As advertisers have increasingly demanded verification to be included with third-party buys from ad networks, exchanges, DSPs and agency trading desks, the Trust Index has provided advertisers with in-depth data about partner compliance and brand safety trends in online advertising.

“The Trust Index has emerged as the industry standard for measuring advertising compliance and is a strong indicator of the positive impact media verification has had in online ad campaigns. Over the past 18 months, we’ve seen the continual decrease in the incidence rate of non-compliance when verification is applied,” said Oren Netzer, CEO of DoubleVerify. “Advertisers, networks and platforms that actively and consistently use verification on all of their campaigns and inventory are experiencing vast improvements in brand protection. This further indicates that online advertising needs to integrate verification on a long-term basis so that trust is permeated throughout the ecosystem.”

Epic Marketplace is pleased to be among the leaders in compliance, and is committed to maintaining their progress and leadership in the area of brand safety.

The parts of the article & blog that reference Epic appear to be based primarily on research that was published by Stanford researcher and graduate student Jonathan Mayer in a blog back on July 19^th. This research received media coverage shortly after the blog was posted, and Epic responded over the course of several weeks in multiple forums including blogs and a press release.

As it pertains to Epic, neither the WSJ article nor the blog appears to report anything new, with the pertinent information either already covered in the media/blogosphere and/or discussed by the company itself in a public forum.

Nevertheless, because the WSJ pieces paint an inaccurate picture of the company in terms of our standards, practices and most importantly character, and because this was done in such a widely-circulated news journal, I want to be responsive here, especially on behalf of the 170 employees of our enterprise. Specifically, I’d like to discuss:

1.        A short distillation of the essential facts of the matter
2.        Our audit results (to date)

(Note also that a few specific points in the WSJ article/blog are factually inaccurate or potentially misleading; I have included responses to these specific points in an appendix below the main body of this post, in order to clarify any misunderstandings).

The essential facts of this matter.

We’ve already laid out our position with regards to the original research (here). Here again is a brief summary of the critical facts:

• We bought an ad server slightly over a year ago, which we ran in parallel with our existing ad server. This acquired legacy ad server used a form of history sniffing; until recently, we did not know that this history sniffing script was operating or even that it existed. Nearly all the senior management staff and technology staff of the acquired company are no longer employed by Epic.

• We shut down this history sniffing (along with the legacy ad server itself) when we migrated to a new technology platform. The new platform was in development for over a year; however, when we learned of the legacy ad server’s history sniffing, we accelerated the transition timeline, completing the launch of the new platform – and the decommissioning of the legacy ad server / history sniffing technology – well ahead of the original schedule.

• In the 4+ weeks since the Mr. Mayer posted his research on July 19^th, we have taken a series of steps to further remediate the situation. In addition to ceasing the history sniffing practice, we have commenced efforts to conduct ongoing audits of our practices to ensure we are in compliance with all relevant standards (see below). We also met with the Center for Democracy and Technology (amongst others), who blogged about the fact that we discontinued the history sniffing practice here.

• To be clear, we believe that history sniffing is inconsistent with digital advertising and consumer privacy best practices and industry self-regulatory guidelines. We do not defend it or justify it, and as we’ve publicly stated, we are pleased to have exited the practice.

Audit results: confirming the facts.

Shortly after the original research was published, we realized that it would be insufficient to discuss this matter without trusted third party validation. Therefore, Epic has engaged DoubleVerify, amongst others, to help confirm the facts. DoubleVerify is a leading source of internet compliance & verification services, an approved compliance vendor for the Digital Advertising Alliance, and has worked closely with the advertising agency and brand community as well as every major ad network and exchange in the sector. So from our perspective, what IS newsworthy – though not in a way which would support the thesis of the WSJ article or their blog – is the first set of results from our audit work. The results are here (PDF).

We are also in the process of engaging with a number of other non-governmental agencies, industry trade groups and consumer watch-dog organizations. Our intent is to confirm every statement we have made about this issue. While this is a time-consuming process and will continue over the months to come, some of the fundamental facts have already been confirmed in the DoubleVerify report. We will continue our work with multiple outside parties well into the future to further confirm and verify our statements regarding this issue and around our practices overall.

Conclusion.

