FTC Takes Action Against Operators of Pornhub and other Pornographic Sites for Deceiving Users About Efforts to Crack Down on Child Sexual Abuse Material and Nonconsensual Sexual Content

Note: The FTC and Utah will be hosting a media availability at 12 pm ET today. Participants will include FTC Commissioner Melissa Holyoak, Utah Commerce Executive Director Margaret Busse, Utah Attorney General Derek Brown and others. News media (only) who want to attend can do so by accessing this link: https://utah-gov.zoom.us/webinar/register/WN_0L2QaaMzSF20Q7LhyHeDhg

The Federal Trade Commission and the state of Utah are taking action against the operators of Pornhub and other pornography-streaming sites over charges they deceived users by doing little to block tens of thousands of videos and photos featuring child sexual abuse material (CSAM) and nonconsensual material (NCM) despite claiming that this content was “strictly prohibited.”

As part of a proposed order settling the allegations, Pornhub’s operators, Aylo and its affiliated companies (collectively Aylo), will be required to establish a program to prevent the distribution of CSAM and NCM on its websites and pay a $5 million penalty to the state of Utah.

“Pornhub’s operators turned a blind eye to the proliferation of videos depicting the sexual abuse of children on its sites so it could profit off this exploitation,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “Under the order we’re announcing today, Pornhub’s operators will be required to take concrete steps to block this harmful content and ensure that those who appear in videos on their sites are consenting adults.”

“Pornhub’s operators inflicted grave harm on children and nonconsenting adults by promoting and distributing truly horrific material online,” said FTC Commissioner Melissa Holyoak, who appeared at a news conference in Salt Lake City with Utah officials. “As today’s complaint and proposed order make clear, the FTC will use every tool in its arsenal to stop such outrageous conduct.”   

“This consent order is an important step in protecting people from some of the most harmful and exploitative material online,” said Utah Gov. Spencer J. Cox. “Companies that profit from such conduct must be held accountable. I’m grateful to the FTC and our Division of Consumer Protection for their work to safeguard Utah’s children and families.”

Aylo, formerly known as MindGeek, operates more than 100 pornographic photo and video-streaming websites including free ad-based “tube” sites such as Pornhub, YouPorn and RedTube, which allow users to upload their own videos, and paid sites including Pornhub Premium, all of which are available in the United States and around the world. These sites have attracted hundreds of millions of monthly visits by U.S. consumers alone.

In their complaint, the FTC and Utah alleged Aylo deceived users by claiming it has zero tolerance for CSAM and works to block CSAM and NCM on its sites by, among other things, taking prompt action when videos are flagged by users. In reality, Aylo failed to review videos flagged by users, did not ban uploaders of CSAM from further use of their websites, did not prevent the reupload of CSAM that Aylo had identified, and did not review all videos before they went live for CSAM or NCM.

The FTC alleged that Aylo engaged in unfair practices by distributing CSAM and NCM content on its sites, which Aylo’s Manager of Operations and Child Safety acknowledged “revictimizes” the individuals who were abused in the creation of the content. In its complaint, the FTC alleged:

• Aylo allowed the dissemination of CSAM and NCM content on its Tube sites by: allowing until December 2020 anyone to upload pornographic videos and photos, urging its content partners to contribute content involving “young girl,” “schoolgirl” and similar topics; licensing and owning CSAM and NCM content with titles such as “Brunette Girl was Raped;” and promoting to users playlists of CSAM and NCM content with such titles as “less than 18,” and “the best collection of young boys.”
• Aylo did not maintain, even though it promised to, paperwork required by federal law to verify the age and identity of individuals featured in some of the content posted on its sites.
• Aylo only decided to conduct audits of CSAM and NCM on its sites in 2020 when credit card processors threatened to impose fines or cut off access to their services and media started reporting on the issue. These audits revealed tens of thousands of CSAM and NCM videos. Even then, Aylo routinely ignored or overruled efforts by its compliance team to remove such content. For example, when a credit card processor threatened to fine Aylo for a content partner’s channel titled “PunishTeens” that included “Rape/Brutality,” the company removed the channel from Pornhub and Pornhub Premium but allowed the same content to remain on their other websites.
• Despite promising to quickly review and, if necessary, remove violative content flagged by users, Aylo did not even review content flagged as CSAM and NCM until it received at least 16 flags. It also claimed it would utilize fingerprinting technology to block users from re-uploading CSAM that had been removed, but the technology failed to effectively prevent such content from being re-uploaded to the site.
• Aylo also failed to block individuals who uploaded CSAM despite promising to ban such users. Even when it began taking action against uploaders of CSAM in October 2022, it only prohibited the user from making a new account under the same username or email address but did not prevent them from creating a new account using an alternate email address and username.

The complaint also alleged that Aylo deceived consumers by failing to protect the privacy and security of data—such as their dates of birth, Social Security numbers and government-issued IDs—uploaded by people enrolled in their model program, which included those who appear in their videos.

In December 2020, Aylo announced it would use a third-party vendor to verify the identities of people seeking to participate in its model program and collect, review and secure their ID documents. Aylo, however, failed to disclose that it obtains the data from the vendor and retains it indefinitely. Aylo also told its models that they could “trust that their personal data remains secure” yet failed to use standard security measures to protect the data. For example, Aylo did not encrypt the personal data it stored, failed to limit access to the data, and did not store the data behind a firewall.

The proposed order settling the FTC and Utah allegations imposes a $15 million penalty against Aylo, which will be suspended after payment of $5 million to Utah, and permanently prohibits Aylo from misrepresenting its practices related to preventing the posting and proliferation of CSAM and NCM on its websites. Aylo also will be required to take multiple actions to address the deceptive and unfair conduct outlined in the complaint including:

• Implement a program to prevent the publication or dissemination of CSAM and NCM content, which must include policies, procedures and technical measures to ensure that such content is not published on its websites and a process to respond to reports about CSAM and NCM content on its websites;
• Implement a system to verify that people who appear in videos or photos on its websites are adults and have provided consent to the sexual conduct as well as its production and publication;
• Remove content uploaded prior to the implementation of the CSAM and NCM prevention program until Aylo verifies that the individuals participating in those videos were at least 18 at the time the content was created and consented to the sexual conduct and its production and publication;
• Post a notice on its website informing users about the FTC’s and Utah’s allegations and the requirements of the proposed order; and
• Implement a comprehensive privacy and information security program to address the privacy and security issues detailed in the complaint.

The Commission vote authorizing the staff to file the complaint and stipulated final order was 3-0. The FTC and Utah filed the complaint and stipulated order in the U.S. District Court for the District of Utah. Chairman Andrew N. Ferguson issued a statement, joined by Commissioners Melissa Holyoak and Mark R. Meador. Commissioner Meador also issued a separate statement. 

NOTE: The Commission files a complaint when it has “reason to believe” that the named defendants are violating or are about to violate the law and it appears to the Commission that a proceeding is in the public interest. Stipulated final orders have the force of law when approved and signed by the District Court judge.

The lead staffers on this matter are Jacqueline Ford, Manmeet Dhindsa, and Alejandro Rosenberg from the FTC’s Bureau of Consumer Protection.

The FTC collaborated with the Office of the Privacy Commissioner of Canada on this matter. To facilitate cooperation with its Canadian partner, the FTC relied on key provisions of the U.S. SAFE WEB Act, which allows the FTC to receive and share information with foreign counterparts to combat deceptive and unfair practices that cross national borders.