Data & identity · also called User-Agent string, UA
User agent
A user agent is the text string a browser or app sends with each request describing its browser, version, operating system and device, used for compatibility, analytics and fraud detection.
When your browser requests a page or an ad, it sends a User-Agent header, a line of text like "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 ...) Safari". Sites and ad servers use it to serve the right format, report device and browser statistics, and target by device or OS.
In fraud detection, user agents matter in two ways. Declared bots and crawlers identify themselves there, which is how the IAB/ABC Spiders & Bots List catches GIVT; non-browser or malformed user agents are also GIVT. And because the string is easy to fake, disguised bots copy popular browsers, so detection compares the claimed user agent with how the device actually behaves, as in device fingerprinting and device spoofing checks.
User-agent strings also leaked detailed information useful for tracking. To reduce this, Chrome froze and reduced its user-agent string in 2022 and 2023, moving detailed information to User-Agent Client Hints, which sites must request. In SSAI, the viewer's user agent must be forwarded by the server, making consistency checks important.
Think of it like this
A user agent is like the name tag a visitor writes for themselves at reception: useful, but anyone can write anything on it.
An example
A publisher finds 50,000 requests a day with a user agent claiming to be Chrome 90 on Windows XP, a combination that does not exist in real life, and filters them as invalid.
Related terms
User-Agent Client Hints
User-Agent Client Hints are a web standard, championed by Chrome, where browsers share only basic details by default and send detailed device and browser information only when a site asks.
IAB/ABC Spiders & Bots List
The IAB/ABC International Spiders & Bots List is an industry-maintained list of known crawler and bot user agents, plus valid browser patterns, used to filter general invalid traffic from ad measurement.
GIVT (general invalid traffic)
GIVT (general invalid traffic) is invalid traffic that can be identified with routine, list-based or parameter-based filtration, such as known crawlers, data-center traffic and non-browser user agents.
Device spoofing
Device spoofing is faking the identity or type of device requesting an ad, such as a server posing as a smart TV or iPhone, to earn higher prices or dodge detection.
Device fingerprinting
Device fingerprinting is identifying or characterising a device from the combination of its technical attributes, such as browser, fonts, screen, graphics and network traits, instead of a stored cookie or ID.
Sources: MDN: User-Agent header, IAB Tech Lab / ABC International Spiders & Bots List, MRC Invalid Traffic Detection and Filtration Guidelines Addendum (2020 update)