In its complaint, the FTC alleged:
- Aylo allowed the dissemination of CSAM and NCM content on its Tube sites by: allowing until December 2020 anyone to upload pornographic videos and photos, urging its content partners to contribute content involving “young girl,” “schoolgirl” and similar topics; licensing and owning CSAM and NCM content with titles such as “Brunette Girl was Raped;” and promoting to users playlists of CSAM and NCM content with such titles as “less than 18,” and “the best collection of young boys.”
- Aylo did not maintain, even though it promised to, paperwork required by federal law to verify the age and identity of individuals featured in some of the content posted on its sites.
- Aylo only decided to conduct audits of CSAM and NCM on its sites in 2020 when credit card processors threatened to impose fines or cut off access to their services and media started reporting on the issue. These audits revealed tens of thousands of CSAM and NCM videos. Even then, Aylo routinely ignored or overruled efforts by its compliance team to remove such content. For example, when a credit card processor threatened to fine Aylo for a content partner’s channel titled “PunishTeens” that included “Rape/Brutality,” the company removed the channel from Pornhub and Pornhub Premium but allowed the same content to remain on their other websites.
- Despite promising to quickly review and, if necessary, remove violative content flagged by users, Aylo did not even review content flagged as CSAM and NCM until it received at least 16 flags. It also claimed it would utilize fingerprinting technology to block users from re-uploading CSAM that had been removed, but the technology failed to effectively prevent such content from being re-uploaded to the site.
- Aylo also failed to block individuals who uploaded CSAM despite promising to ban such users. Even when it began taking action against uploaders of CSAM in October 2022, it only prohibited the user from making a new account under the same username or email address but did not prevent them from creating a new account using an alternate email address and username.
The complaint also alleged that Aylo deceived consumers by failing to protect the privacy and security of data—such as their dates of birth, Social Security numbers and government-issued IDs—uploaded by people enrolled in their model program, which included those who appear in their videos.
In December 2020, Aylo announced it would use a third-party vendor to verify the identities of people seeking to participate in its model program and collect, review and secure their ID documents. Aylo, however, failed to disclose that it obtains the data from the vendor and retains it indefinitely. Aylo also told its models that they could “trust that their personal data remains secure” yet failed to use standard security measures to protect the data. For example, Aylo did not encrypt the personal data it stored, failed to limit access to the data, and did not store the data behind a firewall.
The proposed order settling the FTC and Utah allegations imposes a $15 million penalty against Aylo, which will be suspended after payment of $5 million to Utah, and permanently prohibits Aylo from misrepresenting its practices related to preventing the posting and proliferation of CSAM and NCM on its websites. Aylo also will be required to take multiple actions to address the deceptive and unfair conduct outlined in the complaint including:
- Implement a program to prevent the publication or dissemination of CSAM and NCM content, which must include policies, procedures and technical measures to ensure that such content is not published on its websites and a process to respond to reports about CSAM and NCM content on its websites;
- Implement a system to verify that people who appear in videos or photos on its websites are adults and have provided consent to the sexual conduct as well as its production and publication;
- Remove content uploaded prior to the implementation of the CSAM and NCM prevention program until Aylo verifies that the individuals participating in those videos were at least 18 at the time the content was created and consented to the sexual conduct and its production and publication;
- Post a notice on its website informing users about the FTC’s and Utah’s allegations and the requirements of the proposed order; and
- Implement a comprehensive privacy and information security program to address the privacy and security issues detailed in the complaint.