It is fair to report the facts. Epic Marketplace did indeed use a history sniffing script, which we acknowledged several weeks ago. It was an “inadvertent” use (as the article terms it) in that it came from a company we acquired, we did not build it, we did not acquire the company because of it, we did not even know about it until recently, and we do not believe it is appropriate or defensible. Be that as it may, we do accept responsibility for it.

But to the extent that the article creates a net general impression that Epic somehow sought to actively harm consumer privacy or that we were (or are) deliberately and purposefully engaged in some nefarious scheme to profit at the expense of an unknowing consumer, we categorically and emphatically reject that.

We believe deeply that this company should be on the leading edge of protecting consumer privacy – the path not just to long-term sustainability for us and our industry, but at its most fundamental level, the ethically correct imperative. It is painful to have uncovered a practice which is inconsistent with this viewpoint. But we have terminated it, we are working extremely hard to improve and validate our policies and practices, and we will work even harder to justify and warrant industry, client and most importantly consumer trust. This is one statement that we cannot, in the short run, validate with a third party. But we can and will work to demonstrate it over time.

Don Mathis

CEO, Epic Media Group and Epic Marketplace

*******

Appendix: clarifying certain points made in the WSJ article.

• The article wrote:

“Charter and Flixster said they didn’t have a direct relationship with Epic, but as is common in online advertising, Epic’s tracking service was installed by advertisers.”

This is incorrect. No tracking technology of any sort was ever installed anywhere by our advertisers. The advertisements which appeared on Charter and Flixster came from impressions Epic purchased via a “supply side optimizer” company, which acts similarly to an exchange for purchasing inventory.

• The blog writes (and quotes me as saying):

“We have more than 2,500 segments” of information we collect about individuals, said Don Mathis, CEO of Epic Media Group, the company that Mayer found was using code to determine which of 1,500 sites users had visited. “That is part of what enables us as an audience company to differentiate ourselves.” Epic has since discontinued the practice.

This is a misquote; while I did say “We have more than 2,500 segments,” I did not say that we have more than 2,500 segments of information that we collect about individuals. In fact, all of our segments exist to target audiences, not to collect data.

This distinction is important. The concept of an audience segment, e.g. “men between the ages of 18-34”, is the basis on which we (and virtually every other advertising company) reach a defined audience as desired by our advertising clients. With regard to companies that engage in behaviorally-based online advertising, the focus is on aggregating an audience to match to a particular segment; the data which is examined in this case comes from cookies. To be more specific, if my desired audience segment is “men between the ages of 18-34 who appear to be in market for buying a new luxury car”, and I see a cookie that suggests that that consumer might fit that category, I will serve the ad for the luxury car. In digital marketing, the opportunity to get relatively granular in defining an audience is what enables a banner ad, for example, to reach a more targeted audience than a television commercial.

It merits noting that Epic is fully compliant with industry governance regulations in defining our audience segments, as we noted in our interview for this article. We believe the industry regulations are consistent with FTC guidance.

• The blog writes:

Epic argues that the history-stealing technique met the (industry self governance) guidelines because companies (sic … we believe the journalist meant “consumers”) could “opt out” of receiving ads based on the data collected about them.

Actually, no we don’t. Not only do we not defend the practice of history sniffing as a general matter, we do not argue that the “technique” meets any industry self-regulation guideline. What we did say is that, during the time period that the history sniffing script was used by the legacy ad server, a consumer had the ability to opt out of it. Having the ability to opt-out is an important fact, because it meant that the practice of history sniffing was subject to a consumer’s control in the same manner that a consumer could opt out of behavioral advertising.

• The blog writes:

In Epic’s case, the browser-history information continued to be sent after the person had opted out. But Epic says although the information was stored in a “cookie” file, it was not used for online behavioral advertising.

This is incorrect. Here is what we actually wrote verbatim, in a follow-up email to the journalist: “If segment verification were operating, it would operate as follows: Step 1: the script would send a string to the ad server with the segment specified as you demonstrated; Step 2: the opt-out function would examine the cookie to see if the opt-out flag was set to positive; is so (sic; I meant “if so”), no further action occurred, and the data transmission was ignored (i.e., not collected, recorded nor acted upon in any way). If the consumer had not opted out, then the process proceeded to Step 3 (and only Step 3): the ad server would write the segment generated by the script into the rth cookie” (emphasis added).

