In 2022, Google began changing the availability of the information available in User-Agent strings across their Chromium browsers. The change is to use the set of HTTP request header fields called Client Hints. Through this process, a server can request, and if approved by the client, receive information that would have been previously freely available in the User-Agent string. This change is likely to have an impact on publishers across the open web that may use User-Agent information today.
To explain what this change means, how it will impact the AdTech industry, and what you can do to prepare, we spoke with Nate West, our Director of Product.
What is the difference between User-Agents and Client Hints?
A User-Agent (UA) is a string, or line of text, that identifies information about a web server’s browser and operating system. For example, it can indicate if a device is on Safari on a Mac or Chrome on Windows.
Here is an example UA string from a Mac laptop running Chrome:
To limit the passive fingerprinting of users, Google is reducing components of the UA strings in their Chromium browsers and introducing Client Hints. When there is a trusted relationship between first-party domain owners and third-party servers, Client Hints can be used to share the same data.
This transition began in early 2022 with bigger expected changes beginning in February 2023. You can see in the above example, Chrome/109.0.0.0, where browser version information is already no longer available from the UA string on this desktop Chrome browser.
How can you use User-Agent device attributes today?
UA string information can be used for a variety of reasons. It is a component in web servers that has been available for decades. In the AdTech space, it can be used in various ad targeting use cases. It can be used by publishers to better understand their audience. The shift to limit access and information shared is to prevent nefarious usage of the data.
What are the benefits of Client Hints?
By using Client Hints, a domain owner, or publisher, can manage access to data activity that occurs on their web properties. Having that control may be advantageous. The format of the information shared is also cleaner than parsing a string from User-Agents. Although, given that Client Hints are not the norm across all browsers, a long-term solution may be needed to manage UA strings and Client Hints.
An advantage of capturing and sharing Client Hint information is to be prepared and understand if there is any impact to your systems and processes. This will help with the currently planned transition by Google, but also should the full UA string become further restricted.
Who will be impacted by this change?
Publishers across the open web should lean in to understand this change and any potential impact to them. The programmatic ecosystem supporting real-time bidding (RTB) needs to continue pushing for adoption of OpenRTB 2.6, which supports the passing of client hint information in place of data from UA strings.
What is Google’s timeline for implementing Client Hints?
Do businesses have to implement Client Hints? What happens if they don’t?
Not capturing and sharing with trusted partners can impact capabilities in place today. Given Chromium browsers account for a sizable portion of web traffic, the impact will vary for each publisher and tech company in the ecosystem. I would assess how UA strings are in use today, where you may have security concerns or not, and look to get more information on how to maintain data sharing with trusted partners.
We can help you adopt Client Hints
Reach out to our Customer Success team at tapadcustomersuccess@experian.com to explore the best options to handle the User-Agent changes and implement Client Hints. As leaders in the AdTech space, we’re here to help you successfully make this transition. Together we can review the options available to put you and your team on the best path forward.
About our expert
Nate West, Director of Product
Nate West joined Experian in 2022 as the Director of Product for our identity graph. Nate focuses on making sure our partners maintain and grow identity resolution solutions today in an ever-changing future state. He has over a decade of experience working for media organizations and AdTech platforms.
Latest posts
As many folks within the email eco-system probably know by now, Spamhaus, an organization known for compiling several widely used anti-spam lists, has been extremely active this week. Over the past week, Spamhaus has listed a number of potentially hazardous IP addresses used by some of the world’s largest email service providers due to the way their newsletters signups are set up. According to most of the listings, Spamhaus has stated: Unfortunately, the said newsletter service is not verifying the email address of new subscribers. Due to this, the service can be easily abused to "listbomb" internet users. Problem resolution ============================ The newsletter service needs to clean up their email address list and ensure that bulk emails are only being sent to recipients who have verifiably subscribed to their bulk email service. In addition, the newsletter service should take appropriate actions to prevent further abuse of their service: a) Implementing CAPTCHA to prevent automated subscriptions b) Implementing Confirmed Opt In (COI) to prevent abusers from adding random email addresses to the newsletter service that are not owned by the subscriber For the most part these listings should not directly impact marketers’ current ability to send their campaigns and reach their customers as they are listed as “warnings” within the Spamhaus system. What is important to understand is that these types of listings will likely continue to happen as Spamhaus has seen a dramatic increase in malicious use of newsletter sign-ups to "email bomb" various addresses, especially government (.gov) domains. While we understand that implementing CAPTCHA, or