The platforms sex workers use for advertising all have terms and conditions pages listing their privacy policies. I have taken a close interest in reading these policies since it seems that many directories give themselves permission to sell our personal details, and even our identity documents, to advertisers and to hand over our identities to the authorities without requiring a subpoena.

Escort directories have been hacked and raided before and will get hacked or raided again. Unfortunately, many directories take copies of our identity documents and selfies and just leave them lying around unencrypted.

Our identities have value in that they can be sold to spammers and used for leverage to make a deal with authorities. I don't see why escort directories need a full non redacted copy of our identity documents and an un-blurred selfie.

My recommendations

• If they need to know your year of birth, fine, send them a copy of your ID with everything except the year of birth hidden.
• If you're "face in" on your ads, why shouldn't you also be "face in" on your verification? Blur your face on your ID that you send in.
• If they get hacked, do you want your identity stolen? Put a cross Through your ID saying "for X Directory verification purposes only." (replacing the "X" with the name of whichever directory you're verifying for.)
  

Example

I sent emails asking about privacy policies to Tryst.link, Eros, Megapersonals, Slixa, Listcrawler, P411, Eroticmonkey, Ourhome2, Humaniplex, Adultsearch, Theeroticreview, Leolist, Terb, Adultwork, Vivastreet, Eurogirlsescort, Scarletblue, Ivysociete, Escortsandbabes, Massagerepublic, Rentmen, Hunqz and Sleepyboy.

These are my findings.

Discovery

Here are the questions I asked:

• Do you require personally identifying information from sex workers for verification?
• Identity documents?
• Selfies?
• Can these be partially obscured or redacted?
• Do you sell our identities and/or personal details to third party advertisers?
• Do you take any steps to secure our identities from hackers or in case your servers were seized?
• Are our identity documents and selfies deleted after verification?
• Stored offline?
• Encrypted?
• If you were told you could protect yourself from prosecution by freely handing over the identities of sex workers to authorities, would you do so?
• Or would you put up a fight and demand that they get a subpoena?
• Do you honour deletion requests?
• In entirety?
• How long does this take?

I sent the emails on September 2nd 2024. Only P411, Hunqz and Rentmen have replied. Tryst said they will respond to my questions in a few weeks time. (They have responded and it is included below.)

Table of platforms and known privacy standards

Note: The data displayed here is based on either responses (if received from my request) or determined by the Terms & Conditions and Privacy Policies found on those sites.

Scroll down to the "Details and Responses" section to see responses along with links to their site policies and questions or concerns I have about them.

Platform	Accepts partially obscured or redacted identity documents	Refrains from selling personal details to third parties	Encryption used to secure our identities	Identity documents and selfies are deleted after verification	Withholds identities from authorities unless subpoena provided	Honours deletion requests partially	Deletion requests honoured entirely	Processing time for deletion requests
Tryst	No	Yes	Yes	Yes	Yes	Yes	Yes	Instant
Eros	No	No	No	No	No	No	No	18 months?
Megapersonals	No	No	No	No	No	No	No	No
Slixa	No	No	Yes	No	No	No	No	No
Listcrawler	No	No	No	No	No	No	No	No
P411	No	Yes	Yes	No	Yes	Yes	No	No
Eroticmonkey	No	Yes	Yes	No	No	No	No	No
Ourhome2	No	No	No	No	No	No	No	No
Humaniplex	No	Yes	No	No	No	No	No	No
Adultsearch	No	No	No	No	No	No	No	No
Theeroticreview	No	Yes	Yes	No	No	No	No	No
Leolist	No	No	No	No	No	Yes	No	No
Terb	No	No	Yes	No	No	Yes	No	No
Adultwork	No	No	No	No	No	No	No	No
Vivastreet	No	No	No	No	No	No	No	No
Eurogirlsescort	No	Yes	Yes	No	Yes	No	No	No
Scarletblue	No	No	Yes	No	No	No	No	No
Ivysociete	Yes	No	No	No	No	Yes	Yes	30 days
Escortsandbabes	No	No	No	No	No	No	No	No
Massagerepublic	No	No	No	No	No	No	No	No
Rentmen	Yes	Yes	Yes	No	Yes	Yes	No	7 days
Hunqz	No	Yes	Yes	Yes	Yes	Yes	Yes	1 day
Sleepyboy	No	No	No	No	No	No	No	No

Operating Locations

Where a platform is located can impact the laws and policies of a company.

Eroticmonkey, Ourhome2, Humaniplex only operate in USA.

The USA approach to privacy laws is more fragmented and industry specific than the GDPR in Europe but they do have the Federal Trade Commission (FTC) Act.

The FTC enforces rules related to consumer protection, including privacy and data security practices. Under the FTC Act, the agency can take action against companies engaging in unfair or deceptive practices concerning the handling of personal data.

Several other states besides California, like Virginia, Colorado, and Connecticut, have introduced comprehensive privacy laws similar to the GDPR. These laws grant consumers certain rights over their data and place obligations on businesses handling personal data.

Leolist and Terb are exclusive to Canada.

Privacy laws in Canada come under the Personal Information Protection and Electronic Documents Act (PIPEDA).

