The Truth About PornHub's Safety Protocols: Exclusive Interview with Solomon Friedman & Sarah Bain

Thanks so much for having us, Kim. When we got into this work and founded Ethical Capital Partners, we really believe that more public dialogue is going to lead to a safer internet. Instead of people just hiding in the shadows and hurling accusations and defenses back and forth, productive dialogue is what's required because there are so many pieces to that puzzle of how to protect particularly young people on the internet. Like Sarah, I'm a partner at Ethical Capital Partners. We are the ownership group that acquired in March of 2023 100% of the company that was then called MindGeek. MindGeek operates, among other platforms, PornHub. It's now named Aylo and we are the co-owners of that company. My role as Vice President of Compliance for the ownership group is to support and assist the platform and its investments in trust and safety—both making the platform as safe as it can possibly be, protecting the vulnerable, but also serving as a conduit to the broader internet—to other adult platforms, social media, technology companies, government, law enforcement—so that we can share what we have learned and the technology we've developed. If you would have asked me 10 years ago where I was going to end up, it would not have been in the ownership group of one of the largest adult companies in the world. I was a criminal lawyer, a law professor. But when we began examining the prospects of acquiring this company and looking at what it had built, it is really one-of-a-kind online in terms of the work it's doing to keep the platform safe. It's definitely learned a lot of hard lessons, as much of the internet and the creator space have. But we're really in an exciting place to do things when it comes to protecting the vulnerable that no one else has done, and that should be absolutely widespread and common.

You really asked the right question because you asked about procedure and technology. It's important to emphasize that even though we're a tech company with incredible solutions—both in-house and from third-party providers—technology is not enough. We've made a massive investment in people. Aylo has roughly 1,400 employees, which is completely out of scale for the adult industry. Of those, 20% work full-time in trust and safety. If you asked Twitter or Facebook their trust and safety numbers, it's minuscule compared to that in proportion. As the ownership group, we never would have contemplated buying this company if this infrastructure didn't exist. As of today, there is no content on any of our content-sharing platforms that was not uploaded via the Verified Uploader Program. For every uploader, we verify their identity—age, ID, and consent. You can't just create an account and start uploading like on YouTube. You have to apply, review the terms of service, and verify your identity. We use a third-party provider called Yoti—they verify for governments, banks, insurance companies, car rental agencies. We require a biometric scan of the uploader's face in motion, government ID, and the technology matches both to ensure you're a live, real person. When AI-generated deepfakes of Taylor Swift erupted on social media, those would never have passed even basic review on our platform—we don't have her biometric scan or ID. If you pass identity checks, you're eligible to attempt to upload—you submit content for moderation. Before any human sees it, it runs through 10 different engines scanning for child sex abuse material—Google CSAI Match, Safer by Thorn, NCMEC. If there's a match, we report it immediately. We publish twice a year a transparency report describing all of this technology. Someone once asked if I was worried someone would copy what we do. I said no—that's what we're hoping for. I want every adult and social media company to copy our processes. If content passes all automated checks, it goes to human moderators working 24/7 in a secure facility. We are the only free content-sharing platform that requires all individuals featured in content to provide identification and consent. Even for faceless content, we require the same verification—we can request additional footage or photos to match the person to their ID. All moderators are full-time employees—zero outsourcing. There's a three-month training course before they start work. Our moderators look for far more than just legal compliance. We ban depictions of underage individuals, even if it's consensual roleplay. We look for contextual cues—a bedroom with youth-associated art, behavioral cues. A moderator's job is to look at both content and context. We also ban depictions of non-consensual activity or recording—even pretending it's non-consensual—spy cams, hidden recordings, depictions where someone cannot withdraw consent, intoxication, mind control or hypnosis even if pretend, and serious violence likely to cause injury or death even if it's acting. Content can take hours, days, or sometimes weeks to go through our moderation process.

