The World’s Most Popular Porn Site Is a Government Agent Now. Does It Matter?
On Monday, I published a two-part blog post about the Federal Trade Commission (FTC) settlement with Aylo, parent company of Pornhub. The FTC's complaint alleged that Aylo violated federal consumer protection law by allowing child sex abuse material (CSAM) and non-consensual pornography (which I'll call NCII) on its various sites, despite claiming it didn't. The resulting order, now approved by a Utah federal judge, imposes a bunch of requirements to make Aylo clean up its act.
In part 1, I discussed the lurking Fourth Amendment problem with the content review" provisions of that order. (Part 2 explained why this isn't really about fighting CSAM and NCII; it's a power grab over free speech online by the Trump FTC.) The tl;dr: by forcing Aylo to scan every uploaded file to check if it's CSAM or NCII, the FTC has turned Aylo into an agent of the government for purposes of the Fourth Amendment, making all those scans warrantless searches.
Warrantless searches are typically considered unreasonable and thus unconstitutional, unless consent or some other exception to the warrant requirement applies. The usual remedy for unconstitutional searches is suppression. Consequently, I said in part 1, any evidence turned up in the scans ought to be inadmissible in any resulting prosecutions of the accused uploaders.
A couple of readers challenged my assumption about the outcome by raising a provocative question: Doesn't the order also force waiver of the reasonable expectation of privacy in file uploads, dooming any motion to suppress? That is, even if the world's most popular porn site - one of the world's most popular websites, period - is now an agent of the U.S. federal government: does it matter?
The FTC Order Purports to Make Aylo Users Waive All Privacy Rights in Uploads
In response to a suppression motion based on the content review mandate I quoted in part 1, prosecutors will point out a different provision that requires Aylo to (1) notify users that uploaded files will be searched for CSAM and NCII, and (2) include a waiver of any privacy rights" in that notice.
Per the order (at pp. 13-16), for any file uploaded by Content Partners" (meaning professional porn companies) or Models" (meaning any other third-party individual or entity that uploads" content to an Aylo site besides Content Partners), Aylo must not make the content available unless they:
Provide a notice and a consent checkbox for each piece of Content to the uploader of the Content, which the uploader must review and endorse prior to submitting Content for review. The notice and checkbox will inform the uploader that Defendants will review Content prior to its publication and may report actual or suspected CSAM or [NCII] to the National Center for Missing and Exploited Children or to relevant law enforcement. The notice and consent checkbox will inform the uploader that if the Content is approved for publication it will be made public and that the uploader is waiving any privacy rights they may have previously had in the Content by submitting Content for Defendants' review...
The FTC is trying to use Aylo to do something the government would have a very hard time doing directly. Via a consent order, it's making Aylo force its users (models and content partners) to consent to a search of their uploaded files and waive all privacy rights therein. This would allow future prosecutors to invoke either the consent exception to the warrant requirement, or to argue that Aylo's scans aren't a Fourth Amendment search" in the first place, even if there's no dispute that Aylo is a government agent. (In Fourth Amendment law, a search" only occurs when the government infringes upon an expectation of privacy that society is prepared to consider reasonable.'")
The question, then, is: Can they do that? Will that work? I think there are good arguments for no," but the real answer is probably I guess we'll find out once CSAM defendants start filing motions to suppress."
The notice-and-consent language that Aylo ultimately implements will be subject to a fact-specific analysis if it's ever challenged in court. As the Second Circuit recently noted, courts have shied away from the question of whether terms of service pertaining to content review might ever be so broadly and emphatically worded as to categorically extinguish internet service users' reasonable expectations of privacy in the contents of their [files], even as against the government." It may well be that such terms, as parts of [p]rivate contracts[,] have little effect in Fourth Amendment law because the nature of those [constitutional] rights is against the government rather than private parties,'" that court continued, quoting from a recent law review article by my Stanford colleague Orin Kerr. But, in the case before it, there was no need for categorical conclusions," because the specific terms in question didn't extinguish the defendant's reasonable expectation of privacy in that content as against the government."
In Kerr's article, he argues that Terms of Service can define relationships between private parties, but private contracts cannot define Fourth Amendment rights." Kerr's article expresses skepticism that language purporting to authorize a service provider to act as the government's agent and search the user's data would be effective, even assuming the user saw and understood that language (and users typically don't read TOS). He thinks that court decisions to the contrary are wrongly decided.
