Pornhub owner may become the UK's gatekeeper of online porn

NSFW Warning: This story may contain links to and descriptions or images of explicit sexual acts.

Mindgeek may be the most powerful company that you've never heard of, or at least, a company you'll claim never to have heard about in polite society. It's the conglomerate that owns some of the world's most visited porn sites, including Pornhub, RedTube and YouPorn. Far from simply being a popular and free way for people to consume adult content, it may soon have a powerful political role in the UK that will ensure its dominance for decades to come. That's because, within the next year, Mindgeek may become the principal gatekeeper between the country's internet users and their porn.

In April, the UK passed the Digital Economy Act 2017, legislation that mandated that any website showing adult content must verify the ages of its visitors. It was pushed through in response to concerns that children were being corrupted by easy access to and exposure to adult content at an early age. Section 15(1) of the bill requires that "pornographic material" not be published online, on a "commercial basis," unless it is "not normally accessible by those under 18." The bill has several flaws, not least the number of vague proposals it contains, and the ad hoc definition of what pornography actually is.

Section 17 of the same act outlined the creation of an "age-verification regulator," the digital equivalent of a bouncer standing between you and your porn. This gatekeeper will have the right, and duty, to demand you show proof of age, or else refuse you access. In addition, the body will be able to impose fines and enforcement notices on those who either neglect or circumvent the policy.

Myles Jackman on the Digital Economy Act a year before it was passed.

The punishments it will have in its arsenal will not be trivial, either, and include being able to serve injunctions or otherwise force compliance. In addition, the financial penalties are capped at a maximum of either 5 percent of the company's annual turnover or £250,000 ($329,000). Falling foul of the rules could be ruinous for a number of small businesses that fail to comply for any number of reasons.

Businesses that do comply may also potentially lose a significant amount of money by implementing age verification. It's currently assumed that the burden will be passed on to the sites themselves, which, again, could threaten many sites. It's believed that one such verification system will charge around $0.07 per verification, which could substantially eat into the already slender revenues for some websites.

There are plenty of ifs and buts, because very few of the key decisions surrounding the program have been made. The government has yet to nominate a regulator to enforce the bill's provisions, although it's presumed that the British Board of Film Classification will be given the task. The BBFC is, however, an industry body set up by the film industry in 1913 to avoid direct government regulation and censorship.

The Open Rights Group believes that the BBFC will then hand over the actual mechanisms of the age verification platform to a third party in the private sector. Mindgeek has had several conversations with officials and is currently pushing its own age verification platform, AgeID. If selected, this platform could become the principal wall between Britons and their pornography -- giving Mindgeek enormous power in the market. The service is already available in Germany, which restricts a wide variety of online services to those over 18, including violent video games, films with an 18 certificate and adult content.

"Obscenity lawyer" Myles Jackman wrote in his blog that he believes the government has ceded its responsibility to regulate the law it is enacting. Instead, it is handing "regulatory liability to a non-Governmental body founded by the film industry (the BBFC)." He added that passing the age verification role to a private sector company is similarly unwise.

Mindgeek's discussions with the UK government are a matter of public record, as are some of the documents relating to the discussions. In one email, an unnamed Mindgeek representative proposed the gray-listing -- essentially a temporary block -- of more than four million URLs that (British ISP) Sky has cataloged. Each one of these sites, including Twitter, would then be contacted and told to sign up to the age verification system -- like Mindgeek's nascent AgeID -- or face blacklisting. A Mindgeek spokesperson confirmed to Engadget that it believes up to 25 million Britons could sign up to its system.

Jim Killock of the Open Rights Group is critical of the plans, saying that the "approach is almost certain to go wrong." By leaving the choice of age verification platform up to the websites, it hands Mindgeek all of the power. Similarly, he feels that, whatever happens, the result will be "the censorship of legal material." And that the tools offered to the regulator are "purely a policy and financial choice," rather than limited by more specific factors.

The idea is that a user will sign up to AgeID once and then have what Pornhub VP Corey Price describes as a "seamless browsing experience." The executive believes that the approach will ensure users can move between compliant sites without "hitting multiple age verification walls."

Pornographer Pandora/Blake, who has criticized the age verification platform, explained that the government has "written Mindgeek a blank check." "Smaller sites like mine," they argued, "will effectively have to pay a 'Mindgeek tax' to our biggest competitor."