PIPEDA is the federal law that governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activities across Canada. Key provisions include:

• Consent: Organizations must obtain meaningful consent to collect, use, or disclose personal information.
• Data Access and Correction: Individuals have the right to access their personal data and request corrections if necessary.
• Reasonable Use: Organizations can only collect information necessary for the purpose they have outlined, and they must handle that data responsibly.
• Safeguards: Organizations must protect personal information through appropriate security measures.

Scarletblue, Ivysociete, Escortsandbabes list sex workers based in Australia.

Australia's primary federal privacy law is The Privacy Act 1988. It regulates how personal information is handled by government agencies, organizations with an annual turnover of more than AUD 3 million, and some smaller organizations. Key elements include:

Australian Privacy Principles (APPs): The act is based on 13 Australian Privacy Principles, which outline the standards, rights, and obligations related to the collection, use, disclosure, and storage of personal information. The APPs cover areas such as:

• Open and transparent management of personal information
• Anonymity and pseudonymity
• Collection of solicited personal information
• Use and disclosure of personal information
• Data security and access rights to personal information
• Consent: Organizations must generally obtain consent to collect, use, or disclose personal information, unless exceptions apply (e.g., for law enforcement purposes).

The remaining directories all operate in Europe.

Tryst.link, Eros, Megapersonals, Slixa, Listcrawler, P411, Adultsearch, Theeroticreview, Adultwork, Vivastreet, Eurogirlsescort, Massagerepublic, Rentmen, Hunqz and Sleepyboy all list advertiser profiles based in Europe so they are all required by law to comply with GDPR.

The General Data Protection Regulation (GDPR) is a European Union law that sets guidelines for the collection, processing, and storage of personal data of individuals within the EU. It aims to enhance individuals' control over their personal information and imposes strict penalties on organizations that fail to comply.

Details and Responses

Tryst.link

Tryst's Privacy Policy and Tryst's Terms.

Tryst.link has replied to my email:

Do you require personally identifying information from sex workers for verification?

Identity documents?

Yes, a form of government issued ID is required to advertise on Tryst. This became a requirement as a result of changes made by Payment Processors in 2021.

Selfies?

To sign-up for Tryst, we require two different selfies which is processed internally by our verification team:

1. A selfie where you’re holding up your identification. This helps us to make a match your face to your ID. These photos (and any additional photos of ID) are automatically deleted as soon as possible, for example within 24 hours after approval.
2. A selfie where you’re holding a handwritten sign. This photo is stored until your account is deleted.

Both selfies are processed at the same time, ensuring that the person in the first selfie is the same as in the second. The selfie with the sign is kept for the life of the account to help match future photo uploads and assist in verifying your identity if you lose access to your account.

Can these be partially obscured or redacted?

We can’t accept redacted identification documents as a result of the requirements set out by Payment Processors terms of service for adult sites.

You can read more about these changes and the impact financial discrimination has had on the sex working community via the #AcceptanceMatters campaign and the Free Speech Coalition’s: financial discrimination report. You can also find out more about our verification process in our Age verification on Tryst.link knowledge base article.

https://help.tryst.link/en-gb/14/142

Do you sell our identities to third party advertisers?

No, we do not and will not ever sell any data to third-parties.

Do you take any steps to secure our identities from hackers or in case your servers were seized?

• Tryst is a collective of current and former sex workers and technologists, we know how damaging a data breach is to the community and to our reputation. We take the security of our platform seriously, and commit to notifying our users if there was ever a data breach.
• We tightly control who has access to your information. We think it's important that your sensitive information is only viewed when it needs to be, and only by the person who needs to see it.
• We use multiple layers of encryption when accessing and storing your information, where each layer adds additional protection to the one inside it. These layers include encryption of your data, held on encrypted servers, accessible only via encrypted connections and authenticating with multiple factors. We also log all access and have auditing processes that monitor access to this information.
• We specifically chose to host your sensitive data only on servers in the EU due to the higher level of protections provided through the privacy and international human rights laws that apply there.
• While technological protections are important, they're not a complete solution. We also have strong internal policies and processes that minimise how much of your personal information our team members see. This includes deleting your data as soon as we can, once we are in compliance with the requirements we needed it for. We audit the access logs regularly and make sure that there are no unapproved actions.

Are our identity documents and selfies deleted after verification?

As soon as we can, answered in more detail in the answer to the ‘selfies’ question.

If you were told you could protect yourself from prosecution by freely handing over the identities of sex workers to authorities, would you do so?

From our reading, we take this question as “Would we hand over all of our users data if it meant we’d walk away from prosecution” the answer is no, we have not, do not, and would not.

Or would you put up a fight and demand that they get a subpoena?

As a standard, all websites should require a valid and verifiable subpoena for data requests to ensure its upholding basic legal standards, and most importantly the human rights and privacy of its users.

All data requests must be accompanied by a valid and verifiable subpoena. The subpoena must be issued by a recognised authority and comply with all the relevant legal standards. We will thoroughly verify all legal requests for its authenticity and scope before considering the release of any data, and will only disclose information when legally obligated to do so.

Do you honour deletion requests?

Yes. We try to minimise the data we store on active users, as well as deleting inactive accounts, which you can read more about here. https://help.tryst.link/en-gb/23-profile/174-what-happens-if-i-stop-using-my-account

https://help.tryst.link/en-gb/14/142

In entirety?

