Aylo, the company behind adult websites like Pornhub, faces condemnation for sharing intimate images without proper consent, leading to severe impacts on victims. (IT World Canada)
A Canadian federal privacy commissioner has found that Aylo, the company behind popular adult websites like Pornhub, violated privacy laws by allowing intimate images to be shared without the direct consent of those depicted. This ruling comes after an investigation initiated in 2020 when a woman discovered that her ex-boyfriend had uploaded an intimate video and other images of her to Aylo websites without her consent.
The investigation revealed that Aylo, formerly known as MindGeek, did not seek the complainant's consent to collect, use, and disclose her intimate images. Instead, the company relied solely on her ex-boyfriend's assertion that she had consented to the distribution of the video on Aylo's websites. This failure to obtain proper consent was a violation of the Personal Information Protection and Electronic Documents Act (PIPEDA).
The report made several recommendations to Aylo to improve its content handling processes, but the company has not committed to implementing any of them. Despite changes to its consent practices in recent years, Aylo has not provided evidence that it is obtaining meaningful consent directly from everyone appearing in images and videos posted on its websites.
The report highlighted the severe impacts on victims of non-consensual disclosure of intimate images, including social stigmatization, psychological damage, financial loss, and even attempted suicide. The complainant in this case had to hire a professional takedown service to remove over 700 instances of her intimate images from more than 80 websites. Despite these efforts, the material continued to resurface online.
Privacy Commissioner Philippe Dufresne emphasized the need for stronger laws to address online harms. The proposed Online Harms Act would empower a Digital Safety Commission to order the removal of such images from designated websites within 24 hours or face significant penalties. Additionally, the ongoing debate over the Consumer Privacy Protection Act (CPPA) could grant the OPC broader powers to enforce compliance.
Under the CPPA, Dufresne would have the authority to order Aylo to immediately delete content where individuals in uploaded images or videos have not given express consent. However, under the current law, the OPC can only make recommendations. Dufresne has the option to ask the Federal Court to compel Aylo to comply with the recommendations.
The commission's recommendations include stopping the upload of intimate content without obtaining meaningful consent, deleting previously collected content without consent, implementing a privacy management program, and agreeing to oversight by an independent third party for five years.
Dufresne hopes that Aylo will reconsider its silence on the recommendations and take quick action. He also urged other social media sites to take note of the report's principles on obtaining consent for posting sensitive material.
The case underscores the need for stronger privacy protections and enforcement measures to prevent and remedy privacy violations, especially concerning the non-consensual sharing of intimate images or videos. Despite Aylo's claims of providing safe platforms, the investigation revealed a concerning lack of privacy protections and a failure to obtain proper consent.
The report concluded that Aylo's consent model, which relied on the uploader's attestation of consent, did not constitute reasonable efforts to ensure meaningful consent. Despite changes to its uploading policy, Aylo's platforms continue to face challenges in preventing unwanted content from returning.
In light of these findings, the OPC recommends stronger laws and enforcement mechanisms to protect individuals' privacy and dignity.
