What epik actually is
epik is added to the landing page URL when someone clicks a Pinterest ad and lands on your site. The Pinterest tag on that page reads it to help match the visit back to the campaign that produced it, the same broad job every click ID on this list does, and Pinterest also sets a matching _epik first-party cookie on your domain so the match can survive beyond the single page load.
Why epik behaves differently from the other ad click IDs
Most click IDs covered on this site, gclid, fbclid, ttclid, msclkid, are opaque lookup keys: the value itself means nothing outside the ad platform, and the platform's own servers hold the actual record the key points to. Pinterest describes epik differently: the value is an encrypted payload that carries attribution details, like the campaign it came from, directly inside the string, decodable only by Pinterest's own servers. Practically that changes little about what you should do with it, but it's worth knowing the string isn't a random-looking reference number, it's closer to a sealed envelope than a claim ticket.
Pinterest also has a fallback, _derived_epik, generated when a match is made without any cookie present at all, through enhanced matching signals instead. If you spot that name in a cookie inspector rather than in a URL, it's the same family, produced a different way.
Is it safe to remove?
There's no visible change for a visitor either way. For the advertiser, stripping epik before the Pinterest tag fires breaks the attribution chain back to the ad, the same as any other click ID. Because the value is genuinely opaque and encrypted rather than just obfuscated, there's no meaningful privacy upside to trying to read it yourself; removing it before sharing a link is the only useful action available.