For all profile information, including photos, yes. With the caveat that we are required by law (as disclosed in our Terms) to maintain financial records.

How long does this take?

This depends on how the deletion request is initiated, you can delete your account at will (https://help.tryst.link/en-gb/14-faq/142-how-do-i-delete-my-tryst-account) or you can raise a support request (https://app.tryst.link/support/new) with our team who can assist if you’ve lost access to your account, but this will take some additional time as our team will need to verify you to complete your request.

For inactive accounts, see this article on our knowledge base that outlines when we consider your account to be inactive, how long you have to reactivate it, and when each step in the process to deletion happens (https://help.tryst.link/en-gb/23-profile/174-what-happens-if-i-stop-using-my-account).

I also asked Tryst.link some follow up questions.

Tryst.link Privacy Terms state =

"We may disclose personal information to: third party service providers for the purpose of enabling them to provide their services, including (…) marketing or advertising providers, (…) (and to) courts, tribunals, regulatory authorities and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights; "

Why does it say you disclose personal information to advertising providers? and to defend our (tryst's) legal rights without mention of requiring a subpoena?

“Why does it say you disclose personal information to advertising providers?”

This is considered a standard clause because of how the internet works, but when we say “We may disclose personal information to third party services for the purpose of enabling them to provide their services” this means we may share some of your information with other services who are acting on our behalf to run the platform - it doesn’t mean we are selling your data.

For example, let’s consider analytics, we pay a third-party company to license their software to process that we host to process this data internally. In the event we require support from this company, we would be obliged to give them access to our system in order for them to provide us that support, which in turn, may result in the disclosure of information but access to our system and data is covered by confidentiality and licensing agreements.

“and to defend our (tryst's) legal rights without mention of requiring a subpoena?”
There are two parts to this question, both are fairly standard clauses:

1. We have used broad language in this clause such as “as required by law, legal proceedings, regulatory and law enforcement authorities” to ensure that we cover the different type of legal obligations, including subpoenas and their local variants.

To reiterate, we will thoroughly verify all legal requests for its authenticity and scope before considering the release of any data, and will only disclose information when legally obligated to do so.

2. When a policy states “In order to establish, exercise or defend our legal rights” it means that if a user of the platform makes a legal claim or accusation of wrong doing against the platform, the platform may be required to use or share information about the user to legal representation or the courts to defend against the claim.

Also Tryst.link terms says "Upon termination of your account, in accordance with our Privacy Policy, the platform will remove your profile and photos but we will keep data required for business operations such as but not limited to; verification information, payment information, support conversations, and audit history."

Does that apply if someone deletes their own account? The verification information you keep according to that quote doesn't include the selfies and pics of identity documents since you said those are deleted within 24 hours of approval?

"Upon termination of your account, in accordance with our Privacy Policy, the platform will remove your profile and photos but we will keep data required for business operations such as but not limited to; verification information, payment information, support conversations, and audit history."

There are two parts to this question, the audit history and the verification information:

Audit history is referring to the actions taken by a team member (such as the outcome of a photo review) but when an account is deleted, the associated user data (any identifying information and the actual photo) is removed, but the audit record is kept to state that this team member performed an action on our platform.

This clause is worded this way to cover instances that fall outside of the platform, specifically our support system. This system falls into its own data retention schedule which is separate from the platform, and depending on the classification of the ticket it will determine how long it’s stored for, such as if it’s business critical that has regulatory requirements, or non-business critical tickets such as account deletion where a user has lost account access and must be verified to action.

To add to that, support tickets that are deleted will include a record that it was deleted, the time it was deleted, the ticket number, and an anonymised user for record integrity.

---

Eros

I didn't get a reply from Eros. Their data processor, based in Switzerland, with this email address: [email protected] ignored my email.

Of all the escort directories, Eros has by far the worst track record regarding privacy and data security.

They've been raided before by Homeland Security , had servers full of unencrypted sex worker identities seized and it's rumoured they continue to operate due to some kind of deal involving continuing to hand over the identities of sex workers.

Their privacy policy makes no mention of allowing people to obscure any part of their identity documents or selfies used for verification.

They do sell our personal data to advertisers. Their terms say:

"We may use your personal information or share your personal information with third parties to: (...) Serve marketing or advertising materials to you; and Provide any other good or service to you with your consent."

They also give themselves permission to hand over our identities to the authorities.

"We may disclose your personal information to third parties, without notice if, in our sole discretion, we believe that it is reasonable to do so to: (...) Protect ourselves."

Their terms are clear about retaining personal information.

"We reserve the right to retain publicly available information and de-identified information for any legitimate business purpose without further notice to you or your consent."

Their terms say they will delete personal data on request.

"Right of erasure/deletion/omission ("right to be forgotten"): You have the right to request that personal data relating to you be deleted immediately and the personal data must be deleted immediately if one of the reasons listed in the Swiss or European legislation applies, for example that the data are no longer necessary for the purpose for which they were collected."

But I have screenshots of emails to prove that when this is requested, they refuse and tell people to just log out and leave their accounts inactive for 18 months and then their data will be deleted automatically. I have screenshots of follow up emails from after the 18 months to show that even this did not happen.

---

Megapersonals

[email protected]

Megapersonals' Privacy Policy says:

"authorized agents may require you to provide additional information as necessary to verify the accuracy of your identity and your information."

