Epic Marketplace, Inc.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF EPIC MARKETPLACE, INC. AND EPIC MEDIA GROUP, LLC CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5(A) OF THE FEDERAL TRADE COMMISSION ACT Docket No. C-4389; File No. 112 3182 Complaint, March 13, 2013 – Decision, March 13, 2013 This consent order addresses allegations of deceptive business practices by respondents Epic Media Group, LLC and its wholly-owned subsidiary, Epic Marketplace, Inc. (collectively “Epic”). As part of its business, Epic engages in online behavioral advertising, which is the practice of tracking a consumer’s online activities in order to deliver advertising targeted to the consumer’s interests. The Commission’s complaint alleges that Epic failed to disclose to consumers in its privacy policy that it engaged in “history sniffing,” a practice that examines a user’s browsing history without using cookies. Though Epic claimed it would collect only information about consumers’ visits to sites in its network, the complaint alleges that Epic used history sniffing to secretly gather data from millions of consumers about their interests in sensitive medical and financial issues ranging from fertility and incontinence to debt relief and personal bankruptcy. Under the order, respondents are required to destroy all information collected using history sniffing. Respondents are also prohibited from engaging in history sniffing or from using any information obtained by history sniffing for the next 20 years. Further, respondents are prohibited from misrepresenting to consumers their privacy practices or the extent to which software code is used to determine whether a user has previously visited a webpage.

Participants For the Commission: Kristen Anderson, Katherine White, and Jonathan Zimmerman.

For the Respondents: Charulata B. Pagar, VLP Law Group LLP.

COMPLAINT The Federal Trade Commission, having reason to believe that Epic Marketplace, Inc., a corporation, and Epic Media Group, LLC, a corporation, have violated the Federal Trade Commission Act (“FTC Act”), and it appearing to the Commission that this proceeding is in the public interest, alleges: EPIC MARKETPLACE, INC., ET AL. 407 Complaint 1. Respondent Epic Marketplace, Inc. (“Epic”) is a Delaware corporation with its principal office or place of business at 512 7th Ave., 12th Floor, New York, NY 10018.

2. Respondent Epic Media Group, LLC (“EMG”) is a Delaware corporation with its principal office or place of business at 512 7th Ave., 12th Floor, New York, NY 10018. 3. The acts and practices of Epic and EMG (collectively “respondents”) as alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act.

RESPONDENTS’ BUSINESS PRACTICES 4. EMG is a global digital marketing company. Epic is a wholly-owned subsidiary of EMG, and EMG controls Epic’s operations.

5. Epic is an advertising company that engages in online behavioral advertising, which is the practice of tracking a consumer’s online activities in order to deliver advertising targeted to the consumer’s interests.

6. Epic acts as an intermediary between website owners who publish advertisements on their website for a fee (“publishers”) and advertisers who wish to have their advertisements placed on websites. Epic purchases advertising space on publishers’ websites and contracts with advertisers to place their advertisements on the websites. Epic refers to the network of websites on which it purchases advertising space as the “Epic Marketplace [N]etwork.” The Epic Marketplace Network includes over 45,000 publishers.

7. Epic collects data on consumers who visit the websites within the Epic Marketplace Network. When a consumer visits a website within the Epic Marketplace Network, Epic sets a new cookie in the consumer’s browser or automatically receives a cookie it previously set. Cookies are small text files that are commonly used to store information about a consumer’s online VOLUME 155 Complaint activities, including information such as the content of advertisements that a consumer views or the pages a consumer visits within a particular website.

8. In March 2010, Epic merged with Connexus Corporation. One of Connexus’ subsidiaries, Traffic Marketplace, engaged in “history sniffing,” which is the practice of determining whether a consumer has previously visited a webpage by checking how a user’s browser styles the display of a hyperlink. For example, if a consumer has previously visited a webpage, the hyperlink to that webpage may appear in purple, and if the consumer has not previously visited a webpage, the hyperlink may appear in blue. History-sniffing code would sniff whether the consumer’s hyperlinks to specific webpages appeared in blue or purple. 9. Through its merger with Connexus, Epic acquired Traffic Marketplace and continued to engage in history sniffing until August 2011. Epic included the history-sniffing code within advertisements it served to visitors on at least 24,000 webpages within the Epic Marketplace Network including, but not limited to, cnn.com, papajohns.com, redcross.com, and orbitz.com. The code exploited a feature of consumers’ web browsers that displays hyperlinks in different styles, depending on whether the consumer has previously visited the link. The code allowed Epic to determine whether a consumer had visited any of over 54,000 domains. Among the domains that Epic “sniffed” were pages relating to fertility issues, impotence, menopause, incontinence, disability insurance, credit repair, debt relief, and personal bankruptcy.

