There aren’t many websites bigger than Pornhub. Each month, more than 2 billion people visit the adult site, spending an average of almost eight minutes browsing and watching videos—an eternity in internet time. All that activity has the potential to generate huge volumes of data. Now Pornhub is facing a series of legal challenges across Europe over the information it collects.
Activists and researchers are filing a complaint today against Pornhub in Italy that claims the company is “illegally” handling the data of millions of people. The complaint—which is based on a technical analysis of the website and its privacy practices and builds upon previously unreported complaints in the country and in Cyprus, where Pornhub is legally based in Europe—alleges that the company falls foul of Europe’s strict GDPR rules, which govern how people’s data can and should be used.
Pornhub doesn’t allow people to easily opt out of being tracked by cookies; the site isn’t clear about the data it shares with third parties; and its algorithm “assigns” people sexual preferences, based on the videos they watch, says Alessandro Polidoro, a digital rights activist and the lead attorney of the litigation. Polidoro is representing #StopDataPorn, a collective that includes researchers and civil liberties organizations involved in the action. Polidoro spoke with WIRED about the legal complaints but did not disclose the text, due to the privacy of individuals involved.
The legal complaints, which could take years to resolve, arrive as the online adult industry faces increased scrutiny from regulators around the world, with governments blocking what is accessible online and demanding that people show ID to access adult material.
Polidoro claims that the group found “a lot” of potential issues with the way Pornhub uses people’s data but has decided to focus on three areas. First, there’s the issue of people giving consent to be tracked, Polidoro says. Under Europe’s privacy laws, if a website wants to track someone, it has to obtain consent. That’s why the web is littered with annoying cookie popups.
Open YouTube, for instance: In Europe, a big popup appears stating how cookies are used, and it gives people the option to accept, reject, or customize them. However, if you open Pornhub, a banner appears at the bottom of the page that says the website uses cookies. It includes an option to find out more information and a button that says “OK,” but it provides no way to stop cookies from tracking you. (The banner does not appear in the UK or US, according to tests by WIRED.)
“Pornhub is not asking for consent,” says Polidoro. “Pornhub is dealing with the sexual preferences of users, and they don’t ask for consent.” Polidoro says cookies are deployed whether someone clicks “OK” or doesn’t click the button.
The second element of the GDPR problems, Polidoro says, has to do with the way Pornhub shares the information it collects with other businesses owned by its parent company, MindGeek, which is based in Canada and was recently purchased by private equity firm Ethical Capital Partners. The group claims there is little transparency around what data is shared and how it is used.
The final element of the complaints claims that Pornhub uses people’s data and “unilaterally assigns sexual preferences to each individual without their knowledge,” according to statements from the group behind the action. Polidoro claims that someone only needs to watch a small number of videos to be shown more of that kind of content.
Freely available tools that monitor what trackers websites use, such as Blacklight and Privacy Badger, show that Pornhub data is transmitted to Google via its analytics platform and tag manager, and also TrafficJunky, the advertising platform owned by MindGeek. TraffickJunky claims its ads are viewed 3.2 billion times a day.
One tracking technology Pornhub uses is capable of storing IDs of the videos you watch—using the “watchedVideoStorage” and “watchedVideoIds” keys—on your computer or phone, WIRED tests found. Each time you watch a video, even if you aren’t logged in to Pornhub, an ID number for it is added to a list in your browser’s local storage. “They basically create a parallel search history kept directly on the user’s device,” Polidoro says.
A MindGeek spokesperson says the company does not comment on ongoing litigation and will respond "through the appropriate process in time." "MindGeek is committed to protecting user privacy, and is continuously implementing measures to safeguard the personal data of everyone in its community," the spokesperson says.
Pornhub's privacy policy, which details the data it can collect about people, says it uses cookies for multiple purposes. For example, it uses cookies to help people log in, to “personalize and enhance” people’s online experience, to record how many people are using its website, and to track the pages people visit and serve ads. “You can set your browser to refuse all or some browser cookies or to alert you when cookies are being sent,” the privacy policy says. It also says Pornhub has turned on Google Analytics IP anonymization so full IP addresses are not stored.
Emily van der Nagel, a lecturer in social media at Monash University, Australia, who researches social media identities, says that while Pornhub’s privacy policy does include what data it collects and uses, it is “probably unlikely” that the average user looks at this information. “If data collection appears to be happening on a technical level, from an opaque organization, with no insight into the social consequences, users are unlikely to attempt to intervene in the data collection,” Nagel says. “If there is a threat of social harm, for example, porn preferences surfacing as targeted ads that display prominently on a work computer—this is when users become aware of what data porn websites collect about them and seek to intervene in that data collection and use.”
While one new GDPR complaint is being filed in Italy today, the #StopDataPorn group also filed broader complaints with officials in Italy and Cyprus last year. Italy’s data regulator refused WIRED’s request to comment on the issues. Irene Loizidou Nicolaidou, the commissioner of Cyprus’s data protection regulator, says they cannot comment as there is a “pending audit” of Pornhub and the case is ongoing. Much of the underlying research for the complaints was completed by Tracking Exposed, a digital rights group that has developed a custom browser extension to analyze Pornhub’s personalization algorithm. The group published a peer-reviewed analysis of Pornhub’s algorithm in May 2022.
The complaints are likely to draw attention to the amount of data the pornography websites collect and how they handle that information. Generally speaking, porn companies can collect huge reams of data about who visits them. In 2019, researchers analyzed 22,484 porn websites and found that 93 percent of them leak data to third parties, 44.97 percent “expose or suggest” a gender or sexual identity that is likely to be linked to the user, and 79 percent used tracking cookies from outside companies. Google’s trackers were on the vast majority of websites, the research found.
“Since Pornhub is modeled on YouTube, it isn’t a surprise that data practices characteristic, or foundational, to social media are also present,” says Susanna Paasonen, a professor of media studies at the University of Turku, Finland, who researches sexuality and pornography. “The degree to which this is obvious to casual users is, however, impossible to predict.”
Paasonen points to the fact that Pornhub has in recent years highlighted how much data it can collect through its Insights series, which details traffic trends on the website and provides some transparency. “But as there are no opt-outs—as required by GDPR—and I doubt how many users read their privacy policy that makes the tracking pretty obvious, the transparency vis-à-vis users is questionable,” Paasonen says. For most people, using privacy browsers or privacy-enhancing browser extensions can help limit what data is collected and how they’re tracked.
Update 9:35 am ET, June 29, 2023: Added a refusal to comment on the allegations against Pornhub from a Cypriot official.
