1.1 Adding Publishers into the network

Strict policies are in place to ensure that only high quality sites are selected for Exponential Interactive’s network. Adding publishers evolves from a two-step process:

Site Acceptance:

• Publishers must meet the Exponential Publisher Code of Conduct before being accepted
• Manual quality checks are performed by Exponential employees to ensure compliance
• Sites are also constantly scanned by proprietary technology and are removed if questionable content is found
• Transparent site lists are always made available for advertisers to approve or remove sites that are not an appropriate match for their brand

Domain Verification:

• Before a new site goes live, they must identify all domains that they will/might run an Exponential ad on
• After the publisher submits the domain(s), Exponential employees manually vet the domain for brand-safety purposes
• If the domain is approved, it is added into the ‘approved domain’ list. Exponential’s ad server references this approved list to learn where it is and is not allowed, to serve an impression
• If a non-approved domain calls our ad server for an ad, the ad server rejects the request and will NOT serve that domain an ad
• This process and proprietary technology prevents nefarious publishers from retrafficking our ads to questionable sites

**These two steps make up two of the three steps that power our proprietary verification tool, PageGuard™

1.2 Publisher Code of Conduct Overview

• Exponential identifies types of prohibited content (i.e. pornography, copyright infringement, spam, fraud, pyramid schemes, etc…)
• Exponential identifies types of prohibited actions (i.e. tag retrafficking, altering ad creative, pay for clicks/impressions, timed rotations/autorefresh, etc…)
• Publisher domains are approved at Exponential’s discretion (i.e. no publishers with downloadable software, no publishers that may be harmful to the business reputation of Exponential Interactive)
• Includes the legacy IASH terms and conditions
• The Publisher Code of Conduct can be found at: https://exponential.com/documents/publisher-code-of-conduct/

1.3 Inventory acquired through RTB

• Sometimes we supplement our on network activity with inventory acquired off network with our client’s consent
• We use exchange partners who are certified by both IAB QAG and JICSWEB to the DTSG Good Practice Principles (http://www.jicwebs.org/agreed-principles/digital-trading-standards-group-code/151-dtsgsignatories).
• We integrate with DoubleClick Ad Exchange. This is subject to change and is not exhaustive of all partners we may work with in the future.
• We run activity on a pre-vetted domain whitelist unless otherwise agreed with the client.

1.4 Ads.txt

• At Exponential, we’ve been supporters of ads.txt since its launch in 2017.
• We continue to work with publishers who have an ads.txt file enabled and enter us as an approved seller of their inventory.
• Any inventory acquired through RTB is also ads.txt compliant.
• We are committed to our role in creating a cleaner, more transparent advertising ecosystem for everyone.

The following section outlines the various roles that both proprietary and 3rd party technology plays in ensuring delivery to the audience intended by the agency/brand.

2.1 PageGuard™

PageGuard™ is Exponential’s proprietary answer to ensuring that all campaigns are delivered to safe environments. It uses a 3 step processes to provide a comprehensive and proactive solution to prevent the possibility of ads appearing on inappropriate content:

• Site acceptance (covered in section 1.1)
• Domain Verification (covered in section 1.1)
• Page Level Contextualization: Pages are scanned daily according to traffic priority. Our proprietary page level contextualization technology then categorises these pages, assessing the safety of the content. In the event a page is deemed to be an unsafe brand environment, Exponential will not serve an ad.

**PageGuard runs free for all advertisers on all on-network campaigns

2.2 3rd Party Content Verification

1. An agency/brand decides they want to run a 3rd party verification tool (i.e. DoubleVerify, Integral Ad Science, comScore vCE, etc…)
2. Agency either works directly with the verification provider to create verification specifications OR allows Exponential to pick a preferred vendor
3. Agency sends the specifications to Exponential – specs might include a white/black list, intended or violating website categorizations, violating keywords, intended geo targeting, etc…
4. Exponential targets the campaign in our ad server per the agency’s specifications
5. Campaign is set live after applying the verification code in either the agency’s ad server or Exponential’s ad server
6. Exponential starts to receive reporting from the agency ad server AND the verification tool

• If no violations are seen, continue to run campaign
• If violations are seen, adjust campaign targeting until the violations go below the predetermined threshold or disappear altogether

**Due to occasionally inaccurate categorizations by the 3rd party vendors, Exponential account managers are trained to vet the site categorization from the vendors against their own personal categorization. If the AM categorization vastly disagrees with the vendor’s categorization engine, the AM may pursue the agency to add the site to a whitelist OR the verification vendor to re-categorize the site.

2.3 Take Down Policy

If violations are seen, adjust the campaign targeting until the violations go below the predetermined threshold or disappear altogether. Correction of flagged violations will occur within 48 hours, but best endeavors will be made to rectify immediately. The contractual consequences of not responding appropriately to a takedown request in the specified time frame will be subject to the terms of individual IOs.

By algorithmically leveraging data provided from the three leading geo databases in the industry, Exponential Interactive can ensure our approach to geo targeting is incredibly accurate.

3.1 Providers Used

• DigitalEnvoy
• MaxMind
• Quova

3.2 Updating Intervals

In order to update our systems, we sync our ad server with the geo databases once per month.