10. Based upon its knowledge of which domains a consumer had visited, Epic assigned the consumer an interest segment. Epic’s interest segments included sensitive categories such as “Incontinence,” “Arthritis,” “Memory Improvement,” and “Pregnancy-Fertility Getting Pregnant.” Epic used this historysniffing data for behavioral targeting purposes. 11. History sniffing circumvents the most common and widely known method consumers use to prevent online tracking: deleting cookies. Deleting cookies does not prevent a website from querying a consumer’s browsing history. Consumers could only protect against history sniffing by deleting their browsing history EPIC MARKETPLACE, INC., ET AL. 409 Complaint and using private browsing mode, or, with regard to Epic’s history sniffing, opting out of receiving targeted advertisements from Epic. Once major browser vendors began to implement protections against history sniffing in 2010 and 2011, consumers could also avoid having their browser history sniffed by using updated versions of those browsers.

12. History sniffing allowed Epic to determine whether consumers had visited webpages that were outside the Epic Marketplace Network, information it would not otherwise have been able to obtain.

13. Epic’s history sniffing was revealed in July 2011, when researchers at the Center for Internet and Society at Stanford Law School uncovered the practice and posted their findings online. RESPONDENTS’ STATEMENTS RELATING TO THE COLLECTION AND USE OF CONSUMER INFORMATION (Counts 1 and 2) 14. Respondents have disseminated or caused to be disseminated statements on Epic’s website regarding respondents’ privacy practices, including but not limited to the following statement in the Epic “Web User Privacy Policy,” from approximately March 2010 until at least August 2011, about respondents’ collection of consumer information: Epic Marketplace automatically receives and records anonymous information that your browser sends whenever you visit a website which is part of the Epic Marketplace Network. We use log files to collect Internet protocol (IP) addresses, browser type, Internet service providers (ISP), referring/exit pages, platform type, date/time stamp, one or more cookies that may uniquely identify your browser, and responses by a web surfer to an advertisement delivered by us. 15. Respondents’ statement describing their privacy and online behavioral targeting practices did not disclose that Epic was engaged in history sniffing.

EPIC MARKETPLACE, INC., ET AL. 411 Decision and Order COUNT 1 16. As described in paragraph 14, respondents represented, expressly or by implication, that Epic collected information on consumers’ visits to websites only within the Epic Marketplace Network.

17. In truth and in fact, Epic did not collect only information on consumers’ visits to websites within the Epic Marketplace Network. Epic used history sniffing to collect information on whether consumers had visited websites outside of the Epic Marketplace Network. Therefore, the representation made in paragraph 16 was false or misleading and constitutes a deceptive act or practice.

COUNT 2 18. As described in paragraphs 14-15, respondents failed to disclose that they were engaged in history sniffing. This fact would be material to consumers in deciding whether to use Epic’s opt-out mechanism. Therefore, in light of the representations made, respondents’ failure to disclose this fact constitutes a deceptive act or practice.

19. The acts and practices of respondents as alleged in this complaint constitute deceptive acts or practices, in or affecting commerce, in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this thirteenth day of March 2013, has issued this complaint against respondents. By the Commission, Commissioner Wright not participating. VOLUME 155 Decision and Order DECISION AND ORDER The Federal Trade Commission having initiated an investigation of certain acts and practices of the respondents, and the respondents having been furnished thereafter with a copy of a draft Complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge the respondents with violations of Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 et seq;

The respondents, their attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), an admission by the respondents of all the jurisdictional facts set forth in the aforesaid draft Complaint, a statement that the signing of said Consent Agreement is for settlement purposes only and does not constitute an admission by respondents that the law has been violated as alleged in such Complaint, or that the facts as alleged in such Complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it has reason to believe that the respondents have violated the Federal Trade Commission Act, and that a Complaint should issue stating its charges in that respect, and having thereupon accepted the executed Consent Agreement and placed such Consent Agreement on the public record for a period of thirty (30) days for the receipt and consideration of public comments, and having carefully considered the comments filed by interested persons, now in further conformity with the procedure described in Section 2.34 of its Rules, 16 C.F.R. § 2.34, the Commission hereby issues its Complaint, makes the following jurisdictional findings, and enters the following Order: 1. Epic Marketplace, Inc. and Epic Media Group, LLC are Delaware corporations with their principal offices or places of business at 512 7th Ave, 12th Floor, New York, NY, 10018.

2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the EPIC MARKETPLACE, INC., ET AL. 413 Decision and Order respondents, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this Order, the following definitions shall apply:

1. Unless otherwise specified, “proposed respondents” or “respondents” shall mean: Epic Marketplace, Inc.; Epic Media Group, LLC; and their parent company, FAS Labs, Inc.; including each of their subsidiaries, successors, and assigns.

2. “Commerce” shall be defined as it is defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44.