That's a great question. Let's look at the numbers. We voluntarily report any instances of suspected CSAM to NCMEC—the National Center for Missing and Exploited Children. I say voluntarily—it's very important. We're not a US-based company; we're based in Cyprus, so we have an obligation to report to the Cypriot regulator, which we do. Notwithstanding that, for over four years we've been reporting voluntarily to NCMEC. They're the clearing house—Facebook, Instagram, Google, Snapchat all report to them. Because we have full moderation, we make reports even when nothing went live at all but we caught it. Last year in 2023, we made approximately 2,500 reports to NCMEC. These are suspected instances—we're not talking about things that necessarily ever went live. Meta, on its platforms between Facebook, Instagram, and WhatsApp, made around 20 million reports. When a law enforcement officer asked if that was a typo, I reminded them: nobody is eligible to attempt to upload before they're a verified uploader. We verified their real identity with biometric scan and government documentation. You have to be a special kind of stupid to try to upload child sex abuse material after providing your real identity verified by a third party. Does that mean no one does it? There are special kinds of stupid and evil throughout the world, but the verification process isn't just about ensuring age and consent—it's also about deterring misbehavior and holding uploaders accountable. We do not allow anything approaching anonymity when it comes to uploading on our platform.

Absolute zero tolerance. And this is not just a policy that is words—we have made enormous investments to ensure our platform is as safe as it can possibly be. Now, Kim, you have to understand—criminals are out there trying to engage in criminal activity every day. One of the limitations in giving a full tour of trust and safety is that you don't show the criminals where all your alarm systems and security processes are. So we have tools that I won't even talk about because they are designed to catch people trying to exploit the platform—which, just like people try to rob banks, they try to exploit online platforms. We can never rest easy. When I assure you we have a zero tolerance policy, that doesn't mean the work is done. Every day, new technologies are being developed to fight wrongdoers online. Unfortunately, that is the nature of trust and safety on the internet.

And I'll just add—since you asked about since our acquisition in March of 2023. In the 2023 NCMEC report, besides the number of reports they received from platforms—those are proactive reports—they also give the numbers of how many notices they sent to platforms. A notice means they detected suspected child sex abuse material and they're notifying the platform. The Meta number was somewhere around 200 million notices. In 2023, the total number of notices of suspected CSAM from NCMEC to all of Aylo's platforms was zero.

This is not us saying this—NCMEC is not a porn industry entity. They are the National Center for Missing and Exploited Children, relied on by law enforcement around the United States. They're the leading authority when it comes to not only data but also law enforcement action against child exploitation.

I couldn't agree more. Leading by example is very important for us. I always tell anyone I'm speaking to—whether media, advocacy, government, or law enforcement—don't take it from us. Go to trusted third-party advocacy and internet safety agencies. A great example is the Internet Watch Foundation in the United Kingdom. Two years ago, they signed a partnership with Aylo to create best practices and standards for all adult companies to fight against child sex abuse material. At the time, that raised a lot of eyebrows—it was still called MindGeek. Why is this major internet safety agency partnering to create these standards? That should tell you there's more to this discussion than meets the eye. Maybe the professionals in those spaces don't have the same view about MindGeek, Aylo, PornHub. Just two weeks ago, the Internet Watch Foundation finalized those standards. It's not a PornHub or Aylo panel—it has members of UK law enforcement, child protection agencies. They created standards where adult companies must abide by a code of conduct when it comes to protecting against child sex abuse material. They used our processes as a model because we built this proactively. One example that goes to your point about doing more than the legal minimum: we have a banned word list on our platform—words that cannot be searched for, used as a username, comment, tag, or title. We're over 44,000 words in more than 35 languages. Criminals are always trying to evade detection—using symbols or abbreviations instead. We pay a third-party provider to scrape the dark web for these terms so we can add them to our banned list. We don't have to do that—we do it because we want to stay ahead of predators. Beyond zero results and a warning that the search could be illegal, we decided to go further. We know predators come to our platform looking for illegal content and won't find it. It would be within our rights to just let them leave. But the folks at Aylo, working with organizations around the world, made a principal decision: we can't turn a blind eye. That's where deterrence messaging arose. When someone searches for child or minor-related terms, not only do they get zero results, they get forwarded to resources that can help them get assistance. We've partnered with organizations in Canada, the United States, the UK, France, Australia—all over the world. In the UK, a chatbot pops up saying you're searching for illegal material and help is available. We gave all the results to a university for academic study, which found two important things: the deterrence messages actually reduce the number of searches looking for illegal content, and dozens of people got real-world help with these urges.