Doesn't say whether identity documents and/or selfies are required in all cases or whether these can be partially anonymised.

They do sell personal details to advertisers.

"To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you."

They make no mention of any measures taken to secure our identities or personal details. They do say regarding if they get hacked...

"...we shall not be liable for any recording or release of private information, personal data, or your Posts, and you hereby release us from all liability and claims associated therewith."

The paragraph "We will fully cooperate with law enforcement authorities or orders from courts of competent jurisdiction which request or direct us to disclose the identity or location of any user in breach of these Terms of Use, in accordance with our privacy policies, law enforcement policies, and applicable law or regulation." implies they don't care about subpoenas or court orders and will identify us to any and all authorities who ask.

Regarding deletions:

"Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully, or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request."

So they might delete your personal data. Partially. Maybe.

---

Slixa

[email protected]

Slixa Advertiser Agreement "requires that all advertiser accounts are subject to age verification. Advertisers must supply a true and accurate color copy of a current, valid, government issued ID via the website’s secure verification page."

Doesn't say if the ID can be partially redacted or if it's deleted after verification.

Slixa's Privacy Policy says Slixa does use our personal details to "tailor marketing". Does this mean they sell our identities to advertisers?

A big win for Slixa with their data security statement:

"We use all reasonable measures to protect Your personally identifying information that is stored within our database (including data encryption, SSL, strong password requirements and firewalls), and we restrict access to member information to those employees who need access to perform their job functions, such as our customer service personnel and technical staff."

That's what we like to hear.

Slixa will share our identities with third parties

"6.1.1 To comply with any laws including, but not limited to, the Electronic Communications Privacy Act or any other legal or governmental requests for information;

6.1.2 If disclosure is necessary to identify, contact, or to bring legal action against a person who may be in violation of Slixa Terms and Conditions;

6.1.3 As is reasonably necessary to operate the Website;

6.1.4 To protect Slixa, its Users, its Advertisers, and the general public. Slixa will only disclose a User’s information when it is compelled and /or required to do so by law (for example, in response to a court order or subpoena). Where permitted by law, Slixa will not disclose any information pertaining to any User without first presenting the User with an opportunity to object to said disclosure."

If it was just 6.1.4, that would be perfect.

Doesn't seem to say anything about deletion requests.

---

Listcrawler

[email protected]

Listcvrawler's Privacy Policy says they'll give our identities to anyone who asks for pretty much any reason:

"We may disclose IP addresses, and/or associated email address, telephone numbers, or other information about, if (i) required to do so by law, court order or subpoena, or as requested by other government, law enforcement, or investigative authority, (ii) we in good faith believe that such disclosure is necessary or advisable, including without limitation to protect the rights or properties of the Site, (iii) we have reason to believe that disclosing your personal information is necessary to identify, contact or bring legal action against someone who may be causing interference with our rights or properties, or has breached an agreement, or if anyone else could be harmed by such activities or interference, (iv) if we determine an ad posted violates our Terms of Use or the rights of a third party, or (v) there is an emergency involving personal danger. We may also share information if we believe it is necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or as otherwise required or permitted by law."

Doesn't say anything about data security, selling personal details to advertisers or deletion requests.

---

P411

[email protected]

P411 replied to my email.

"Thanks for taking the time to write.

The only time we would release that information is if a Spanish court (we are in Spain and abide by Spanish law only) issued a subpoena specifically asking for that information. Of course, we would have our legal counsel review the subpoena first before doing anything. To this date, we have never been subpoenaed for any information.

We retain age documentation images to match account holders to other accounts. This is particularly important when it comes to accounts that have suspended or revoked for negative behavior. However, it's much less important when an account has never shown us any indication there are any issues, and those identification images would be deleted by request."

P411's Privacy Policy says:

"COMPANIONS: When you sign up for a companion account, Preferred411 collects some personal information for verification purposes, including and not limited to: full name, e-mail address, telephone number, website url, etc. Preferred411 also requires images of you and your government identification to prove that you are over the age of 21. These images are kept as encrypted data to ensure that companion accounts are not shared with anyone other than the account holder. We also require a username, email address and security questions."

Regarding Deletion of Information 

"Other than your P411 Id, all information found on your profile is wholly within your control and can be updated at your convenience. You can view what other members see about you, by clicking Companion View (admirers) or clicking on your thumbnail (companions). If you would like your information to be completely deleted from our servers, provide us with a detailed written request. This will result in your account and information being permanently removed from Preferred411 and the complete loss of use of member areas of the site. In limited cases, where we suspect unfavorable, fraudulent or criminal activity is taking place, as well as any activity that violates our Terms & Conditions, your information will not be deleted for the protection of Preferred411 and/or its members."

Their data security policy:

"The entire Preferred411 site is secured by using 128 bit SSL technology. Every effort is made to ensure the security of our servers and the data we retain. However, we are unable to make any guarantees that our measures will prevent an illegal hacking, which could result in the data on our servers being compromised. You assume this risk by voluntarily providing your information to Preferred411, with the understanding that such hacking incidents can occur despite reasonable security measures being in place."

---

Eroticmonkey

[email protected]

Eroticmonkey's Privacy Policy doesn't say whether they require ID or selfies or what they do with these.

