The privacy claims Phorm makes about its technology's use of consumer data have been verified by leading global auditing firm Ernst & Young (View report PDF).

E&Y have determined that the unique fundamental design of this technology ensures that consumer privacy is protected and that, even under compulsion, no personally-identifying data or detailed browsing data can be retroactively provided to anyone.

The technology used by the OIX will be regularly audited on an ongoing basis to make sure that we continue to comply with our commitment.

Ernst & Young have confirmed the following:

1. Phorm's systems do not use or intentionally store or collect personally identifiable information from consumers.

   Phorm is able to do this as Phorm's systems:

   • Do not tie into the authentication systems of our ISP partners;
   • Do not store and/or use the IP address, which is potentially another mechanism to identify a consumer household;
   • Ignore information such as form fields, numbers with more than 3 digits (to protect against the accidental collection of social security, telephone and credit card numbers), email addresses and secure (HTTPS) pages.

2. Phorm has established industry-leading standards regarding storage, retention and deletion of data.

   Storage, retention and use of consumer data are currently key concerns in the online advertising industry. Phorm's systems collect browsing information such as URLs visited, search terms entered, OS version, relevant keywords of a particular page and randomly-generated unique IDs. Importantly, however:

   • This specific data cannot be accessed by Phorm's ISP partners.
   • Even this non-personally-identifiable information is automatically purged from the production system within hours. (Research and debug logs may be kept on a separate system for a maximum of 7 days).
   • Once the system deletes this data, it is not possible for Phorm to release it, either accidentally or deliberately.

3. An Easy Opt-Out Mechanism

   Phorm offers an easy, anonymous method for users to opt out of Phorm's systems if they would rather not receive targeted advertising. For as long as a user retains the Phorm opt-out cookie, the system will not collect or store data from their browsing behaviour.

Copies of the full report are available by request. Phorm will also consider requests for audits from other persons or organisations wishing to certify the privacy features of the OIX platform. To make a request, simply contact us.