Organizations they got counseling whether over the phone or in person, but in the real world. And I think to myself, a program like this — of course it opens up to criticism, oh well, people are looking for illegal content even though they're not finding it. But if we can help one person, which means we can save one child — even one child — all of it's worth it. Help one person get assistance so they don't offend in the future, that is a no-brainer. It's not required by any law, but it is who we are as a company. We've been doing this now for years in jurisdiction after jurisdiction. And Kim, I'll add — you know, I think you sort of hinted at it at the beginning — that certainly by even hosting us on your show, you open yourself up to potential backlash. You open yourself up to individuals not understanding your objective here. Your objective is: let's shed some light on this, let's collaborate, let's find ways to reduce harm online. And if it's by, you know, taking on a bit of that risk yourself to open this up, to allow your listeners to understand what we are trying to do — that does bring on some risk. So when you, at the beginning, your question about social media platforms — and Saul mentioned it — we want to make the data we have, the tools we have, available to other companies. Because we are, if you will, the first that are doing some of these efforts, because we absolutely have to. The content that we are sharing is for adults only, and we need to ensure that young people are not in the content. Zero tolerance for young people being in the content, but also zero tolerance for young people consuming the content. This is content that is restricted to adults. And so we want to share that finding, that data, the tools that we have. But that brings on some risk to companies, to individuals, organizations, not-for-profits — as Saul mentioned, the IWF — it brings on risk to those organizations. Now, because they are willing to sit down with us, understand what we're trying to do, and work with us, we appreciate that. We are making efforts. We're absolutely reaching out to social media companies. We're absolutely reaching out to governments, law enforcement, organizations like yours, and we are working with them. Sometimes it's difficult to share that because it compromises that really important work that we're doing. And us getting kudos or credit or recognition for some of the work we're doing — if it puts at risk the work that we're doing, then it's not worth it for us. It's not worth it for those organizations. So to try to bring it back to: what are other social media platforms doing? We're trying to work with everyone. We're trying to make sure that same objective, which is keeping kids safe online, keeping the internet safe — so it's more like a call out to your listeners or anyone who's listening: corporations, individuals — if there are things that we could be doing differently, if there are tools that they're aware of — they may not want to contact us, but there are not-for-profits that they can work through that are our partners, and all of that is publicly available on our website. I don't want anyone sending you thousands of emails, but even you, Kim — if people see that through you they have a funnel towards us, then I invite people to think about what are things that we should be doing. If we're not talking to individuals like yourself or to experts, we also will become stagnant. We need to understand what's happening in the larger internet. So I'll mention that we also work with organizations that are scouring the dark web, because we can't just pretend that we exist in this very safe space. This is the internet, and all of us are responsible for keeping it safe.

If there's an accusation, if there's content that you believe is not appropriate, or that you didn't consent to, or that you've had a hard time taking it down — reach out to us. This is a solicitation to let's work together. Let's not just talk about the problem; let's actually work together with the right people for solutions. I challenge every single person who has a complaint or concern to contact either Ethical Capital Partners or myself, and let's work together to solve it. And just in terms of content removal, the very best thing to do — this is an essential plank of our trust and safety program — and on every single page of every single one of our platforms, it's something called the content removal request form. If an individual fills that out and indicates that they have firsthand knowledge that what is depicted is either underage or non-consensual — and Kim, you talked about withdrawing consent — I want to highlight that we require ongoing consent in order to have people's content featured on our platform. So if an individual withdraws consent, go ahead, fill out the content removal request form — you'll see this and try it out — it will come down with no investigation. The investigation comes after it's been taken down. I call that the 'take down first, ask questions later' approach. So anyone can fill out a content removal — now, if you fill out that content removal request form and say 'I don't like porn, take this down' — well, fair enough. But if you say 'that's me in the content,' then you'll be contacted to prove it, provide some details. But it'll be down in the interim. It will be removed. The content removal request form is on every single one of our platforms, on every single page, and it is automatic when it comes to takedown. So that is an important process. It's required because consent is at the heart of what we do.