They talk about personally identifying information (PII) in their terms and say

"We will never sell, rent, or loan your PII without your express written consent. We sometimes use third parties to help with some of the services available through the Site, such as third party software and service vendors, partners and consultants. When we supply PII to these third parties, we require them to use it only for the function they are helping us with. (...) We will disclose PII as required by law, or if in our judgment it is necessary to protect our company or our users from loss or liability."

So they won't sell PII to advertisers but will give PII freely to authorities without requiring a subpoena to protect themselves.

No mention of deletions.

Re data security

"We keep PII you provide on servers that are protected by industry-standard firewalls and other technological means against intrusion or unauthorized access. They are located in a physically secure facility, and only our employees and agents with a need to know the information are given access. While no amount of security can give a perfect guarantee, you can have a high degree of confidence that the personally identifiable information you give us is protected from unauthorized access and use."

---

Ourhome2

[email protected]

Doesn't have a Privacy Policy.

All they say on the subject is:

"Only anonymized registrations are allowed; as far as GDPR/CCPA goes, OH2 follows the protocol outlined below: Anonymous information, as information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable'. The GDPR/CCPA do not apply to anonymized information."

This is not very helpful eg if you're a sex worker who wants their personal details deleted from their site.

---

Humaniplex

[email protected]

Humaniplex's Privacy Policy doesn't say whether they require sex workers to send identity documents and/or selfies for verification.

They do say loud and clear:

"Your Information Is NEVER Used for Marketing, Promotion, or Advertising by Third Parties! - We do not sell or lease personal information. Many websites, specifically socials networks such as this one, choose to sell their users' personal information to third parties so that those third parties can advertise to you. Worse yet, many sites profile your browsing habits to try to generate a picture on the things you might buy and then sell that information to third parties. That is not the case here, and never will be."

This is the best statement I've seen on the topic on any of the escort directories. All the directories should have words to this effect in their privacy policies.

Sadly their statement regarding legal requests is a failure.

"If we have a good faith belief that the response is required by law, we may disclose information pursuant to subpoenas, court orders, or other requests (including criminal and civil matters). This may include honoring requests from jurisdictions outside of the United States where we have a good faith belief that the response is required by law under the local laws in that jurisdiction, apply to users from that jurisdiction, and are consistent with generally accepted international standards. We may also share information when we have a good faith belief it is necessary to prevent fraud or other illegal activity, to prevent imminent bodily harm, or to protect ourselves and you from people violating our Terms of Service. This may include sharing information with lawyers, courts or other government entities."

There's no need for this. Just say "We won't give your personal details to any law enforcement, legal or government entity unless we receive a subpoena from a court of law."

They don't say anything about deletions.

---

Adultsearch

[email protected]

Adultsearch's Privacy Policy uses almost the exact same phrase as Eros re:

"We may disclose your personal information to third parties, without notice if, in our sole discretion, we believe that it is reasonable to do so to: (...) Protect ourselves."

The full quote on Adultsearch says:

"we may disclose passively-collected information about Users, (...) for any reason without notice if, in our sole discretion, we believe that it is reasonable to do so, including, but not limited to: To satisfy any laws, such as the Electronic Communications Privacy Act, regulations, or governmental, or legal requests for such information; To disclose information that is necessary to identify, contact, or bring legal action against someone who may be violating our Terms of Use and other policies and procedures; To operate our Services properly; To protect ourselves, our Users, and the general public. We specifically reserve the right to disclose any and all information to law enforcement in the event that a crime including, but not limited to, fraud-related offenses is committed, is suspected, or if we are compelled to do so by lawful criminal, civil, or administrative process, discovery requests, subpoenas, court orders, writs, or reasonable request of authorities or persons with the reasonable power to obtain such process;"

I don't like that bit about "reasonable request". It's far too ill-defined and open to interpretation. If you require a subpoena, just say you require a subpoena.

In the next paragraph they say:

"We do not intend to cooperate with private-party litigants and others seeking information unless compelled to do so through lawful court or administrative process, such as subpoenas, court orders, or writs."

So why do they need to they need to give themselves permission to give our identities to whomever, to protect their own interests, without requiring a subpoena via that "reasonable requests"?

---

Theeroticreview

[email protected]

TER is primarily a review site aimed at getting clients to register and write reviews about sex workers.

It is possible to register as a provider but I couldn't find anything in their terms saying whether ID or selfies are required, whether they can be partially redacted or whether they're deleted after verification.

TER's Privacy Policy says:

"we will keep your Personal Information private and will not share it with third parties, unless such disclosure is necessary to: (a) comply with a court order or other legal process; (b) satisfy our legal obligations to cooperate with law enforcement or other investigating agencies; (c) satisfy any laws or regulations, or, governmental or legal requests for such information; (d) protect our rights or property, or the rights or property of others; or (d) enforce our Terms of Use Agreement."

Their data security policy says:

"We take measures, including data encryption, to protect the transmission of all sensitive user information. We make every reasonable effort to help ensure the integrity and security of our network and systems, and use commercially reasonable safeguards to preserve the integrity and security of your Personal Information. Nevertheless, we cannot guarantee that our security measures will prevent third-parties from illegally “hacking” into our computers and obtaining this information. You assume the risk of such breaches to the extent that they occur despite our reasonable security measures."

They don't say anything about deletions.