The Aylo situation has some twists from the cases and hypotheticals Kerr discusses. Which is to say that I don't think this particular fact pattern has, uh, happened before. (Because, as my first post discussed, the government usually tries very hard to avoid the impression that it's making platforms scan for CSAM!) What is the result where the private platform is already an agent of the government thanks to the FTC order? What if the user didn't know that? Does it affect the reasonableness" analysis if the user thinks they're giving consent to a private company, not to the government? After all, the notice and consent" disclosures do not require Aylo to disclose that the company is under an FTC order (which compels the user's upload to be reviewed) and that's why the user is being shown the notice and consent flow in the first place.
Is the notice-and-consent language the order requires emphatically worded" enough to categorically extinguish" Aylo uploaders' reasonable expectation of privacy? Does it procure valid consent to an otherwise problematic search? Is the notice-and-consent language's wording irrelevant, and the dispositive factor is that the uploader intended the file to be publicly viewable on a porn site, not to attach it to a private email message or add it to a private cloud storage account?
This is all complicated. Needlessly complicated. None of this was necessary.
The Aylo Order Will Add Needless Work in Criminal Cases
Maybe a future court will decide that the make your users waive their privacy rights" language in one part of the Aylo order cures the Fourth Amendment problem created by the content review mandate in another part of the order. Maybe suppression motions will ultimately fail when made by defendants accused of uploading CSAM/NCII to Aylo. But criminal defense lawyers will still file them (as they must, ethically, and should, to make the government meet its burden). Prosecutors will have to make specific arguments in every case for why the defendant had no reasonable expectation of privacy. There will probably be arguing over whether the waiver of privacy" language in the Aylo order actually holds up. There may be discovery involved. Courts will have to decide all those motions.
We can also expect to see suppression motions citing the Aylo order in other CSAM/NCII cases that didn't originate on Aylo sites. In my previous blog posts, I talked about how the FTC regulates by consent decree; the Aylo order signals to other platforms (and not just adult sites) that they'd better scan uploads for CSAM/NCII, or they might catch a case too. The Aylo order opens the door for criminal defendants caught by scans on other platforms to argue that those scans aren't voluntary (even if they used to be), rather they're induced by the FTC. They'll try to subpoena documents and witnesses from the platform, looking for proof. And in those cases, there won't be any order that Department of Justice (DOJ) prosecutors can cite that purports to make that platform make its users waive their privacy rights. Will those suppression motions work? Maybe, maybe not. But criminal defense attorneys will try, because, god love em, they'll throw a lot of stuff at the wall to see what sticks, and sometimes, bless them, something does.
All of this is work nobody would need to do if the FTC hadn't put all this problematic language into the order with Aylo. When drafting the terms of that order, it would have been so easy not to manufacture any Fourth Amendment issues.
Erase the Fourth Amendment Online with This One Weird Trick!
But then, maybe that's the point. The FTC apparently believes it has the power to enter orders making online platforms search every single file uploaded to the service and report any illegal material that turns up (as per pp. 34-35 of the Aylo order, duplicating what's statutorily required for CSAM anyway)... and, because they'd also be forced to notify users of the searches and obtain users' consent," that's A-OK. Government-mandated disclosures would be all that's needed to wipe away users' constitutional rights not to be subjected to warrantless surveillance conducted, at the FTC's behest, by what looks like a private company but is actually an agent of the government (likely unbeknownst to the user).
Having used this theory on a major porn site, the FTC can later apply the same approach the next time they go after a Big Tech company - many of which are already under decades-long consent decrees with the FTC over prior incidents (often alleged privacy or data security issues), making them potentially susceptible to additional enforcement actions. And that's how the Trump FTC will try to use its orders with companies, not just to control speech online, but to get rid of Americans' Fourth Amendment rights online in an era where the Supreme Court has been deeply skeptical of the third-party doctrine. I sure hope Professor Kerr is right.
Conclusion
Maybe the Aylo order won't end up letting a bunch of accused CSAM and NCII defendants go free, like I feared. Maybe, instead, it's how the Trump administration tees up a future court challenge with the goal of getting a ruling that severely harms our Fourth Amendment rights online. If that's the order's secret purpose, then the FTC's power grab is even worse than I thought.
The DOJ has spent years making its terms of service beat the Fourth Amendment" argument in response to CSAM suppression motions. Hanlon's Razor says not to ascribe to malice that which can be explained by incompetence. That's what I did in my first blog post, assuming the FTC order was the work of attorneys who know consumer protection law but not the niceties of the Fourth Amendment. But now I wonder whether the DOJ's fingerprints aren't actually all over this order. It might be time to grudgingly come around to a remark someone made to me: that the FTC's order is a work of evil genius."