Correct. That's all content that comes through the verified uploader program. Obviously, we're talking about content individuals have generated — whether you're the one who posted it or not, whether you've just changed your mind. We actually even go a little further than that. When somebody sends a content removal request form, we actually use our own internal fingerprinting software to look for other instances of that same content on our platform. Maybe it's part of a larger clip compilation or a shorter form — we have technology that can scan for that. We do a number of things. We'll also send requests to Google to delist even the link with the name, because obviously Google's a separate company, we don't control what they post online, but we do send removal requests. And we'll also, for individuals who say 'my content is on other platforms as well,' we will then forward them some tools that are available to look for their content and have their content removed elsewhere. So ongoing consent is essential. Because Kim, I think you actually put it really well — that distinction between legal adult content and sex trafficking. To me, I make it very clear the distinction between — and we'll just say porn, we're not scared of that word — the distinction between porn and sex trafficking is the distinction between work and slavery. Work is legitimate and deserving of protection, and it is a decision someone makes. Slavery is not. And sex trafficking is slavery. And like child sex abuse material, we have a zero tolerance policy for sex trafficking on our platform.

And Kim, for us it's not a line in the sand — it's a line in cement. It is an infrastructure that there is no way to get around. So I know the expression is 'line in the sand' — for us it's even a line in a skyscraper, the difference between adult and children. And I think I'll say this: it's why dialogue like this is so important, why I'm so, so honored that you want to speak to us and your audience wants to hear from us. Because I say this — you say that you don't really have an opinion on adults one way or another, and I can even go further: let's say you told me, Kim, 'I am anti-pornography' — I would say great, we can disagree on that, let's put that to the side and let's go on what we agree on. Because we agree on far, far more than we disagree on. We agree that there should be zero tolerance for child sex abuse material. We agree that child predators should be prosecuted to the fullest extent of the law — that they should be deterred, detected, investigated, and prosecuted. We believe that consent is essential. We believe that non-consensual content should be eradicated. So it's like, I don't even need someone to say they're quote-unquote agnostic about porn. You can be anti-porn, that's fine. We have so much to talk about and work on, far more than just consensual adult content.