In other words, while the blog implies that we stored browser history information in a “cookie” file even if the consumer opted out, this is false; we did not. We also had DoubleVerify audit this point explicitly, and communicate their results to the journalist.

• Terminology:

The article refers to the practice in question as “history stealing”, not as “history sniffing”. This may seem a trivial point, but it is not. Language matters; the term “stealing” versus “sniffing”, as it is used here, appears to imply nefarious intent. Moreover, the word ‘stealing’ is generally associated with illegality, whereas the article itself appears to declare that the practice is not illegal (the specific language from the article comes from the opening line of the second paragraph, “The new techniques, which are legal…”).

The term “history sniffing” is much more commonly used to describe the practice, and likely derives from another technique for examining internet traffic known as “packet sniffing”. The Center for Democracy & Technology, the University of California San Diego (who did ground-breaking research on the issue), a number of other organizations and many media outlets – including the New York Times, Forbes, and the Wall Street Journal itself in past articles – refers to the practice as history sniffing. A Google search resulted in 266,000 references to the term “history sniffing” combined with the word “browser,” whereas a Google search for the term “history stealing” combined with the word “browser” turns up 14,400 results.

Note that Epic has called history sniffing, “segment verification”, which we discussed in our first blog on the matter, here. For the record, the point we were making is that the history sniffing script was used to verify purchased 3^rd party data (e.g., BlueKai). In other words, we were differentiating the methodology of history sniffing from the purpose for which the data was used. We felt like this was an important marker of intent: using the data for benign purposes would at least demonstrate that we were not deliberately engaged in violating consumer trust around behavioral targeting.

And while I am by no means defending the history sniffing practice, it does bear mentioning – in part because several sources, including Mr. Mayer from Stanford, suggest otherwise – that, for the period of time that the history sniffing / segment verification script was running, the consumer was afforded an operable means of opting out of it. This too has been verified by DoubleVerify. As we note above, the ability to opt-out meant that the practice of history sniffing was at least subject to a consumer’s control in the same manner that a consumer could opt out of behavioral advertising.

Read more from the press release right here.

Epic Marketplace has ended the Segment Verification data collection practice. We announced this in a press release that went out on August 4^th (it is prominently mentioned in the second paragraph of a press release that was principally discussing our new technology ad serving Platform, here). We also met with and asked the Center for Democracy and Technology (CDT), a consumer advocacy group, and the National Advertising Initiative (NAI), to review our marketing practices and confirmed with them that we are no longer engaged in Segment Verification. Moreover, we are working with Double Verify to confirm our opt-out mechanism and to audit our practices overall. Nonetheless, we feel that a further explanation is appropriate for our clients and the industry at large.

Epic Marketplace, Privacy & Compliance

Before I get into the heart of the discussion, I think it is important to understand who Epic Marketplace is, and the time and effort we have invested over many years to develop world class privacy and consumer protections. Who we are of course impacts what we do and how we think about issues like this.

Epic Marketplace has consistently been recognized as a leader in the online marketing industry and a pioneer in the development of compliance and anti-abuse technology. Epic chairs the Performance Marketing Association’s anti-fraud and anti-abuse subcommittee, and is one of the few digital marketing companies to have received an “A+” rating with the Better Business Bureau. The company is an active member of the Network Advertising Initiative, the Digital Advertising Alliance, and the Interactive Advertising Bureau. Moreover, through the company’s dedicated compliance subsidiary, Online Intelligence, Epic provides crucial assistance to major national brands through online monitoring of their trademarks and copyrighted images. For example, we recently concluded a year-long project for Oprah Winfrey’s company, Harpo Productions, exclusively focused on compliance and trademark protection.

The executive-in-charge of the company’s compliance operations, former FBI Special Agent EJ Hilbert, is widely considered one of the nation’s foremost experts on cybercrime and marketing fraud. Our General Counsel David Graff and our Deputy General Counsel & Chief Privacy Officer Anwesa Paul have years of combined privacy and compliance legal experience, and Anwesa served in the New York Attorney General’s cyberfraud division. Our COO, Charlie Nowaczek, has led compliance initiatives in several digital and online settings, and we built our compliance team with personnel from the cyber unit of the Florida Attorney General’s Office and the integrity assurance teams at Google and Commission Junction, among others. Finally, I began my career at Epic as our Chief Compliance Officer (and COO), and have a background in forensic, technology and internet compliance work; and in critical infrastructure / information security as a Naval Officer on reserve duty and while mobilized in the War on Terror. I was also one of the principal organizers of the Leadership and Ethics Forum at Harvard University when I was a graduate student there.