3.3 Geo Targeting Logic

• By leveraging the three main providers, we are effectively constructing our own proprietary geoDB
• For a particular impression, the sources are compared and where a provider is known to be better, they are preferred.
• The sources are also compared and leveraged so that when two of the three sources agree, that becomes the source of truth on the actual geo
• Algorithmically, we use the suppliers’ own accuracy scores to select the best option for each region
  • This effectively allows us to get a second and third opinion on every IP mapping

3.4 Geo Discrepancies

Because ad serving and verification systems are built on completely different platforms, they can often leverage different geo databases as their source of truth in regard to geo targeting. This is usually the root cause of geo discrepancies between two parties. For instance, if DoubleVerify uses DigitalEnvoy and Exponential uses all 3 geoDB’s, there will be times when we’re both looking at two different geo DB’s for the same impression. If those geo DB’s do not agree, there will be a discrepancy.

Exponential uses The Media Trust as its 3rd party malware detection service. Exponential has been leveraging a relationship since March of 2011.

4.1 Media Trust Integration

We have an API integration with the Media Trust that allows them to access our ad tags. They programmatically scan our ad tags looking for malware. If malware is detected on a tag, they notify an internal team, which is made up of several lead engineers, ad ops and product folks. The integration was built so the Media Trust could scan each ad tag in our ad server 6 times per day.

4.2 Internal Malware Process

1. Media Trust identifies malware coming from a specific tag
2. They immediately, and automatically, send a report to an internal Exponential team. The automated email includes all of the necessary information to locate the advertiser and creative in our ad server
3. One of the members of the ‘malware’ team pause the flight in the ad server and notify the account manager
4. The Exponential AM reaches out to seek clarification from the advertiser about the malware
5. The advertiser then either fixes the issue on their side OR sends a new creative for the flight
6. The flight goes back live once the malware is resolved

A ‘bot’ is short for robot. That is to say, a bot impression is an impression that has been generated by a non-human user. Exponential has a number of safeguards in place to help keep our network clean and free of bot traffic: PageGuard, click fraud algorithms, impression fraud algorithms, and a proprietary ad server that allows us to monitor and adjust accordingly.

5.1 Impression Fraud

We do not serve any campaigns to robotic impressions

• For every impression, we compare the user agent with a list of known user agents and if found, we mark the request origination from a robot
• Apart from the above static list, we maintain a count of ads served to a user in a preset amount of time and anytime we find its count going too high, we mark it as a Robot user and any subsequent impressions for the remaining browsing session will not be counted. In order for this user to become a human user (non-robot user) again, it’ll have to behave for a preset amount of time.
• Bots are detected and blocked in the future both by means of built-in logic inside our ad server and having offline processes.

5.2 Click Fraud

• The ad server first checks the combination of creative id (via the mediadata_id ), user_id (the unique id associated with a cookie) and timestamp. If we’ve seen the combination before, disregard the click request (it’s a duplicate). The ad server has a strong algorithm to detect all duplicate clicks and disregard those duplicate requests.
• Next, check the IP address and user agent requesting the click against our list of known robots. If either is found, the click request will not be honored.
• If a user has clicked more than a certain number in a preset amount of time, it will be treated as ROBOT for all subsequent views/clicks
• Bots are detected and blocked in the future both by means of built-in logic inside our ad server and having offline processes.

5.3 Manual Monitoring

We look for suspicious patterns in the data that may indicate bots or purchased traffic

• Pre-launch monitoring: Prior to approval, a domain is manually vetted using a combination of licensed tools and proprietary methodology to help determine the likelihood that the domain engages in nefarious behavior
• Post-launch monitoring: After domain approval and traffic starts flowing, pubs are monitored on certain distributions of inventory types, as well as fluctuations of various metrics
• Consultative technology monitoring: various services are leveraged as an additional safeguard

Exponential’s dedicated publisher team manually monitors this publisher activity on an ongoing basis. If irregularities are noticed, we will either:

• Remove the publisher immediately, OR
• Start a conversation regarding the infraction(s). If the publisher is forthcoming with information, we will entertain a second chance. If not, they will be removed

The following is a list of services that are leveraged by Exponential Interactive’s display network to guarantee accurate delivery of advertiser campaigns. Some of these services are used on request, while others are used at regular or consistent intervals.

• The Media Trust: alerts clients to overt malware attacks or potentially malicious software code or viruses embedded in ad tags or distributed through syndicated content. The Media Trust identifies the location of the threat and alerts the client in order to take action before it reaches unknowing visitors.
• TrustMetrics: gives brand advertisers the ability to rank and score websites based on a site’s potential advertising value/quality. Ratings can be customized for specific brands, ad categories, campaigns, or markets.
• DoubleVerify: provides online media verification and campaign effectiveness solutions for media entities looking to ensure quality advertising environments, campaign transparency and performance.
• comScore vCE (verification): is a holistic ad delivery validation solution that provides deep campaign insights including in-view data, geo validation, brand safe ad delivery and the prevention of non-human traffic.
• Integral Ad Science: provides verification services that scores and evaluates the brand safety, context, viewability and many other elements of web pages on an individual page level.
• Maxmind: provides its geolocation technology by pinpointing in real-time the location of Internet customers and visitors by country, geographic region, and the granular detail of city
• DigitalEnvoy: Using advanced IP level technology, DigitalEnvoy identifies the location of internet users by country, geographic region, and city. This data is used by media providers to help with accurate geotargeting.
• Quova: enables businesses to accurately identify where their Website visitors are geographically, by country, state or city. This, in turn, allows for accurate geotargeting of internet users.

Exponential reserves the right, at its sole discretion, to modify, discontinue or terminate these Safety Guidelines at any time and without advance notice. Continued access to or use of Exponential’s services after any such revision constitutes agreement to the revised Safety Guidelines.

Last modified March, 2015

Copyright © 2015 Exponential Interactive, Inc.