The Montreal-based operator behind Pornhub and other pornographic websites broke the law by enabling intimate images to be shared without direct knowledge or consent, the federal privacy watchdog has found.

The privacy commissioner's investigation into Aylo, formerly known as MindGeek, followed a complaint from a woman whose ex-boyfriend had uploaded an intimate video and other images of her to Aylo websites without her permission.

Commissioner Philippe Dufresne says inadequate privacy protection measures on Pornhub and other Aylo sites have led to devastating consequences for the complainant and other victims.

"Aylo had a legal obligation to obtain the complainant's consent directly from her, and had failed to do so," Dufresne said. 

Privacy is a fundamental right, but Aylo lacks an "effective model" to get consent from the people who actually appear in the videos, he added.

"Given the enormous risks involved, Aylo must take steps to ensure that it only posts intimate images and videos with the direct knowledge and consent of everyone appearing in the content."

Aylo's model only requires the consent of the person uploading the material.  

The investigation also found that people faced an onerous and ineffective process when they asked Aylo to remove content posted without their consent.

Dufresne made several recommendations to bring Aylo into compliance with the federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act. Among them:

  • Immediately stop collection, use and disclosure of user-generated intimate images, videos and associated personal information until appropriate measures are in place;
  • Delete all content for which valid consent was not obtained directly from each individual depicted in the images;
  • Adopt measures to ensure that express, meaningful and valid consent is obtained directly from each individual whose personal information is included in uploaded content; 
  •  And simplify takedown processes.

The company "expressly disagreed with our conclusions" and has not committed to implementing any of the recommendations, the commissioner said.

Dufresne's investigation report says the company did not seek the complainant's consent to collect, use and disclose her intimate images. Instead, it relied exclusively on her former boyfriend to attest that she had agreed.

The woman contacted the company to ask that the content be taken down, and it was subsequently removed, the report says. 

However, the content, which could be easily downloaded by users at the click of a button, continued to be re-uploaded on various sites.

Strangers from around the world who had seen the video online contacted her on Facebook using information contained in the video's title and tags, such as her name, mother's maiden name, university and sorority, the investigation found.

Ultimately, she employed a professional takedown service, which led to the removal of more than 700 instances of her intimate images on more than 80 websites, the report says. 

But the material continued to resurface and is likely still available online.

The woman said the loss of control caused her to withdraw from her social life, lose a job opportunity and live in a constant state of fear and anxiety, Dufresne found.

The commissioner said while Aylo made changes to its consent practices in recent years, the company has not provided the watchdog with evidence it is obtaining meaningful consent from individuals.

"In today's world where information is shared instantaneously and in many cases online forever, organizations need to ensure that valid consent is obtained," Dufresne said. 

"Especially when dealing with content as personal and highly sensitive as intimate images and videos."

This report by The Canadian Press was first published Feb. 29, 2024

鈥� With files from Mickey Djuric in Ottawa.