Pornhub parent company broke privacy law by failing to obtain valid consent for content uploads: OPC

The Montreal-based company behind Pornhub and other major adult websites broke Canada’s privacy law by sharing intimate content on its platforms without obtaining valid consent from those depicted, the Office of the Privacy Commissioner (OPC) has found. According to a report released by the watchdog on Thursday, Aylo, formerly known as MindGeek, is in violation of the Personal Information Protection and Electronic Documents Act (PIPEDA). Not only does the company fail to obtain valid consent from people depicted in user-uploaded content, the report stated, but Aylo’s takedown processes are ineffective, and it fails to be accountable for the sensitive information under its control. “Privacy is a fundamental right,” said privacy commissioner Philippe Dufresne during a press conference on Thursday. “In today's digital world, where information is shared instantaneously, and in many cases lives online forever, organizations need to ensure that valid consent is obtained, especially when dealing with content as personal and highly sensitive as intimate images and videos.” The OPC launched its investigation back in 2020, following a complaint from a woman whose ex-boyfriend had uploaded an intimate video of her to various Aylo websites without her consent. She had been trying to get the content removed since 2015, but it continued to be re-uploaded. Before going to the OPC, she hired a professional takedown service which removed more than 700 of her intimate images across more than 80 websites, but are “likely still available online,” explained the report. The report was ready to be released last May, according to Dufresne, but was delayed when Aylo took the OPC to court in an attempt to block its publication. Aylo claimed it would face irreparable reputational harm if the report was released. The Federal Court denied the injunction on Oct. 26 and the OPC shared the report immediately after the Federal Court of Appeal upheld the decision on Thursday. “Our investigation uncovered a concerning lack of privacy protections, given the vast amount of highly sensitive information under Aylo’s control,” said Dufresne. “Our key finding is that consent should be obtained directly from the person whose images are being shared,” he stated, explaining that Aylo’s current consent model requires the uploader to attest that they have gotten permission from everyone involved. “There are measures that exist, but they rely on that third-party uploader,” said Dufresne, which fails to protect victims of revenge porn. Uploaders are also given two weeks to provide consent documentation after the content is put online. Even if that documentation was not provided, “the harm would still have been done,” said Dufresne, who noted that 70 per cent of audited uploaders failed to provide proof of consent to Aylo. The commissioner made several recommendations to the company, calling on Aylo to stop sharing user-created intimate content until it adopts effective measures to secure meaningful consent directly from everyone depicted, and delete all content from its websites that are missing valid consent. He also demanded Aylo establish a privacy management program to ensure compliance with PIPEDA within nine months, and that it agree to be monitored and reported on by a qualified independent third-party, appointed by the OPC, for five years. According to Dufresne, Aylo has disagreed with the commission's findings and refused to commit to implementing its recommendations. The commissioner noted that he does not have the power to implement binding orders on the company, but can make recommendations and, if needed, take action at the Federal Court. Dufresne added that he hopes to see Canada’s privacy legislation updated to grant his office more power in these kinds of situations, pointing to provisions in Bill C-27 that would do so. – Reporting by Phalen Tynes-MacDonald at pcreed@thewirereport.ca

Pornhub parent company broke privacy law by failing to obtain valid consent for content uploads: OPC

News | March 1, 2024

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Pornhub parent company broke privacy law by failing to obtain valid consent for content uploads: OPC

News | March 1, 2024

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Ethics committee calls for privacy law improvements, more oversight of social media platforms

Online harms and more in focus as Parliament returns

Government working with AI researcher Mila on governing use of cultural content

Privacy tribunal unlikely to get through INDU’s look at Bill C-27

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us