---

Leolist

[email protected]

Leolist's Privacy Policy says they will sell your personal information to advertisers.

"We may use your Data to show you LeoList adverts and other content on other websites. If you do not want us to use your Data to show you LeoList adverts and other content on other websites, please turn off the relevant cookies (please refer to the section headed “Cookies” below). (...) any of our group companies or affiliates - for the purpose of marketing where relevant;"

They say they will hand our data to:

" relevant authorities, such as law enforcement - to facilitate the detection, prevention, or investigation of a crime or offence, or in connection with other lawful requests for your Data;"

They do not say what they consider to constitute a lawful request.

They won't fully delete personal details on request.

"we will only hold your Data on our systems for the period necessary to fulfil the purposes outlined in this privacy policy or until you request that the Data be deleted. 19. Even if we delete your Data, it may persist on backup or archival media for legal, tax or regulatory purposes."

No mention of encryption or any other steps taken for data security.

---

Terb

Doesn't have a contact email on their site. I filled out the contact form but they haven't replied.

Privacy Policy is very brief and basic.

It does say they'll honour deletion requests. (you) "have the right to request the erasure of your personal data. Please contact us if you would like us to remove your personal data."

Re data security "We are committed to ensuring that any information you provide to us is secure. In order to prevent unauthorized access or disclosure, we have put in place suitable measures and procedures to safeguard and secure the information that we collect."

That doesn't really tell us anything about their data security.

Doesn't say anything about not selling info to spammers or giving identities to authorities.

---

Adultwork

[email protected]

Does require identity documents and does not accept anything partially redacted.

They also have quite invasive and weirdly old fashioned verification requirements eg making sex workers get their picture taken next to a phonebox while holding up a copy of that days newspaper.

Their Privacy Policy says they will sell your identity to advertisers "To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you".

Regarding data security they say "We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business 'need to know'. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so."

They do say you have the "Right to Erasure. Every individual has the right to be forgotten upon request. The Data Controller must remove your Personal Data from its systems and request the same of any third-party systems of that controller." under GDPR.

But "In the event of a law enforcement request involving your account or the data we hold about you on file. We are obliged by law to comply with the request and retain the data until the case has been closed by Law enforcement. Data may be held beyond the deletion request for the basis of complying with law enforcement."

I've heard from multiple UK based sex workers that they are entirely face in and have only ever shown their face in one place = Adultwork verification selfies and identity documents sent to AW, and yet they have been denied entry to USA due to facial recognition detecting a connection to sex work. ie Adultwork has given at least some, possibly all, of the selfies and ID they hold to USA border control.

---

Vivastreet

I sent them a message on twitter where I've spoken to Viva before. They read the message. It's marked as "seen". They haven't replied.

Does require "ID Verification for the purpose of registering as a Registered Escort on the Site".

No mention of partially redacted ID.

Vivastreet's Privacy Policy says they will hand over our identities "Where we need to comply with a legal or regulatory obligation. Where we consider it to be in the interests of our Users (Registered Escorts or otherwise) or in the public interest, we may provide Personal Data to law enforcement to assist them with an investigation. If we believe that you are a victim, we may provide your Personal Data without obtaining your prior consent for your protection."

They say "To undertake an Identity Verification Check, you will be asked to upload a ‘selfie’ photograph of yourself and a supporting identity document. These will then be verified by third-party technology"

Doesn't say who the third party is, which country they're in or which data protection laws they are subject to.

"We may also disclose your Personal and Biometric Data if required to do so by law, or if we believe that disclosure is necessary to comply with any applicable law, or to defend our own rights or property, or to safeguard you or others. This may involve discussing the information we hold with law enforcement agencies if we believe or suspect that you are using the Site to engage in criminal and/or illegal activity. Law Enforcement may also choose to disclose this information further to other security services to comply with any applicable law or if they believe doing so will safeguard others."

The "defend our own rights" line could mean they'll give our identities to anyone who asks if they think it is good leverage to protect themselves from prosecution.

Doesn't mention encryption.

You can request data erasure but they might not honour that request.

"Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. "

They will sell your identity to advertisers, possibly even if you specifically ask them not to.

"You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms."

---

Eurogirlsescort

[email protected]

Eurogirlescort's Privacy Policy says verification using ID and selfies is optional.

"We as the administrator do verify profiles. These profiles have VERIFIED status (in blue). Each girl who advertise on our site has "verification" option in the account. We require verification pictures or face + ID picture as proof that profile is real. If the girl sends required verification pictures we give "verified" status."

Unless you look underage.

"Our company will manually review each post and pictures before it goes LIVE online. If we determine that age of the model/escort is in question, we may ask for ID and age verification and we reserve the right to refuse to post"

This is good to see "We do not collect personal information to trade, sell or give away in any way. (...) Any and all the information collected on this website will be kept strictly confidential and will not be sold, reused, rented, disclosed, or loaned! We respect the right of users to remain anonymous and will endeavour not to knowingly disclose user identities unless directed by a court of law."

Also good = " several layers of encryption and several layers of security to prevent unauthorised access protect all of the sensitive customer data we collect."

No mention of deletion requests.

---

Scarletblue

[email protected]

Scarletblue's Privacy Policy

says they do collect "results of any identity checks or verifications".

Nothing about partially redacted ID or selfies.

