PIPEDA Findings #2024-001: Investigation into Aylo (formerly MindGeek)’s Compliance with PIPEDA
The OPC investigated Aylo (formerly MindGeek), a global technology company operating major pornographic websites like Pornhub, following a complaint from an individual whose intimate video was uploaded without her consent. The investigation focused on MindGeek's compliance with PIPEDA regarding consent for personal information collection, its content takedown process, and overall accountability. The OPC found that MindGeek failed to obtain valid and meaningful express consent directly from individuals depicted in highly sensitive content, relying instead on uploaders, which was deemed insufficient. MindGeek's content takedown process was also found to be not easily accessible, simple-to-use, or effective for individuals seeking removal of non-consensual content. These deficiencies demonstrated a broader lack of accountability for the vast amount of sensitive personal information under MindGeek's control. MindGeek disagreed with the findings and did not commit to implementing the OPC's recommendations, which included ceasing uploads without direct consent, deleting non-consensual content, and establishing a privacy management program. Consequently, the complaint was found to be well-founded and unresolved, with the OPC issuing several recommendations for compliance and independent oversight.
- 1Whether PIPEDA applied to MindGeek given its international operations but significant Canadian connection.
- 2Whether MindGeek obtained valid and meaningful consent for the collection, use, and disclosure of highly sensitive personal information (intimate images and associated identifiers) of individuals depicted in content uploaded to its websites, as required by Principle 4.3 and s. 6.1 of PIPEDA.
- 3Whether MindGeek's reliance on uploaders to attest consent constituted reasonable efforts to ensure meaningful consent.
- 4Whether MindGeek's "enhanced" consent practices implemented in 2020 remedied the contravention of consent requirements.
- 5Whether MindGeek provided individuals with an easily accessible, simple-to-use, and effective process for having their personal information removed from its websites, as required by Principles 4.10 and 4.10.2 of PIPEDA.
- 6Whether MindGeek's takedown process was effective at preventing further uploads of the same or other content depicting the requester.
- 7Whether MindGeek was accountable for the personal information under its control, as required by Principle 4.1 of Schedule 1 of PIPEDA.
- Consent for collection: Failed to obtain valid consent
- Content takedown process: Process found inadequate
- Accountability for personal information: Lack of accountability found
- Complaint outcome: Complaint well-founded and unresolved
- Recommendations: Recommendations issued to institution
Complaint well-founded and unresolved
MindGeek failed to obtain valid and meaningful consent directly from individuals, its content takedown process was ineffective and onerous, and it demonstrated a lack of accountability for highly sensitive personal information, further exacerbated by its refusal to implement the OPC's recommendations.
The Commissioner recommended that MindGeek immediately cease collection, use, and disclosure of user-generated intimate images without direct consent, delete all non-consensual content, establish a privacy management program within nine months, and agree to independent third-party oversight for five years.
- Principle 4.3 of Schedule 1 of PIPEDA
- section 6.1 of PIPEDA
- Principle 4.3.4 of Schedule 1 of PIPEDA
- Principle 4.3.6 of Schedule 1 of PIPEDA
- Principle 4.3.2 of Schedule 1 of PIPEDA
- Principle 4.10 of PIPEDA
- Principle 4.10.2 of PIPEDA
- Principle 4.1 of Schedule 1 of PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro