Yesterday, Epic Marketplace was included in a Wall Street Journal article entitled Latest in Web Tracking: Stealthy ‘Supercookies’. In addition, a related blog post was made by the same reporter. Curiously, we were not actually included in the article for the use of ‘Supercookies’ – which we do not use nor have we ever used – but instead for a separate practice most commonly called “history sniffing”.
The parts of the article & blog that reference Epic appear to be based primarily on research that was published by Stanford researcher and graduate student Jonathan Mayer in a blog back on July 19th. This research received media coverage shortly after the blog was posted, and Epic responded over the course of several weeks in multiple forums including blogs and a press release.
As it pertains to Epic, neither the WSJ article nor the blog appears to report anything new, with the pertinent information either already covered in the media/blogosphere and/or discussed by the company itself in a public forum.
Nevertheless, because the WSJ pieces paint an inaccurate picture of the company in terms of our standards, practices and most importantly character, and because this was done in such a widely-circulated news journal, I want to be responsive here, especially on behalf of the 170 employees of our enterprise. Specifically, I’d like to discuss:
- A short distillation of the essential facts of the matter
- Our audit results (to date)
(Note also that a few specific points in the WSJ article/blog are factually inaccurate or potentially misleading; I have included responses to these specific points in an appendix below the main body of this post, in order to clarify any misunderstandings).
The essential facts of this matter.
We’ve already laid out our position with regards to the original research (here). Here again is a brief summary of the critical facts:
- We bought an ad server slightly over a year ago, which we ran in parallel with our existing ad server. This acquired legacy ad server used a form of history sniffing; until recently, we did not know that this history sniffing script was operating or even that it existed. Nearly all the senior management staff and technology staff of the acquired company are no longer employed by Epic.
- We shut down this history sniffing (along with the legacy ad server itself) when we migrated to a new technology platform. The new platform was in development for over a year; however, when we learned of the legacy ad server’s history sniffing, we accelerated the transition timeline, completing the launch of the new platform – and the decommissioning of the legacy ad server / history sniffing technology – well ahead of the original schedule.
- In the 4+ weeks since the Mr. Mayer posted his research on July 19th, we have taken a series of steps to further remediate the situation. In addition to ceasing the history sniffing practice, we have commenced efforts to conduct ongoing audits of our practices to ensure we are in compliance with all relevant standards (see below). We also met with the Center for Democracy and Technology (amongst others), who blogged about the fact that we discontinued the history sniffing practice here.
- To be clear, we believe that history sniffing is inconsistent with digital advertising and consumer privacy best practices and industry self-regulatory guidelines. We do not defend it or justify it, and as we’ve publicly stated, we are pleased to have exited the practice.
Audit results: confirming the facts.
Shortly after the original research was published, we realized that it would be insufficient to discuss this matter without trusted third party validation. Therefore, Epic has engaged DoubleVerify, amongst others, to help confirm the facts. DoubleVerify is a leading source of internet compliance & verification services, an approved compliance vendor for the Digital Advertising Alliance, and has worked closely with the advertising agency and brand community as well as every major ad network and exchange in the sector. So from our perspective, what IS newsworthy – though not in a way which would support the thesis of the WSJ article or their blog – is the first set of results from our audit work. The results are here (PDF).
We are also in the process of engaging with a number of other non-governmental agencies, industry trade groups and consumer watch-dog organizations. Our intent is to confirm every statement we have made about this issue. While this is a time-consuming process and will continue over the months to come, some of the fundamental facts have already been confirmed in the DoubleVerify report. We will continue our work with multiple outside parties well into the future to further confirm and verify our statements regarding this issue and around our practices overall.
Conclusion.
It is fair to report the facts. Epic Marketplace did indeed use a history sniffing script, which we acknowledged several weeks ago. It was an “inadvertent” use (as the article terms it) in that it came from a company we acquired, we did not build it, we did not acquire the company because of it, we did not even know about it until recently, and we do not believe it is appropriate or defensible. Be that as it may, we do accept responsibility for it.
But to the extent that the article creates a net general impression that Epic somehow sought to actively harm consumer privacy or that we were (or are) deliberately and purposefully engaged in some nefarious scheme to profit at the expense of an unknowing consumer, we categorically and emphatically reject that.
We believe deeply that this company should be on the leading edge of protecting consumer privacy – the path not just to long-term sustainability for us and our industry, but at its most fundamental level, the ethically correct imperative. It is painful to have uncovered a practice which is inconsistent with this viewpoint. But we have terminated it, we are working extremely hard to improve and validate our policies and practices, and we will work even harder to justify and warrant industry, client and most importantly consumer trust. This is one statement that we cannot, in the short run, validate with a third party. But we can and will work to demonstrate it over time.
Don Mathis
CEO, Epic Media Group and Epic Marketplace
*******
Appendix: clarifying certain points made in the WSJ article.
“Charter and Flixster said they didn’t have a direct relationship with Epic, but as is common in online advertising, Epic’s tracking service was installed by advertisers.”