Adam Grayson, CFO of Evil Angel, can, at least, see the business sense of what Mindgeek is doing, even if it's not great for the wider industry: "Mindgeek, very astutely, is trying to position themselves as a central place, the logic being that everyone goes to Pornhub at some point." He added that if he were Mindgeek, he'd "probably take a similar approach. 'I'm already the biggest porn brand in the world, I have the most traffic, I should just consolidate my power.'"

Pornhub VP Corey Price refutes the company's implied role as a bully of the adult content industry and denies that AgeID is a tax on users or third parties. "We do not believe that age verification costs should be passed on to customers," he said, adding that it'll be "completely free to all users." As for the smaller sites, like Pandora/Blake's, Price said that Mindgeek will license AgeID "in a fair, cost-effective manner, based on the size of their UK traffic." The executive believes that his company's age verification platform will make life easy for "advertisers, affiliates and [our] competitors."

Whatever happens, it doesn't appear that there's been any scrutiny about whether Mindgeek is a fit and proper body for this responsibility. In 2014, the company was described by David Auerbach in Slate as "a porn provider. Or more accurately, the porn provider." It is not simply one of several competing adult content outlets selling their wares online, but a behemoth that has been described by many as a monopoly. Mindgeek could well command the attention of around 100 million users.

It's also been postulated that the company could be the world's third-biggest user of internet bandwidth, although, again, these figures are nearly impossible to verify. Pornhub is the world's most trafficked porn website, with an Alexa Ranking of 39. Numbers 1 through 38 are either Google's various local domains, or the online utilities that we all take for granted, like Facebook, Wikipedia, Reddit, Taobao, Amazon, Twitter and Weibo. Between the various other outlets that Mindgeek hosts and owns, it's extraordinarily likely that if you've wanted to get your rocks off, you've done it on a Mindgeek site.

Fabian Thylmann addresses the Oxford Union on the matter of sex work in 2015.

Mindgeek itself was founded by Fabian Thylmann, a German entrepreneur who built an empire out of free porn. After creating online tracking software used by the adult industry, Thylmann cashed out to buy his first porn website. Colin Rowntree, founder of Wasteland, one of the oldest BDSM websites still running on the internet today, said that "2007 was the perfect storm, between the banking and mortgage crises in the US, and then the launch of the tube sites." That was when Thylmann, backed by a hefty Wall Street loan, went on a spending spree to acquire a raft of sites including Mansef, Interhub, MyDirtyHobby, Webcams.com and xTube. But in 2012, Thylmann was extradited to Germany on charges of tax evasion, forcing him to sell the company.

"Tube" sites like Pornhub and xTube are known as such because their business model mirrors that of YouTube. Users are encouraged to upload clips of their own creation for sharing and viewing, with few barriers to sharing copyrighted content. "There was a suspicion," said Rowntree, that users who were uploading other producers' videos to sites like Pornhub "were outsourced employees of the tubes." He explained that the people were believed to be "buying memberships to pay sites, downloading [everything] as fast as they can and uploading it to build the libraries."

And as those libraries grew, so did Mindgeek's prominence, which enabled it to use its financial clout to buy other sites. The limits of this business were tested when producer Ventura Content filed a $6.75 million lawsuit, claiming that "tube sites maintain the fiction that they offer a forum for consumers to upload and share their own original user-generated adult video" but that in reality they were just "repositories for an extensive collection of infringing adult videos," no better than Napster or Kazaa.

The lawsuit was settled, and it remains an open question how ethically companies like Mindgeek behaved at the time. Eventually, Pornhub would launch a content partner program, letting third parties market their wares on the site. If you watched a clip from a specific studio, you'd be directed back to its site and encouraged to sign up for a paid-for subscription. There was only one downside: Mindgeek claims 50 percent of that cash as commission.

Mindgeek stands accused of becoming a behemoth on a diet of pirated content, but its size gave it enormous power. It held smaller studios hostage, forcing them to either engage in what Rowntree calls the DMCA "whac-a-mole" or let them take 50 percent of the sales. That hasn't worked out well for sites like Wasteland, and Rowntree believes that his income has fallen by more than 35 percent. Rowntree also accuses Pornhub of being aggressively laissez-faire with respect to pirated clips from its partner program members -- a charge Pornhub refutes.

If you visit Wasteland's free Pornhub channel, you'll see that the studio has uploaded 798 clips, which have been viewed a combined 35,469,654 times. Rowntree said that his staff, and the performers in the videos, have directly received nothing. "You get a banner underneath your movie, and if somebody clicks on it and buys, then we get the honor of paying the tube back 50 percent of the revenue." Rowntree added that the sites "do send members, but it's not significant -- it's certainly nothing like it used to be."

Not everyone agrees with Rowntree. Evil Angel's Adam Grayson called Mindgeek "the most civilized [tube site] of the bunch." He added that he doesn't think the site is "such an egregious violator of [his] intellectual property rights," and that he likes the fact that it has offices in Canada. As for the matter of piracy itself, Grayson believes that free porn and the proliferation of tube sites are just a "reality of the business." Grayson feels that the content hosted by tube sites are, essentially, advertising. "If Pornhub gets $100,000 of market value from our clips, and we only get $10,000, then I have no other way to rationalize it that the other $90,000 was marketing."

There has always been free porn, but the economics of the industry generally have relied upon people paying something for the material they consumed. With equipment, crew, locations and a cast, it costs roughly $1,500 to produce a "scene," and with an average selling price between $20 and $30, each scene would require upwards of 60 purchases to break even. "Performers would get sometimes as much as $1,200 to $1,300 per scene back in the old days," explained Wasteland's Colin Rowntree. "Now they're lucky to get that for an entire day where they're shooting four scenes." Later, he added that he feels "horrible for them, because, I mean, most of the performers are living hand-to-mouth."

Pornhub launched Pornhub Premium as a way to remedy complaints from studios, promising a Netflix-esque subscription service for adult content connoisseurs. For a monthly fee of $9.99 (or $95.88 for the year), users can watch adult content in full HD, with no ads, exclusive access to full DVDs and new original content each day. For third-party studios on the service, Pornhub offers a revenue-sharing agreement that compensates them based on the number of views.

The figures involved, however, are ludicrously small, to the point that it's barely worth bothering with the service. Several studios -- which declined to be named in this article -- shared evidence of how much money they were making from Pornhub Premium. Despite scoring thousands of views each month, the payment for each view is less than five cents. At that rate, a film costing $1,500 would need to be watched 30,000 times before it could even break even.

What consenting adults get up to behind closed doors shouldn't be of interest to anyone outside those four walls. But if Mindgeek gets its way, it will be in the position to record an individual's browsing habits and keep them alongside a user's real name and personal data. Jackman said that there are "no safeguards specifically written into the law to ensure that over a third of its citizens' most personal and private data is held privately and securely."

And there is plenty of historical evidence to suggest that such a repository of information should not exist, for a variety of reasons. For a start, as the Ashley Madison breach showed, that data can be used to enable criminals to hack, extort and otherwise threaten individuals. News reports at the time also showed that two people are believed to have taken their own lives as a consequence of the hack.

In our report on data collection and sextech, we explained how the data recorded by connected devices could be used against us. Details of people's intimate desires made public can be used to marginalize, persecute or even kill individuals, and even in the 21st century revealing one's sexual preferences can threaten their life.

It should be a worry that Mindgeek's previous history of data security isn't particularly great, either. This year, Pornhub was subjected to a malvertising attack that was in operation for more than a year via its advertising network. In 2012, YouPorn was breached by hackers, exposing email addresses and passwords for more than a million users. Brazzers, another Mindgeek site, had 800,000 accounts exposed in a data breach in September 2016, while 73,000 were revealed when Digital Playground was hacked.

Corey Price doesn't believe that AgeID should be judged on Mindgeek's prior record, however, saying that the tool was "built in isolation" by a separate team in the UK. "AgeID has privacy at its core. It does not see, let alone store any personal data," said Price on the potential security risks. The company believes that the data will be processed by third-party verification providers, and all information will be hashed. Consequently, should a well-resourced hacker gain access to the system, he or she won't be able to pull out anything more than random strings of numbers.

There's also the issue of people being encouraged to hand over their credit card data to be used in a way that it was not intended. In 2016, Alec Muffett wrote about how users could be habituated into behaving in a way that would make most security professionals tear their hair out in shame. Asking people to "type their credit card numbers into random sites on the internet" is something not to be done lightly, but people may believe that there's no security risk because the process is "government-mandated." This could spark a boom in identify thefts, spoof sites and fraud conducted by those smart enough to exploit that trust.

Right now, nothing is set in stone, and it's entirely possible that all of these concerns are unfounded. But no matter how little politicians wish to be embroiled in the business of pornography, there may need to be proper scrutiny of its prospective gatekeepers. The fact that Mindgeek may be entrusted with the deepest, darkest secrets of millions of Britons shouldn't be taken lightly.