I can assure you, Epic is committed to playing an active leadership role in privacy protection standards and digital marketing compliance overall.

Segment Verification and Epic Marketplace

Epic Marketplace does not use Segment Verification – or whatever one chooses to call it – as part of our new Platform. When we did use it, it was a component of a legacy ad serving platform. This legacy ad server came from a company that Epic Marketplace acquired last year. The legacy ad server was replaced and decommissioned as part of our long-standing plans to move to our new Platform. When we decommissioned the acquired ad server, the Segment Verification program was also decommissioned.

Following the acquisition mentioned above, we actually ran two ad servers in parallel: the one Epic Marketplace built (the first version was originally launched in mid-2005), and the one we bought as a part of the acquisition. It was the legacy ad server from the acquisition that contained the Segment Verification program. The new Platform – like the Epic Marketplace ad server that we built in 2005 – has no need for such a technology to validate third party data acquisition, a task which is performed by a statistical inference model. For the record, note that our new Platform does not collect any data from browser history.

Given the emerging understanding around the nature and consequence of this practice – and in particular, after our extremely productive discussions with the Center for Democracy and Technology – we are pleased that the transition to the new Platform has provided us the ability to end Segment Verification. Epic Marketplace is now engaging with several industry bodies to help shape the effort to self-regulate on this matter. Also, in the spirit of being responsive to the concerns that have been raised, we are purging any data collected by this program from our databases.

There is one important point that I would like to clarify.

In the original graduate student blog referenced above, there is an allegation that the legacy ad server’s Segment Verification program prevents effective operation of the NAI opt-out cookie in situations where consumers elect to download the opt-out cookie. This is demonstrably and unequivocally false; in fact, the presence of the NAI opt-out cookie effectively prevented the program from collecting browser history information during its operation.

NAI performed an independent review of the operation of the cookie in conjunction with the software. We were able to demonstrate that the opt-out cookie did in fact prevent information collected from the software from being stored in our ad-serving cookies. We also asked Double Verify to audit the opt-out cookie operation, and they have verified that the opt-out cookie works.

In summary…

Fundamentally, we believe this issue boils down to the following: we bought an ad server about a year ago that utilized Segment Verification technology. We don’t use it now. For the period that we did use it, the consumer was afforded an operable means of opting out of it. And we are pleased to have exited the practice.

In the spirit of third party validation, we have already worked with Double Verify to audit our opt-out capability, and we have retained them to audit our ad serving practices overall, now and on a  quarterly basis going forward; and we are engaging with them to assist with the OBA self-regulatory “ad choices icon” implementation. As mentioned, we have also worked with the NAI to review our opt-out cookie (and will continue to work with them going forward), and we’ve met with the Center for Democracy and Technology (CDT), a leading digital consumer advocacy group, to explore the issue.

It is our deep belief that Epic Marketplace is not only effective as a partner for its clients, but that we are, in fact, a global leader in promoting consumer protection best practices across our industry.

After almost a year of effort, Epic completes final phase of migrating company to new multichannel ad-serving Platform, and decommissions its legacy ad server.

New York, NY – August 4, 2011 – Epic Marketplace (www.epicmarketplace.com), one of the world’s leading integrated multichannel digital marketing solutions providers leveraging the social media, mobile, display, and video channels, announced today the completion of its migration to a comprehensive new cross-channel ad serving Platform. The new Platform provides for a seamless integration between all of Epic Marketplace’s distribution channels, and the ability to acquire inventory on either a real-time bidding (RTB) or direct basis, all with a universal frequency cap. An enhanced attribution analytics engine is a key component of the new Platform.

The new Platform represents a substantial transformation of the Epic Marketplace ad serving paradigm. Among the changes, the company has decommissioned its segment verification program, which was a component of its legacy ad server. The new Platform was architected and built with an enhanced suite of consumer privacy protections, positioning the company to further enhance its world-class status as a leader in digital marketing consumer protection best practices.