Yeah, so why don't we start — I always like to start with values. Just like people, companies are animated by values: the values of their founders, their executives, and their employees. Our value when it comes to this topic is simple: we do not want any young people whatsoever on our platforms. The performers who are creating this content do not want young people viewing it. We don't want young people viewing it. We're of the view that it's inappropriate for young people, it is not in their best interest, and they should not be viewing this content, period. We have no interest whatsoever in young people on our platforms. Now, the question then is: what do you do about that? If that's your value, what do we do about it? I'll talk about what we have been able to do alone, and then I'll talk about what we need to do in concert with other major actors. So as of today — and this has been in place for many months now, something I'm quite personally proud of — when you go to any one of our platforms from anywhere in the world, including the United States, before seeing any explicit content, you see: 'Are you 18? Under 18? Over 18?' Obviously, if you say you're over, you can go forward; if you say you're under, you cannot. Now, that's limited utility without the ability to verify, but what's much more important is that on that very same dialogue box that pops up — without seeing any porn, nothing explicit whatsoever — we have a link right then and there to parental controls. And people can test this out themselves. When you first go to the platform, we want to center for parents and guardians to make it easy for them to block our platform. I want to reiterate: I'm telling you from the owners of Pornhub — we want to make it easy for parents to block the platform. If you go to our parental controls link, which is right there before seeing any explicit content, we give all the options to block at the router level, to block at the device level, to block at the internet service provider level. So that's something we can do on our own. Let's then talk about broader solutions, because we need to do more, and we're of the view that we have a responsibility to do more, and the internet in general has a responsibility to do more. So take a look at the law in places like Texas. The Texas law — which, by the way, is unconstitutional and we're challenging it up to the Supreme Court of the United States — requires everyone, adults included, to provide their identity and their identifying information, including government-issued ID, before accessing legal content. And to us, we will not gather the personal identifying information of our visitors. We believe strongly in the right of free expression, the right of privacy online. So for that reason, we are of the view that it's ineffective. Now, it's also ineffective at protecting children. Let's play this out: a child comes to Pornhub and they get the Texas age verification — have to put an ID — what do they do? They go elsewhere. They just go to a site that does not comply, and there are hundreds of thousands of such sites hosted all over the world, far beyond the reach of the Texas government and the state government in any jurisdiction. They go to that platform. So I always say that this kind of site-based age verification — where you get to prove your age to the site — is like a locked door in the middle of the desert. Sure, the door is locked, but you just walk around it. It'll do nothing whatsoever to keep either young people or adults safe. In fact, it'll actually only make adults less safe, because the same platforms that don't require that kind of verification are the same platforms without our trust and safety, without uploader verification, without moderation, without our standards. So then what is the solution? I'm a very solutions-oriented guy, and I'm very fortunate to have been part of the ownership group of a very solutions-oriented company. The problem here is twofold, Kim — and I'm so glad you brought up the idea of predators preying on children on different apps, because I always say: if you think this is a porn problem, you don't understand age verification. Because age verification is equally — just as much as it's about keeping children out of adult spaces — even more importantly, it's about keeping adults out of children's spaces. Because the kind of exploitation that happens when youth-oriented apps, young people-gathered spaces online are then invaded by predators — that is equally, if not far more, harmful than young people being exposed to explicit content, which is also harmful and something we want nothing of. So how do we do it? The answer is very simple. And in fact, Kim, Sarah, most of your listeners — the answer is in your pocket. It is your device. Instead of targeting sites — which, by the way, makes no sense at all; the law in Texas targets only sites that have a certain proportion of their content being adult or explicit content. I always say: what's the largest repository of adult content online? Call it the largest porn site in the world — it's not us, it's not any of our competitors. It's Google Images. Google Images has more porn than all of us combined. Or, as the Australian eSafety Commissioner found, the majority of young people first encounter porn on quote-unquote safe-for-work sites like Twitter and Reddit before they ever get to a porn site. So if you have a law that only targets adult sites, you're missing the mark. You need to start at the source. The source is the device. I'm going to say something, Kim — it's going to be surprising. I presented at a conference of 400 investigators and prosecutors who focus on internet child exploitation, and there was a gasp when I said this: we want, as a company, for all devices by default to block adult content. That is, when you have a new device or a new user registering access to a device, the default is no adult. And if you want to be able to access adult content on the device — where we already have all our trusted information, our banking information, our credit card information, our health information, our government biometric identity, everything; we unlock these things with our faces — your ID can reside securely there to verify your age, and then the device becomes the key. We will be the lock. And the good thing about this is, instead of convincing, legislating, cajoling hundreds of thousands if not millions of websites, we only have three operating system manufacturers we need to be concerned with: Google, Apple, and Microsoft. And they already have the technology — they just have it as opt-in. You need to activate these controls. We want it to be opt-out — that these controls are activated by default. And if we could accomplish that and have a world where both children — and by the way, adults who don't want to see porn should also be part of this — that they can't see this material even by accident, I think the internet gets a lot safer for everyone. So we are working day and night to make this happen, but we need those players, including legislators, to make it a reality.

Great question. So as a European company, we're bound by some of the strictest data protection rules on the planet, and we apply all those same protections no matter where our users are located, so they all get the benefit of that. And once again — I know people don't come to Pornhub.com to read the articles, but you should read the privacy policy; it's actually pretty interesting, and it, by the way, includes a right to have your private data deleted. But we do not gather any personal or private identifying information of our visitors. We don't do that. When it comes to someone who signs up and buys a premium product from one of our subscription services, we take only the minimum data that's required in order to facilitate the transaction. That's, in fact, what the law requires us to do — we're not allowed to take more information than is required. What this would do is expose 130 million people a day to reporting their personal identifying information to sites like ours. But as Sarah said, there are millions of adult sites, and there's new ones popping up every day — and who, by the way, and this is something I really emphasize — not all these sites have either our commitment to trust and safety and privacy, or the infrastructure and the data security that we have. It's one thing to do that when you're a company of 1,400 — we have 500 engineers building tech products every day. But the idea that this information is just going to be given out freely online — and I'll tell you, it's interesting. When we first litigated this in Texas, the judge — Justice David Ezra, who heard it, by the way, a Ronald Reagan appointee, so not some namby-pamby liberal judge, appointed by Ronald Reagan to the bench and still going strong — he said something really interesting. He said: 'Of course this is going to deter free expression online. How will it violate the First Amendment? Think about it this way: somebody in Texas is going to be accessing perfectly legal content and sharing their sexual preferences with the government of Texas. That's unacceptable in a free society. We don't do that.' Particularly where, in Texas, the government not 20 years ago tried to outlaw consensual homosexuality. You can have whatever moral or religious belief you want, but it's constitutionally protected. Adults have the right to make those free choices, and we do not share that information with the government. We just don't. So the device-based solution is one that protects the private data, because that information never comes to us as an adult provider, and it's much more of a holistic safeguard — because to your point, there are many different platforms that either have content that's not appropriate for children or that children shouldn't access, etc. So what's in the way of the device-based verification? I'm assuming you guys are behind that and working towards that. What are the obstacles to attaining that?

