Epsilon Data Management, LLC is a marketing data broker and advertising technology company headquartered in Irving, Texas, owned by French advertising group Publicis Groupe, which completed its $4.4 billion cash purchase of the business from Alliance Data Systems on July 1, 2019. Epsilon operates consumer marketing databases built from household purchase histories contributed by catalog, retail, and nonprofit clients, third-party data partners, and online tracking, and its COREid identity graph links offline names and addresses to online identifiers for 255M+ U.S. individuals. Its privacy notice states that all categories of personal data it processes, including sensitive categories such as health, political and religious beliefs, and racial/ethnic data, may have been shared, sold, or used for targeted advertising. In January 2021, Epsilon entered a deferred prosecution agreement with the U.S. Department of Justice and agreed to pay $150 million after admitting employees knowingly sold consumer lists to elder-fraud mail schemes from 2008 to 2017. Epsilon is registered as a data broker in California and offers opt-out, access, and deletion mechanisms.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2021-01-27]
In January 2021, Epsilon Data Management LLC entered a deferred prosecution agreement with the DOJ's Consumer Protection Branch and the U.S. Attorney's Office for the District of Colorado on one count of conspiracy to commit mail and wire fraud, agreeing to pay $150 million ($127.5 million to victims) after admitting that from July 2008 through July 2017 its Direct to Consumer unit employees knowingly sold modeled consumer lists to clients running fraudulent "sweepstakes" and "astrology" mass-mailing schemes that disproportionately harmed the elderly.
In April 2011, under then-parent Alliance Data Systems, Epsilon disclosed an unauthorized intrusion into its email system affecting approximately 2% of its clients' email programs; the company stated the compromise was limited to email addresses and/or customer names, with no other personally identifiable information such as Social Security or credit card numbers exposed. The incident was among the largest email-address breaches of its era.
Epsilon's consumer guide describes a household purchase database in which client companies (mostly catalog and retail companies, plus nonprofits and publishers) contribute their customer information in exchange for prospect data — a cooperative-database model — which Epsilon segments into "niches" using modeling algorithms. The guide states these databases do not contain Social Security numbers, driver's license numbers, financial account numbers, or (absent voluntary surveys) health information.
Epsilon markets consumer data at population scale: its About Us page advertises reach to 255M+ unique U.S. individuals, 120B personalized emails annually, and $15T in transactions tied to people, and claims to know what potential customers want, what they buy, and where to find them.
Epsilon's North American privacy notice states it collects personal data by observing consumers' interactions with its advertisements, from third-party data partners, and from public sources, across categories including purchase histories, financial attributes, inferences, and sensitive personal data (health data; political, religious, and philosophical beliefs; racial/ethnic data; and sex-life data such as contraception purchases). The notice also states Epsilon does not knowingly collect data directly from individuals under 18.
Epsilon Data Management, LLC is registered in California's data broker registry, listing its opt-out webform and phone channel, and its 2026 registration disclosure states that in October 2025 Epsilon acquired Lotame Solutions, Inc., which was merged into Epsilon Data Management, LLC.
Epsilon publicly discloses its ownership on its own site, stating that Publicis Groupe acquired Epsilon in 2019 and that Epsilon is positioned at the core of Publicis Groupe as a global company with over 8,000 employees in more than 40 offices.
Alliance Data Systems' SEC filing documents that on July 1, 2019 it completed the sale of its Epsilon business to Publicis Groupe, S.A. and certain Publicis subsidiaries for $4.4 billion in cash, pursuant to a securities purchase agreement dated April 12, 2019 — making Euronext-listed Publicis Groupe Epsilon's parent.
Epsilon operates under multiple brand names: its privacy notice identifies the covered entities as Epsilon Data Management, LLC doing business as Epsilon, Yieldify, CitrusAd, and Lotame, along with affiliate Conversant LLC also doing business as Epsilon — a multi-brand structure that can make it harder for consumers to recognize which entity holds their data.
Epsilon offers a consumer opt-out from its information sharing, but its consumer guide explains that opting out does not delete the consumer's record: the record is instead marked "Do Not Share" and retained so the suppression persists if the data is resubmitted. Consumers can separately request a free summary of the data Epsilon holds on their household.
Per the Department of Justice, Epsilon admitted its Direct to Consumer unit sold more than 30 million consumers' data to fraudulent mass-mailing schemes between 2008 and 2017, and that the data sold to fraudsters came both from other fraudulent clients and from legitimate Epsilon clients, including nonprofit and charitable organizations.
Epsilon's privacy notice states that all categories of personal data it processes — including sensitive data — may have been shared, sold, or used for targeted advertising with roughly thirty listed categories of third parties (advertising networks, consumer data resellers, financial services companies, social networks, and others) in the past 12 months, and carries an explicit notice that it may sell sensitive personal data. The policy permits opting out of sale and states Epsilon recognizes Global Privacy Control signals as valid opt-out requests.
In April 2011, under then-parent Alliance Data Systems, Epsilon disclosed an unauthorized intrusion into its email system affecting approximately 2% of its clients' email programs; the company stated the compromise was limited to email addresses and/or customer names, with no other personally identifiable information such as Social Security or credit card numbers exposed. The incident was among the largest email-address breaches of its era.
In January 2021, Epsilon Data Management LLC entered a deferred prosecution agreement with the DOJ's Consumer Protection Branch and the U.S. Attorney's Office for the District of Colorado on one count of conspiracy to commit mail and wire fraud, agreeing to pay $150 million ($127.5 million to victims) after admitting that from July 2008 through July 2017 its Direct to Consumer unit employees knowingly sold modeled consumer lists to clients running fraudulent "sweepstakes" and "astrology" mass-mailing schemes that disproportionately harmed the elderly.
Epsilon publishes annual consumer-request metrics in its privacy notice: for calendar 2025 it reported receiving 50,721 opt-out-of-sale/sharing requests (all complied with in full), 2,611 deletion requests, and 1,304 requests to limit sensitive-data use, with median response times of 10-19 days — a transparency practice consistent with the compliance measures its DOJ deferred prosecution agreement required.
Epsilon markets its COREid identity-resolution system as a 100% deterministic, person-level identifier anchored to a verified name and address rather than a cookie or device, unifying offline and online touchpoints and augmenting client data with Epsilon's proprietary demographics, psychographics, and "buyergraphics" — an architecture expressly positioned to withstand third-party cookie loss.
Epsilon's privacy notice discloses that it uses cookies, log files, pixels, and tags to collect data when consumers view or interact with its internet advertisements or visit partner websites, and that it builds "identity" graphs for clients by connecting identities through cookie IDs, IP addresses, and hashed email addresses. The same notice states Epsilon does not monitor or act on browser "Do Not Track" signals, though it does honor mobile Limit Ad Tracking signals when bidding on ad impressions.