"We do not ask for or collect your identity documents, such as your drivers licence, passport, or any other identity documents, or verify your identity. A third-party service provider may complete identity checks on our behalf from time to time when you provide your identity documents to the service provider through their function on our website. This function is not linked with us, and we do not have access to any information that is entered into the function. The third-party service provider will handle your personal information in accordance with its privacy policy."

Doesn't say who the third party is, where, or what legal requirements they are subject to. When this policy was announced, the announcement went over like a lead balloon on sex work twitter and reddit.

They sell our personal information to advertisers and will give our identities to authorities.

"We may disclose your personal information to the following third parties: (a) our business or commercial partners; (b) our professional advisers, dealers and agents; (c) third parties and contractors who provide services to us, including customer enquiries and support services, IT service providers, data storage, webhosting and server providers, marketing and advertising organisations, payment processing service providers; (d) payment system operators and debt-recovery functions; (e) third parties to collect and process data, such as Google Analytics, Google Display Network, DoubleClick, Yahoo, Adobe, Campaign Manager, and Microsoft; and (f) any third parties authorised by you to receive information held by us. If you are a contractor, we may disclose your information to payment system operators and debt-recovery functions. We may also disclose your personal information if we are required, authorised or permitted by law. We may send information to third parties that are located outside of Australia for the purposes of providing our services. These third parties are located in Cyprus, although this list may change from time to time. Disclosure is made to the extent that it is necessary to perform our functions or activities."

Again with the unnamed third parties =

"We take all reasonable steps to protect personal information under our control from misuse, interference and loss and from unauthorised access, modification or disclosure. We hold your personal information electronically in secure databases operated by our third-party service providers. We protect the personal information we hold through using secure ‘bcrypt’ hashing when storing user passwords, not storing any credit card information in the Scarlet Blue databases, using secure hosting providers, storing data in secured internal databases, firewalls and login password protocols and secure and access-controlled premises."

No mention of right to erasure.

---

Ivysociete

[email protected]

Ivysociete's Privacy Policy

Ivysociete posted on reddit asking for feedback about their site. Here is our conversation =

IS>

Thank you for your feedback. Please note that all advertisers on ivysociete.com are required to submit a verification image to ensure the legitimacy of profiles. However, advertisers have the option to blur their face in the image. The only requirements for this verification are to wear the same outfit, take a full-body photo, hold a sign, and raise three fingers on the other hand. As a "face-in" escort myself, who prefers not to show my face in photos, I completely understand the importance of maintaining privacy.

Regarding ID verification, it's optional for clients and not mandatory. It's simply another way to verify themselves if they feel more comfortable with it.

As for the terms and conditions, we don't share private images with a third party. Including a clause about sharing information with third parties is a common practice in terms and conditions.

IS didn't reply. I tried messaging them as a reply to their tweet about the redesign but they deleted my tweet reply.

---

Escortsandbabes

[email protected]

Escortsandbabes's Privacy Policy doesn't say whether they require identity documents or selfies or if so, how these are handled.

"Unless you object, your personal information may be used to: (...) assist us with our marketing"

Sounds like they do sell personal info to advertisers.

"we may disclose personal information in special situations where we have reason to believe that doing so is necessary to identify, contact or bring legal action against anyone damaging, injuring or interfering (intentionally or unintentionally) with our rights or property, users or anyone else who could be harmed by such activities."

and they'll disclose to authorities. No mention of requiring a subpoena.

No mention of encryption.

Doesn't say they honour deletion requests.

---

Massagerepublic

[email protected]

Massagerepublic's Privacy Policy

GDPR Compliance Policy

"Advertiser registration form – the object and the basis of the data processing Your personal data provided through this form are processed in order to register your account on our server. Providing us with your personal information is necessary, and abstaining results in our inability to register your account."

So they do require identity documents. Doesn't say about selfies.

"your personal data might be disclosed to third parties, including (...) the marketing agencies, the e-commerce agencies"

Translates as they do sell your personal information to advertisers.

No mention of encryption.

Their GDPR page mentions "the right to delete personal data (the right to be forgotten)" but doesn't say how this happens or how long it takes.

---

Rentmen

[email protected]

Privacy Policy

I got a reply from Rentmen responding to my questions as follows:

Do you require personally identifying information from sex workers for verification?

We require personal identifying information from all of our advertisers, aiming to confirm the users’ identity and age.

Identity documents?

The users are requested to present a state-issued document, confirming their date of birth. Any document with a photo of the user and date of birth is sufficient.

Selfies?

In some cases, when the administration needs more information to confirm the user, the so-called photo verification is required. The user needs to take a selfie holding a sign with the website name and the date the selfie is taken.

Can these be partially obscured or redacted?

Yes, the user can partially cover the ID - compulsory information that must
be visible is:

• Face - we need to be sure the person from the ID is the same as the
  person in the profile gallery.
• Data of birth - to confirm the user is over 18.
• Expiration date - we need to be sure the document is valid, not expired.
• Name - KYC (Know Your Customer) requirements by the card operators.

Do you sell our identities and/or personal details to third-party advertisers?

We do not sell or share personal data of our users to third-party advertisers under any circumstances. We believe that apart from the moral and ethical norms that the company follows in this direction, any proposals would be rejected due to the fact that we believe that such an act would have an extremely negative impact on the image of the company and the products that we manage.