This is incorrect. No tracking technology of any sort was ever installed anywhere by our advertisers. The advertisements which appeared on Charter and Flixster came from impressions Epic purchased via a “supply side optimizer” company, which acts similarly to an exchange for purchasing inventory.
- The blog writes (and quotes me as saying):
“We have more than 2,500 segments” of information we collect about individuals, said Don Mathis, CEO of Epic Media Group, the company that Mayer found was using code to determine which of 1,500 sites users had visited. “That is part of what enables us as an audience company to differentiate ourselves.” Epic has since discontinued the practice.
This is a misquote; while I did say “We have more than 2,500 segments,” I did not say that we have more than 2,500 segments of information that we collect about individuals. In fact, all of our segments exist to target audiences, not to collect data.
This distinction is important. The concept of an audience segment, e.g. “men between the ages of 18-34”, is the basis on which we (and virtually every other advertising company) reach a defined audience as desired by our advertising clients. With regard to companies that engage in behaviorally-based online advertising, the focus is on aggregating an audience to match to a particular segment; the data which is examined in this case comes from cookies. To be more specific, if my desired audience segment is “men between the ages of 18-34 who appear to be in market for buying a new luxury car”, and I see a cookie that suggests that that consumer might fit that category, I will serve the ad for the luxury car. In digital marketing, the opportunity to get relatively granular in defining an audience is what enables a banner ad, for example, to reach a more targeted audience than a television commercial.
It merits noting that Epic is fully compliant with industry governance regulations in defining our audience segments, as we noted in our interview for this article. We believe the industry regulations are consistent with FTC guidance.
Epic argues that the history-stealing technique met the (industry self governance) guidelines because companies (sic … we believe the journalist meant “consumers”) could “opt out” of receiving ads based on the data collected about them.
Actually, no we don’t. Not only do we not defend the practice of history sniffing as a general matter, we do not argue that the “technique” meets any industry self-regulation guideline. What we did say is that, during the time period that the history sniffing script was used by the legacy ad server, a consumer had the ability to opt out of it. Having the ability to opt-out is an important fact, because it meant that the practice of history sniffing was subject to a consumer’s control in the same manner that a consumer could opt out of behavioral advertising.
In Epic’s case, the browser-history information continued to be sent after the person had opted out. But Epic says although the information was stored in a “cookie” file, it was not used for online behavioral advertising.
This is incorrect. Here is what we actually wrote verbatim, in a follow-up email to the journalist: “If segment verification were operating, it would operate as follows: Step 1: the script would send a string to the ad server with the segment specified as you demonstrated; Step 2: the opt-out function would examine the cookie to see if the opt-out flag was set to positive; is so (sic; I meant “if so”), no further action occurred, and the data transmission was ignored (i.e., not collected, recorded nor acted upon in any way). If the consumer had not opted out, then the process proceeded to Step 3 (and only Step 3): the ad server would write the segment generated by the script into the rth cookie” (emphasis added).
In other words, while the blog implies that we stored browser history information in a “cookie” file even if the consumer opted out, this is false; we did not. We also had DoubleVerify audit this point explicitly, and communicate their results to the journalist.
The article refers to the practice in question as “history stealing”, not as “history sniffing”. This may seem a trivial point, but it is not. Language matters; the term “stealing” versus “sniffing”, as it is used here, appears to imply nefarious intent. Moreover, the word ‘stealing’ is generally associated with illegality, whereas the article itself appears to declare that the practice is not illegal (the specific language from the article comes from the opening line of the second paragraph, “The new techniques, which are legal…”).
The term “history sniffing” is much more commonly used to describe the practice, and likely derives from another technique for examining internet traffic known as “packet sniffing”. The Center for Democracy & Technology, the University of California San Diego (who did ground-breaking research on the issue), a number of other organizations and many media outlets – including the New York Times, Forbes, and the Wall Street Journal itself in past articles – refers to the practice as history sniffing. A Google search resulted in 266,000 references to the term “history sniffing” combined with the word “browser,” whereas a Google search for the term “history stealing” combined with the word “browser” turns up 14,400 results.
Note that Epic has called history sniffing, “segment verification”, which we discussed in our first blog on the matter, here. For the record, the point we were making is that the history sniffing script was used to verify purchased 3rd party data (e.g., BlueKai). In other words, we were differentiating the methodology of history sniffing from the purpose for which the data was used. We felt like this was an important marker of intent: using the data for benign purposes would at least demonstrate that we were not deliberately engaged in violating consumer trust around behavioral targeting.
And while I am by no means defending the history sniffing practice, it does bear mentioning – in part because several sources, including Mr. Mayer from Stanford, suggest otherwise – that, for the period of time that the history sniffing / segment verification script was running, the consumer was afforded an operable means of opting out of it. This too has been verified by DoubleVerify. As we note above, the ability to opt-out meant that the practice of history sniffing was at least subject to a consumer’s control in the same manner that a consumer could opt out of behavioral advertising.