3. “Computer” or “device” shall mean any desktop or laptop computer, handheld device, telephone, tablet, or other product or device, through which the consumer accesses the Internet.

4. “History sniffing” shall mean running software code on a webpage that determines whether a user has previously visited a webpage by checking how a user’s browser styles the display of a link to a specific URL or by accessing a user’s browser cache. I.

IT IS ORDERED that respondents and their officers, agents, representatives, and employees, directly or through any corporation, subsidiary, division, or other device, in connection with the online advertising, marketing, promotion, offering for sale, sale, or dissemination of any product or service, in or affecting commerce, shall not misrepresent in any manner, expressly or by implication: (A) the extent to which they maintain the privacy or confidentiality of data from or about a particular VOLUME 155 Decision and Order consumer, computer, or device, including but not limited to the extent to which that data is collected, used, disclosed, or shared; or (B) the extent to which software code on a webpage determines whether a user has previously visited a webpage. II.

IT IS FURTHER ORDERED that respondents and their officers, agents, representatives, and employees, directly or through any corporation, subsidiary, division, or other device, in connection with online advertising, marketing, promotion, offering for sale, sale, or dissemination of any product or service, in or affecting commerce, are prohibited from collecting any data through history sniffing or using any data obtained by history sniffing.

III.

IT IS FURTHER ORDERED that respondents and their officers, agents, representatives, and employees, directly or through any corporation, subsidiary, division, or other device, shall not use, disclose, sell, rent, lease, or transfer any information that was collected using history sniffing. Within five (5) days after the date of service of this order, respondents shall permanently delete or destroy all information collected using history sniffing, and shall provide a written statement to the Commission, sworn under penalty of perjury, confirming that all such information has been deleted or destroyed. Provided that, if respondents are prohibited from deleting or destroying such information by law, regulation, or court order, respondents shall provide a written statement to the Commission, sworn under penalty of perjury, identifying any information that has not been deleted or destroyed and the specific law, regulation, or court order that prohibits respondents from deleting or destroying such information. Unless otherwise directed by a representative of the Commission, all statements required by this Part shall be sent by overnight courier (not the U.S. Postal Service) to the Associate Director of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580, with the subject line In the matter of Epic Marketplace, Inc. and Epic Media Group, LLC. Provided, however, that, in lieu of overnight courier, statements may be sent EPIC MARKETPLACE, INC., ET AL. 415 Decision and Order by first-class mail, but only if an electronic version of such statements is contemporaneously sent to the Commission at [email protected].

IV.

IT IS FURTHER ORDERED that respondents shall maintain and upon request make available to the Federal Trade Commission for inspection and copying a print or electronic copy of:

A. For a period of three (3) years from the date of service of this order or from the date of preparation, whichever is later:

1. Consumer complaints or inquiries directed to respondents or forwarded to respondents by a third party concerning: (a) any collection of data by respondents; (b) the use, disclosure, or sharing of such data by respondents; or (c) opt-out practices or any other mechanism to limit or prevent such collection of data or the use, disclosure, or sharing of data collected by respondents, as well as any responses to such complaints or inquiries;

2. All records necessary to demonstrate full compliance with each provision of this order, including all submissions to the Commission; and B. For a period of three (3) years after the last public dissemination thereof by respondents, respondents’ terms of use, form network contracts, marketing materials, frequently asked questions, privacy policies, and other documents publicly disseminated by respondents relating to: (a) collection of data by respondents; (b) the use, disclosure or sharing of such data by respondents; (c) opt-out practices and other mechanisms to limit or prevent such collection of data by respondents or the use, disclosure, or sharing of data collected by respondents; (d) respondents’ VOLUME 155 Decision and Order membership in any self-regulatory body; and (e) respondents’ participation in and compliance with any privacy, security, or other compliance program sponsored by the government or other third party. V.

IT IS FURTHER ORDERED that, for three (3) years after the date of service of this order, respondents shall deliver a copy of this order to: (1) all current and future principals, officers, directors, and managers; and (2) all current and future managers, employees, agents and representatives who have responsibilities on behalf of respondents with respect to the subject matter of this order, and shall secure from each such person a signed and dated statement acknowledging receipt of the order, with any electronic signatures complying with the requirements of the E-Sign Act, 15 U.S.C. § 7001 et seq. Respondents shall deliver this order to current personnel within thirty (30) days after the date of service of the order, and to future personnel within thirty (30) days after the person assumes such position or responsibilities. VI.

