Two OpenAI engineers have proposed letting AI agents hand websites a slice of their user’s identity, and Joost de Valk, writing on his blog joost.blog, argues the design fails the user it claims to serve. The authors circulated an Internet-Draft to the IETF’s HTTP Working Group on November 11. It is an individual draft that has not been formally submitted, and no working group has adopted it, so it is a proposal from two engineers and not OpenAI policy.
The mechanism is small. Six optional parameters ride on the Forwarded header, which normally describes hops in a proxy chain: tz, locale, user-agent, asn, ip-prefix and ip-country. Together they tell a site the user’s network, country, a masked version of their IP address, their time zone, their locale and the browser or app they used. De Valk credits the authors on a few points. Persistent identifiers for users and devices are forbidden, senders are urged to disclose the minimum, and the text concedes that a masked address still identifies someone.
Today, a site visited by an agent sees the agent’s address and user agent, and almost nothing about the person behind it. De Valk calls that an accident of design rather than a feature, but a privacy gain all the same.
The draft says the signals serve “fraud detection and risk assessment”. De Valk reads the purpose differently. Sites challenge agent traffic because so many different users appear to come from a handful of cloud addresses, and the new signals would make an agent look like an ordinary visitor again. That need is legitimate, but the company operating the agent gains the most and decides what is shared. The user is never asked. The site cannot ask either. Client Hints, the existing mechanism in which a server lists the details it wants, solved that years ago.
Trust is the second flaw. Anyone can send these parameters. The draft warns sites against believing a signal unless a verified signature covers it, yet it also says outright that senders need not sign. De Valk’s objection is blunt: once a respectable-looking home network in the header lets a request slip through, fraudsters will all copy it. He wants signatures made mandatory through Web Bot Auth and unsigned signals ignored.
A legal layer sits on top, and de Valk flags that he is not a lawyer. In his reading, the combination of network, IP prefix, time zone, locale and browser is personal data, which makes the agent’s operator the party disclosing it to a third party. Because the browser, language and clock settings come from the user’s own device, the ePrivacy rules apply as well. The signals also leak each other: Europe/Amsterdam paired with nl-NL tells a site the country even when the agent withholds it.
Two of the six already have homes. An agent sets its own headers, so language can travel in Accept-Language, and a tag such as en-NL already means English formatted the Dutch way. For time zone, the Prefer header fits, and MDN’s own sample for a custom preference is a timezone value naming Los Angeles. What remains of locale, de Valk says, is a description of device setup, which is a fingerprint and not a preference.
Caching adds a practical problem the draft never mentions. Suppose a New Yorker puts a question to an agent, and you put the same one an hour later. You may receive the copy built for New York. A site could defend itself with Vary: Forwarded, but that header bundles everything, so nearly each request turns unique and cached agent responses lose their value. De Valk concedes that fraud checks run on logins, payments and orders, which are never cached. He treats that as proof the network signals do not belong on ordinary page fetches.
His counterproposal splits the draft in two. The first half registers a time zone preference for Prefer and perhaps tells agents to forward language in Accept-Language, which he calls small and hard to object to. The second half, covering network signals, would apply only to requests with a genuine fraud question, require signatures, cap how precise the IP prefix can be, and follow the Client Hints model where the site asks first. Then the agent would pause and ask the user whether to share their country with this shop before payment.
The commercial stake sits underneath the privacy argument. If agents can pass as normal visitors, sites lose the cheap signal they use to separate bots from people, and the party that wins the argument over who vouches for an agent will shape how much of the web stays open to them. The first agent vendor to ship a per-site consent prompt would hold the privacy position that OpenAI’s draft leaves vacant.
Joost de Valk, joost.blog, published November 11, 2026.
