Pornhub operator broke privacy law by failing to ensure valid consent, watchdog finds

The Montreal-based operator behind Pornhub and other pornographic websites broke the law by enabling intimate images to be shared without direct knowledge or consent, the federal privacy watchdog has found.

The privacy commissioner’s investigation into Aylo, formerly known as MindGeek, followed a complaint from a woman whose ex-boyfriend had uploaded an intimate video and other images of her to Aylo websites without her permission.

Commissioner Philippe Dufresne says inadequate privacy protection measures on Pornhub and other Aylo sites have led to devastating consequences for the complainant and other victims.

“Privacy is a fundamental right,” Dufresne said Thursday in a statement.

“Given the enormous risks involved, Aylo must take steps to ensure that it only posts intimate images and videos with the direct knowledge and consent of everyone appearing in the content.”

The investigation also found that people faced an onerous and ineffective process when they asked Aylo to remove content that had been posted without their consent.

Dufresne made several recommendations aimed at bringing Aylo into compliance with the federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act. Among them:

• Immediately stop collection, use and disclosure of user-generated intimate images, videos and associated personal information until appropriate measures are in place.

• Delete all content for which valid consent was not obtained directly from each individual depicted in the images.

• Adopt measures to ensure that express, meaningful and valid consent is obtained directly from each individual whose personal information is included in uploaded content.

• Simplify takedown processes.

The company “expressly disagreed with our conclusions” and has not committed to implementing any of the recommendations, the commissioner said.

Dufresne’s investigation report says the company did not seek the complainant’s consent to collect, use and disclose her intimate images.

Instead, it relied exclusively on the uploader, her former boyfriend, to attest that she had agreed to the video being distributed.