IT IS FURTHER ORDERED that respondents shall notify the Commission at least thirty (30) days prior to any change in respondents that may affect compliance obligations arising under this order, including but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor company; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in respondents’ name or address. Provided, however, that with respect to any proposed change about which respondents learn less than thirty (30) days prior to the date such action is to take place, respondents shall notify the Commission as soon as is practicable after obtaining such knowledge. Unless otherwise directed by a representative of the Commission in writing, all notices required by this Part shall be sent by overnight courier (not the U.S. Postal Service) to the Associate Director of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580, with the subject line: In the Matter of Epic Marketplace, EPIC MARKETPLACE, INC., ET AL. 417 Decision and Order Inc. and Epic Media Group, LLC. Provided, however, that, in lieu of overnight courier, notices may be sent by first-class mail, but only if an electronic version of such notices is contemporaneously sent to the Commission at [email protected]. VII.

IT IS FURTHER ORDERED that respondents shall, within ninety (90) days after the date of service of this order, file with the Commission a true and accurate report, in writing, setting forth in detail the manner and form in which respondents have complied with this order. Within ten (10) days of receipt of written notice from a representative of the Commission, respondents shall submit additional true and accurate written reports. VIII.

This order will terminate on March 13, 2033, or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Part of this order that terminates in less than twenty (20) years;

B. This order’s application to any respondent that is not named as a defendant in such complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that the respondents did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Part as though the complaint had never been filed, except that this VOLUME 155 Analysis to Aid Public Comment order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. By the Commission, Commissioner Wright not participating. ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission has accepted, subject to final approval, a consent agreement from Epic Marketplace, Inc. and Epic Media Group, LLC.

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order. Epic Marketplace, Inc. (“Epic”) is an advertising company that engages in online behavioral advertising, which is the practice of tracking a consumer’s online activities in order to deliver advertising targeted to the consumer’s interests. Epic is a wholly-owned subsidiary of Epic Media Group, LLC (“EMG”). Epic acts as an intermediary between website owners who publish advertisements on their website for a fee (“publishers”) and advertisers who wish to have their advertisements placed on websites. Epic purchases advertising space on publishers’ websites and contracts with advertisers to place their advertisements on the websites. Epic refers to the network of websites on which it purchases advertising space as the Epic Marketplace Network, which includes over 45,000 publishers. EPIC MARKETPLACE, INC., ET AL. 419 Analysis to Aid Public Comment The Commission’s complaint alleges that, from March 2010 through August 2011, Epic engaged in “history sniffing” – running software code on a webpage to determine whether a user has previously visited a webpage – by checking how a user’s browser styles the display of a hyperlink. This practice allegedly allowed Epic to determine whether a consumer had visited any of over 54,000 domains, including pages relating to fertility issues, impotence, menopause, incontinence, disability insurance, credit repair, debt relief, and personal bankruptcy. According to the complaint, history sniffing allowed Epic to determine whether consumers had visited webpages that were outside the Epic Marketplace Network, information it would not otherwise have been able to obtain, and Epic used this history-sniffing data for behavioral targeting purposes.

The FTC’s complaint charges that Epic and EMG violated Section 5(a) of the FTC Act by falsely representing to consumers that respondents only collected information on consumers’ visits to websites within the Epic Marketplace Network. The complaint also alleges that the companies failed to disclose to consumers that they were engaged in history sniffing. The proposed order contains provisions designed to prevent Epic; EMG; their parent company FAS Labs, Inc.; and any of their subsidiaries, successors, and assigns (collectively, “respondents”) from engaging in practices similar to those alleged in the complaint in the future.

Part I of the proposed order prohibits respondents from misrepresenting in any manner, expressly or by implication: (A) the extent to which they maintain the privacy or confidentiality of data from or about a particular consumer, computer, or device, including but not limited to the extent to which that data is collected, used, disclosed, or shared; or (B) the extent to which software code on a webpage determines whether a user has previously visited a webpage.

Part II of the proposed order prohibits respondents from collecting any data through history sniffing – running software code on a webpage to determine whether a user has previously visited a webpage by checking how a user’s browser styles the VOLUME 155 Analysis to Aid Public Comment display of a hyperlink or by accessing a user’s browser cache – or using any data obtained by history sniffing. Part III of the proposed order prohibits respondents from using, disclosing, selling, renting, leasing, or transferring any information that was collected using history sniffing. In addition, within five (5) days after the date of service of the order, respondents must permanently delete or destroy all information collected using history sniffing.

Parts IV through VIII of the proposed order are reporting and compliance provisions. Part IV requires that respondents retain, for a period of three (3) years, documents relating to its compliance with the order. Part V requires dissemination of the order to all current and future principals, officers, directors, and managers; and all current and future managers, employees, agents, and representatives who have responsibilities on behalf of respondents with respect to the subject matter of this order. Part VI ensures notification to the FTC of changes in corporate status. Part VII mandates that respondents submit an initial compliance report to the FTC and make available to the FTC subsequent reports. Part VIII is a provision “sunsetting” the order after twenty (20) years, with certain exceptions. The purpose of the analysis is to aid public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed complaint or order or to modify the order’s terms in any way.

DESIGNERWARE, LLC 421 Complaint