COI into any marketing system is not something that can be done quickly, Experian Marketing Services has recommended that our clients begin to investigate how they can potentially implement this process into their newsletter sign-ups. By asking customers to simply perform the CAPTCHA check, it will not only protect marketers from adding addresses from automated signup systems, but will also reduce the possibility of being listed with Spamhaus for these types of issues in the future. Some additional resources: Massive Email Bombs Target .Gov Addresses Subscription bombing, ESPs and Spamhaus, August 15, 2016 by laura in Best Practices Comment on the latter blog post on WordtotheWise.com from the CEO of Spamhaus: Excellent well summarized article Laura. No, we’ve not changed SBL policy to require COI. It’s something we very strongly advise but we cannot make a requirement. We’ll have to consider it if list-bombing of this magnitude cannot be kept in check by list managers. This incident involved a large number of government addresses belonging to various countries being subscribed to very large numbers of lists in a very short space of time by scripts run by the attacker(s). Most of the lists hit by the attack used COI and therefore only sent confirmation requests and did not subscribe any addresses. The attack undoubtedly also hit lists which used Captcha in addition to COI and thus did not even proceed to COI (those list admins deserve some sort of community ‘hi 5’ award, since one can imagine how hard it is to convince one’s management to implement COI let alone put Captcha in front of it). The issue is the badly-run ‘open’ lists which happily subscribed every address without any consent verification and which now continue as participants in the list-bombing of government addresses. These we are trying to address with SBL listings to prompt resolution by the Senders. As you noticed, most of these particular incident listings are for IPs ending “.0/32” which does not cause any mail issue to the Sender and is deliberately used where we have a good relationship with the Sender and know they will act quickly on the alert. Steve Linford Chief Executive The Spamhaus Project
Five Norwegian startups selected to establish U.S. presence NEW YORK, Aug. 15, 2016 /PRNewswire/ — Tapad, the leader in cross-device marketing technology and now a part of Experian, has announced its new entrepreneurial mentorship initiative, the Propeller Program. Five early-stage startups from Norway have been chosen by Are Traasdahl, native of Norway and Tapad’s CEO and founder. The selected companies will share Tapad’s New York City workspace, receive C-level guidance and help establish a U.S. presence. The following companies have been selected to participate in the inaugural Propeller Program – a 12-month program beginning September 19, 2016: Bubbly – Developers of a platform that enables in-store customer feedback with dashboards and tools that facilitate real-time store response BylineMe – A marketplace for freelancers, publishers and brands to connect for content creation and distribution services Eventum – A property-sharing group that digitally assists in securing venues for meetings and corporate events Socius – A content provider for publishers to tell stories using social media Xeneta – A database that organizes the best contracted freight rates in real time and on demand “We are supporting startups that we feel represent the future of service offerings,” said Traasdahl. “It is with incredible pride that we invite these entrepreneurial teams from Norway to join us in New York Citythis year. Mentorship opportunities for early-stage companies are so important, particularly for those based outside the U.S. I look forward to giving the Propeller Program participants access to the expertise of my seasoned team and to our wide network of resources. Hopefully, it will be a game-changing year for many of them.” Contact us today!
As partnership deals mount, aggressive hiring underway for unified cross-screen technology leaders NEW YORK, July 19, 2016 /PRNewswire/ — Tapad, the leader in cross-device marketing technology and now a part of Experian, has announced plans for aggressive expansion in the Asia Pacific (APAC) region. This move capitalizes on Tapad's exceptional performance for brands and marketing technology companies in North America and Europe. With it's proprietary Tapad Device Graph™, the company will enable global, regional and local clients and partners to understand, monetize and measure marketing to users across screens. The Tapad Device Graph is recognized as the most accurate, scalable cross-screen solution in the market today. The decision to expand into APAC was based on increased demand from global, as well as local, brands and clients, many of which have a strong market presence throughout the region. In addition to expanding its roster of world-class data partners, plans include building a world-class team in Singapore. Over the next few months, Tapad APAC will also establish local entities in additional markets. To accelerate its ramp-up, Tapad APAC is actively recruiting in many areas, ranging from skilled and experienced solutions engineers to seasoned sales and marketing professionals. "Tapad is thrilled to be answering the call for cross-device excellence in APAC," said Pierre Martensson, GM of Tapad APAC. "Our Device Graph is adding millions of devices daily and achieves unmatched levels of scale and accuracy while protecting consumer privacy. This meets a critical need in the region." Tapad appointed Martensson as General Manager of Tapad APAC in May, kicking off expansion in the region. Martensson comes to Tapad with nearly a decade of operations experience throughout APAC, having transformed, developed and grown global organizations. To learn more about partnership and employment opportunities available with Tapad in APAC, visit www.experian.com/careers. Contact us today!