Secure 2024: Forrester Wave™ Q2 2022 Showcases Leading Bot Management Solutions
HUMAN Blog

A Tattered Line of User-Agent String

(Please forgive the pun in the title; Adam recently secured tickets to the Postal Service/Death Cab reunion tour and has been listening to Give Up on repeat for a month.)

While most of the focus last year was on third-party cookie deprecation and IP address privacy, another fundamental change to digital advertising tracking slipped past the headlines: the ongoing deprecation of user-agent within the Chrome browser.

As hopefully most in ad tech know already, the full user-agent string is currently being deprecated, and according to the original Chromium advice, the process will be finished once Chrome 113 is released in April of this year. Between now and April, all organizations who use the full user-agent string should be testing and shifting their usage to User Agent Hints, and communicating any impacts to any partners.

Background on the User-Agent Deprecation

User-agents are fields transmitted from devices that identify—among other things—the specific browser and device operating system versions making a given request, and this data has for some time been a key piece of data for advertising technologists to segment their audiences. And while Firefox and Safari have already taken steps to make this particular field safer, it wasn’t until Chrome’s announcement that this conversation came to the forefront. After all, the Chrome browser is the most popular in the world, driving an estimated 60-70% of internet traffic, so privacy improvements on this browser which restrict data for advertising vendors will have an outsized impact compared to Firefox and Safari.

Eliminating user-agent as a field is a big step forward for privacy (as will be Google’s future plans for IP blindness, and as was the introduction of Apple’s IP relay), and it continues the march away from a Wild West of targeting and tracking information and toward a balance of the disparate needs of security, privacy, and personalization. What comes next will help define the coming era of data privacy and targeting.

One privacy improving replacement for the user agent signal is user hints, which minimizes some of the information currently available through user-agent string, and provides enough information for personalization without enough for a global user tracking scheme. These hints allow a request to indicate to the server which specific features the active browser and OS versions support, including information like a device’s screen size, display density, or other capabilities. This maintains the user’s privacy while still offering servers some information about the type of device and operating system making the connection.

Other Privacy Changes Similar to the User-Agent String Deprecation

Both Google and Apple have recently launched a version of “Private State Tokens” –, which is a browser API that provides a limited amount of information from one browsing context to another (for example, from one website to the next), which is the future-ready solution for organizations hoping to continue 3rd party cookie strategies, but with newer safer methods, after that specific form of local storage has been fully depreciated in a few years.

It’s easy to imagine this user-agent deprecation could be kicked down the road; after all, the third-party cookie deprecation date has slipped later and later. But there don’t appear to be any public announcements alluding to a slowdown, and most experts would agree that the Chrome 113 release should be the beginning of the end of the full user-agent string, and the new privacy-enhanced User Agent Hints are the way of the future.

At some point, all our legacy ad technologies will sunset, and organizations will need to be prepared. The move from user-agent to user hints is only one step toward an eventual popping of the data privacy bubble. GDPR is here, CCPA/CPRA is here, CDPA is here, and more regulations are on their way. Data bubbles pop only when organizations change their approach on their own or are forced to change by outside circumstances, and the window to be proactive and ensure you aren’t impacted by the user-agent string depreciation is closing fast.