Do you take any steps to secure our identities from hackers or in case your servers were seized?

Yes, as I mentioned, we follow the rules and regulations of the GDPR and the highest standards for storing the personal data of our users. We have implemented state-of-the-art security measures to prevent any data breaches. Furthermore, your data is encrypted, meaning that in case of a data breach, it will not be readable for the hackers.

Are our identity documents and selfies deleted after verification?

In order to comply with our legal obligations, photo and ID verifications are stored and are needed regarding ongoing monitoring of profile accuracy. For example, if a user changes entirely the photos of their profile gallery and replaces them with others, we need to be sure the newly uploaded photos match the users' photo verification previously provided.

Stored offline?

For security reasons, such information cannot be provided.

Encrypted?

As I previously mentioned, the personal data of our users is protected and encrypted and only limited and licensed staff members have access.

If you were told you could protect yourself from prosecution by freely handing over the identities of sex workers to authorities, would you do so?

We would share data with authorities only if the request is legally valid and in compliance with GDPR and other applicable privacy regulations.

Or would you put up a fight and demand that they get a subpoena?

As I have already specified, we follow the principles of the GDPR, where the reasons and methods for requesting personal data of a user are regulated. Here I should specify that mass provision of personal data to users is absolutely prohibited and would not be respected for any reason. A request for the provision of personal data may be made to investigative authorities in connection with an active criminal investigation. In such a situation, the investigating authority should identify itself by providing documents containing the reason for the request for personal data, as well as what specific personal data are needed for the relevant investigation. For example, if an investigative body were to contact us and request all available data of our user, their request would be considered unlawful and would not be honored.

Do you honour deletion requests?

Yes, of course. Again, following the GDPR, we accept requests for deletion of personal data. Also, any user can request from us what personal data we collect about them.

In entirety?

In some specific cases, we may retain personal information for a longer period. For example, accounting information such as invoices contain personal information. Under the law, we must retain this information for 10 years.

How long does this take?

The period for consideration of requests for the provision of personal data is processed for a period not longer than 7 days.

---

Hunqz

Hunqz's Privacy Policy

Hunqz replied to my email and responded to each of my questions:

Do you require personally identifying information from sex workers for verification?

No

Identity documents?

No

Selfies?

Only needed if profile gets reported multiple times for being fake

Can these be partially obscured or redacted?

Not, if we need to check a user's identity

Do you sell our identities and/or personal details to third-party advertisers?

Of course not

Do you take any steps to secure our identities from hackers or in case your servers were seized?

Of course

Are our identity documents and selfies deleted after verification?

Users upload their verification picture if needed to a private folder for us to review the user's identity. Afterwards the user can delete the picture.

Stored offline?

N.A

Encrypted?

N.A

If you were told you could protect yourself from prosecution by freely handing over the identities of sex workers to authorities, would you do so?

Or would you put up a fight and demand that they get a subpoena?

It wouldn't be legal in the Netherlands to hand over our user's identities to authorities.

Do you honour deletion requests?

Of course. This is also covered under the GDPR

In entirety?

Yes, see our privacy statement for more information (https://www.romeo.com/en/privacy/)

How long does this take?

These requests are normally processed within one working day.

I replied with a few additional questions, querying the term "legitimate interest" and "if the police demand this" and they kindly replied again:

"By legal terms (GDPR) it wouldn't be a legitimate interest to share user data with advertisers.

In our privacy statement (https://www.romeo.com/en/privacy/) we also list what kind of third party we are sharing data with. In this particular case we share some data with an external Fraud Prevention System to keep "the bad guys" (e.g. commercial profiles created through bots) from our platform. This for instance is a legitimate interest, because Fraud harms both our platform and also potentially our users.

If any local police contacts us, they are sent the following text which clearly defines what's needed to receive any data:

Dear Sir or Madam,

There are two ways in which information can be sought from the Netherlands, either using IP (Interpol/Europol or Liaisons) channels for police to police non evidential requests

• or –

if requiring information evidentially then you will need to engage your prosecutor office for them to send an International Letter of Request to the Netherlands to ask for the information on a formal basis.

It is a requirement in the Netherlands for information that is sought as evidence from a foreign jurisdiction to be requested via an European Investigation Order (EIO), which then provides the Netherlands a legal basis to gather the evidence from the business, institution etc. on your behalf. Your prosecutor will be in a position to provide the necessary EIO and sent by post to the Dutch authorities. (...)

This means that we also never hand out any data directly to local police offices but always go through our contacts at the Dutch police."

---

Sleepyboy

Sleepyboy's Privacy Policy says "Sleepypro SL may disclose your Personal Data in the good faith belief that such action is necessary to comply with a legal obligation, to protect and defend the rights or property of Sleepypro SL, to prevent or investigate possible wrongdoing in connection with the Service, to protect the personal safety of users of the Service or the public, and to protect against legal liability."

So they can identify you to law enforcement and here's no mention of requiring a subpoena.

"Advertising Cookies. Advertising Cookies are used to serve you with advertisements that may be relevant to you and your interests."

"To provide you with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information"

So they do sell our personal data to advertisers.

No mention of encryption. Only the disclaimer "The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security."

They recognise right to deletion "Sleepypro SL aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data." but it doesn't say whether this will be entirety or commit to a timeframe.