Okay, so I say there's two things. The first one is this site-based approach that seems to be going from state to state. The major obstacle is — as I've said — just by the fact that it doesn't include Google or Reddit or Twitter, it tells you that it's not about keeping young people away from adult content. It's about trying to destroy the adult industry for ideological reasons. That's straight up. And in fact, the sponsors of that bill readily acknowledge who has been behind it and pushing it from state to state. So when you're not focused on the actual problem, you're never going to get to the right solution. It's like this old parable: a guy comes out of a bar and he sees this drunk stumbling around a light post. He says, 'What are you doing?' And the drunk says, 'Well, I lost my keys and I'm looking for my keys.' He says, 'Okay, well where did you lose them?' And he points all the way down the darkened street. He said, 'I lost them down there.' And he said, 'Well, if you lost them down there, why are you looking under the light post?' And he says, 'Well, the light's better over here.' So where your target is, by definition, not going to address your stated means — then your stated means are baloney. It's not really what you're interested in doing. So the first thing I want to do, I say, we need to actually have a conversation about protecting young people. If that's your goal, then this approach is absurd, number one. Number two, we need the legislative and regulatory will to require Apple, Google, and Microsoft to take this action. And if they don't take it voluntarily, they should be legislated to do it. Sometimes people hear that and say, 'Well, you're just passing the buck.' I say no, no, no. There should be two parts of this law: number one, devices by default must block adult content; and second of all, adult sites must identify themselves using metatags, such as the Restricted to Adult flag, to identify themselves to devices that they are adult sites. And guess what? We've been doing that for years, and the vast majority of sites do it. And if adult sites don't do it, they should be penalized. It should be required. We do it voluntarily because we want content filters to know that we're an adult site. Obviously, if Pornhub.com in the URL wasn't a giveaway — that's fine, we will fly the digital Restricted to Adult flag. We already do, and we have for years. So this is not a matter of passing the buck — it's a matter of understanding that we have an area of shared jurisdiction and we need to collaborate to get that done. So that's what's in the way: poor intentions on the legislative front, and then a lack of will to require this from the device and operating system manufacturers.

And I just — I'll disagree with you a little bit. I think there is profit in it. I think that if, let's say, you're a device manufacturer and you can market your device as being the device that's safe for children — you should do it. I think I'm going with this, absolutely.

Couldn't agree more. Couldn't have said it better.

Yeah, sure, I'd be happy to. And I'll say the general caveat about this is there are operational details where we have worked or cooperated with law enforcement in certain venues where we're asked — and sometimes even required — not to disclose that. So I can't get into certain specifics, but I can definitely talk about a lot of the programs we run as well as many public-facing initiatives. So it is essential to us that law enforcement have easy, efficient, and effective access to our data so that they can do their job. Now, sometimes — especially for companies that are headquartered out of the United States, which, by the way, most of your social media companies are, Google included, Facebook — they might be in California, but they're not in California; they have head offices elsewhere for a number of reasons. We wanted to make it — and we're headquartered in Cyprus — we didn't want law enforcement to have to go find a Cypriot address for service of a warrant or judicial authorization. So we built what's called a law enforcement portal, to put at law enforcement's fingertips access to provide us with the authorizing documents, as well as so they can get all their responses in one coherent way. Because it's essential to us that when law enforcement has a judicial authorization — whether it's a search warrant or a subpoena — to try to get data about a potential offender, that they can do that really quickly. Because in child protection investigations, minutes and hours matter. So we staff those requests 24/7. We have an incredibly fast turnaround. It's funny — going back to my old lawyer days, I remember seeing subpoenas going to your major telecom providers, AT&T, but also social networks like Facebook, where it would take them a week or more to respond. You ask any frontline cop, that's pretty standard. We get to these requests generally in matters of hours, and where they are urgent, we go faster. We work weekends, because this data, if it's essential to an investigation — we're talking about...