“Pornhub is not asking for consent,” says Polidoro. “Pornhub is dealing with the sexual preferences of users, and they don’t ask for consent.” Polidoro says cookies are deployed whether someone clicks “OK” or doesn’t click the button.
The second element of the GDPR problems, Polidoro says, has to do with the way Pornhub shares the information it collects with other businesses owned by its parent company, MindGeek, which is based in Canada and was recently purchased by private equity firm Ethical Capital Partners. The group claims there is little transparency around what data is shared and how it is used.
The final element of the complaints claims that Pornhub uses people’s data and “unilaterally assigns sexual preferences to each individual without their knowledge,” according to statements from the group behind the action. Polidoro claims that someone only needs to watch a small number of videos to be shown more of that kind of content.
Freely available tools that monitor what trackers websites use, such as Blacklight and Privacy Badger, show that Pornhub data is transmitted to Google via its analytics platform and tag manager, and also TrafficJunky, the advertising platform owned by MindGeek. TraffickJunky claims its ads are viewed 3.2 billion times a day.
One tracking technology Pornhub uses is capable of storing IDs of the videos you watch—using the “watchedVideoStorage” and “watchedVideoIds” keys—on your computer or phone, WIRED tests found. Each time you watch a video, even if you aren’t logged in to Pornhub, an ID number for it is added to a list in your browser’s local storage. “They basically create a parallel search history kept directly on the user’s device,” Polidoro says.
A MindGeek spokesperson says the company does not comment on ongoing litigation and will respond “through the appropriate process in time.” “MindGeek is committed to protecting user privacy, and is continuously implementing measures to safeguard the personal data of everyone in its community,” the spokesperson says.
Pornhub’s privacy policy, which details the data it can collect about people, says it uses cookies for multiple purposes. For example, it uses cookies to help people log in, to “personalize and enhance” people’s online experience, to record how many people are using its website, and to track the pages people visit and serve ads. “You can set your browser to refuse all or some browser cookies or to alert you when cookies are being sent,” the privacy policy says. It also says Pornhub has turned on Google Analytics IP anonymization so full IP addresses are not stored.
Emily van der Nagel, a lecturer in social media at Monash University, Australia, who researches social media identities, says that while Pornhub’s privacy policy does include what data it collects and uses, it is “probably unlikely” that the average user looks at this information. “If data collection appears to be happening on a technical level, from an opaque organization, with no insight into the social consequences, users are unlikely to attempt to intervene in the data collection,” Nagel says. “If there is a threat of social harm, for example, porn preferences surfacing as targeted ads that display prominently on a work computer—this is when users become aware of what data porn websites collect about them and seek to intervene in that data collection and use.”