The new Epic Marketplace Platform is driven by a proprietary Optimization Engine (OE) that is built around advanced polynomial statistical analysis. The OE, as the “brain” of the new platform, is data-type agnostic and analyzes data input on a non-PII basis from multiple sources – e.g., social media data, cookie data, mobile data – and then renders targeting solutions applicable across all of Epic’s distribution channels. Among the critical targeting solution sets are strong core competencies in audience aggregation, keyword bidding and contextual analytics, the latter via a real time semantic contextual engine.

“This new Platform is a culmination of a vision we set forth several years ago,” said Don Mathis, President and CEO of Epic Marketplace. “With its launch, we are fully positioned for the next five years of growth in our sector – which will be all about the integrated campaign and the opportunity to provide our clients with cross-channel digital marketing solutions, not just a stand-alone display media buy or a social fan campaign, for example. With the new Platform, we can help clients achieve their marketing objectives across the critical digital traffic channels and throughout the marketing funnel.”

Epic Marketplace has strongly leveraged its deep partnership with LucidMedia in the development of certain components of the new Platform’s infrastructure. In particular, the new Platform utilizes key components of LucidMedia’s comprehensive demand-side, real-time bidding (RTB) management platform and its patented semantic contextual targeting engine as integral pieces of the infrastructure of the new Platform.

Through the new Platform, Epic Marketplace is confident that it will provide even greater value for its clients. The company’s enhanced capabilities will allow it to scale campaigns with a universal frequency cap and in a fully integrated approach across social, mobile, display and video, across its own network of premium inventory, and across major exchanges and supply-side platforms such as AdMeld, PubMatic and Rubicon.

“We’re very pleased that after such a long process, this important work for Epic Marketplace has been completed so effectively – and on-time,” said Mathis. “Our new Platform solidifies our market leadership position and allows us to leverage data and enhanced statistical targeting across all critical digital marketing channels. Moreover, the new Platform has been built with an enhanced suite of consumer privacy protections, further ensuring our compliance leadership position as well.”

For more information on Epic Marketplace, please log onto http://www.epicmarketplace.com.

First and foremost, allegations of this kind – those that involve consumer privacy, online behavioral advertising or compliance issues in general – are taken very seriously by our company no matter who makes them. We believe, as we have for years now, that our company is among the leaders in compliance and we work very closely with the leading industry groups in that regard. When anyone brings to light any issue, whether it is related to “Do Not Track” or any other consumer privacy concerns, we take the time to research the allegations and if necessary, take corrective action immediately.

The Stanford student’s blog purports to examine a practice described as “history stealing”. The use of such a pejorative term obviously reveals a bias; the student seems to believe that the collection of anonymous, non-personally identifiable, browser information somehow constitutes theft. This is an extreme position, to say the least, as this type of data collection occurs in virtually every web transaction. The practice described in the blog, better labeled as “segment verification” (indeed, as admitted in the blog, no URLs or URL history is actually collected) provides companies with a way to measure the accuracy of the data that a company purchases from data vendors without compromising consumer privacy. NO data obtained from segment verification is personally identifiable information (PII), nor is that data ever merged with other data points that are, or may be, personally identifiable.

Furthermore, when the user opts out, all data collection efforts cease. The student erroneously concludes that users are unable to avoid participating in segment verification because the opt-out mechanism does not delete the cookie that exists on the user’s computer. Like many other networks have pointed out already in their responses, this is misleading and inaccurate. When a user opts-out, all further collection of behavioral data from that user stops and existing profile data is deleted, even though the cookie itself is not deleted. The reason for this is simple: these cookies provide important operational information necessary for the delivery of any ad, not just targeted ads.  For example, Epic Marketplace needs this data to determine how many times a particular ad has been shown to a user, and to analyze whether fraudulent activity is taking place. Ironically, in order to give effect to a consumer’s decision to avoid data collection, the cookie has to remain, otherwise advertisers have no way of knowing that that particular consumer has elected to opt-out of that advertiser’s data collection practices.

The business practices at Epic Marketplace are consistent with the NAI’s long-standing definition of what opt-out means.  While many consumer advocates are calling for a much broader implementation of “Do Not Track,” there is no industry consensus on what “tracking” means or what these browser technologies should do.  Currently, the NAI and DAA cookie-based opt out is the industry standard, and Epic Marketplace complies with this approach. By way of background, it should be noted that our legacy network has been named one of the top networks for compliance, as covered in MediaPost here. Epic Marketplace’s privacy practices towards online behavioral advertising are firmly aligned with industry self-regulation efforts which generally allow for the collection and use of anonymous online behavioral advertising data, provided that there is notice and a robust mechanism for opt out.

