside of Canada and thus outside of his jurisdiction.
“Since over 90% of (the company's) collection, use, and disclosure of user content occurs entirely outside of Canada involving non-canadian content, the Commissioner grossly exceeded his statutory power in deciding to publish the findings and recommendations,” the lawsuit read.
The company also said it was treated unfairly throughout the investigative process, namely because the OPC took three years to complete its investigation when the PIPEDA dictates it should be completed in one year. Over that period, it says that it overhauled its content policies and parted ways with two employees who held key roles in its content-moderation team.
The company also complained it was only given 45 days to respond to a preliminary report.
Aylo's lawsuit had meandered largely unnoticed through the Federal Court system since late April 2022, at times removed from the public's view completely.
Shortly after it filed its application for judicial review to the Federal Court in April, Aylo also asked the court for an interim injunction prohibiting the commissioner from releasing his report until a judge had ruled on the case.
The company argued that if the commissioner published his investigation
while the Federal Court proceeding was ongoing, the company would be “irreparably harmed” by both the report and ensuing media coverage, and its underlying case would become moot.
The OPC disagreed and ultimately so did Federal Court Justice Ann Marie Mcdonald. In October, Mcdonald refused Aylo's interim injunction request, sweeping aside the company's concerns about damage to its reputation while noting it was already the subject of negative media coverage.
“Mindgeek does not offer any specific or particular evidence as to how further negative media attention will cause them irreparable harm,” she wrote. “Evidence in support of irreparable harm must be at a convincing level of particularity. No such evidence has been provided.”
The case appears to have been completely wiped from public records on the Federal Court's website through a publication ban and confidentiality order issued over the summer, an unusually opaque measure for the court.
The case also briefly disappeared from the public's view and the party's names were anonymized — a measure generally reserved for delicate criminal cases or sensitive national security issues — at the Federal Court of Appeal in January.
About the same time that National Post inquired to the FCA about the unusual opacity covering to the case, the judge who had just taken over the file issued a new direction advising Aylo and the OPC that he intended to make it as public as possible.
“The current situation, complete secrecy in practice, is utterly unacceptable and must be addressed immediately,” wrote Justice David Stratas on Jan. 26. A few days later, the parties' names were made public again, as were redacted versions of key documents.
In a joint response, both parties said they agreed that their identity should not be sealed and that Aylo never sought for the entire file to be made confidential. “This provision appears to have been added perhaps inadvertently” in a previous court order, wrote Aylo's lawyer Andrew Faith.