For more background about how seriously we take all things compliance-related, we have written several pieces previously which point to our commitment in the area of online privacy and compliance spanning several years. You can see our past essays and the work we’re doing in several of our blog posts. For our take on brand safety, please click here. You can view the news about us being named a top network for compliance here.  You can view our response to the Wall Street Journal’s “What they Know” series here.

Finally, years ago, we invested heavily in our in-house compliance team by bringing on highly-acclaimed attorneys as well as a former FBI agent and cyber crime expert. No other company has done this, or taken the precise steps we have, to secure our reputation to our clients, consumers, and those across the industry. More importantly, we took these steps because consumer protection and privacy are at the top of our agenda and corporate fabric. As one of the only accredited companies in our industry with an A+ rating by the Better Business Bureau, we have a vested interest in ensuring the highest standards are met in the course of everyday business. We pride ourselves on being fully compliant, and are actively working towards implementing all self-regulatory principles our industry has adopted in a comprehensive and responsible manner.

We look forward to continuing a healthy, proactive discussion about some of these important topics in the future. We also look forward to continuing to serve our clients, advertisers and consumers in an effective, yet safe and compliant fashion, to which we are accustomed.

We invite you to head on over to EpicSocial’s “Social Advertising Blog” for a very interesting Q&A with Brendan Gahan from Mekanism. Topics covered include the future of social ads, the biggest challenges facing social media marketers, local advertising, and the utility of Twitter.

Check it out here.

In 2010, Epic won an overall company award for “Best Overall Company – Under 2,500 Employees”. We shared this honor with Apple who won the same award for the over 2,500 employee category. So we’re thankful to have been honored with an award in three consecutive years.

For more details, you can check out the official press release from Marketwatch here.

The new Epic Marketplace operates EpicSocial, EpicMobile, and EpicDisplay brands delivering a full spectrum of digital marketing services via a common audience optimization platform. Epic Marketplace is not an ad network brand, it is the umbrella brand for all the ways we work on behalf of our advertising clients. How exactly? Epic Marketplace enables brands and advertisers to leverage the distinctive strengths of social media, pervasive mobile advertising, premium display targeting, video and rich media.

Our President and CEO Don Mathis sums it up:

“In the year since we acquired Traffic Marketplace, two things have become clear to us at Epic. First, our social media business is realizing explosive growth rates and will represent about half of our total business by early 2012. Social media is a new paradigm, not just a new channel, and all digital advertising will need to be integrated with the social graph going forward. Second, EpicSocial is thriving in substantial part because of its integration with our leading open web targeting capability. Add in EpicMobile – which is on an absolute tear out of the gates – and we are able to offer an integrated digital ad mix to brands and advertisers that is unique and second to none. Consumers are no longer single-channel, they are multi-channel; Epic Marketplace allows advertisers to comprehensively engage with customers across the digital media mix.”

In recent days, there has been a flurry of new online “landscape” charts thanks to LUMA Partners and others. We decided to try and stand out by *not* issuing one of our own. But with this announcement, our broadened “marketplace” and positioning on those landscape charts is more pervasive and, we believe, changes the game a little bit.

Epic Media Group remains the parent company name.

To visit our new website, click here or go to http://www.epicmarketplace.com.

People on Facebook can watch a sponsored video in an application to earn Facebook Credits. Brands can buy and distribute Credits to their target audience in exchange for their time, attention, and feedback, providing predictable ways to engage with consumers on Facebook. While Facebook builds out the Credits ecosystem, EpicSocial and their clients will be the first to access targeted audiences for sponsored video content via Facebook Credits.

This announcement comes on the heels of a year of rapid growth for EpicSocial in the social advertising industry. As our President and CEO Don Mathis rightly summarized, “With the ability to now leverage our video platform with Facebook Credits and offer it to our clients, we have one of the most robust and advanced suite of social services on the market and look forward to working with Facebook and our clients in this growing area.”

Stay tuned for more information on this topic in the coming days, including a guest blog post!