Reading visitor geo & device data with Data Enrichment
Country, device type, browser, whether the visitor is a bot or an AI: tags often need this context, but getting it usually means calling a third-party geo-IP API or parsing User-Agents inside GTM. Data Enrichment adds it as plain request headers on every hit, ready to read with a variable you already have.
What it adds
Once turned on, Data Enrichment adds these headers to every request reaching your server container.
Location (from the visitor's IP)
| Header | Example value |
|---|---|
X-GEO-Country | NL |
X-GEO-Region | North Holland |
X-GEO-City | Amsterdam |
X-GEO-PostalCode | Not available with the current location database |
The country goes along with every hit. Region and city only go along when the hit says the visitor allowed analytics (Consent Mode's analytics_storage), or when your site does not use Consent Mode.
Device (from the User-Agent)
| Header | Example value |
|---|---|
X-Device-Os | iOS 18.1 |
X-Device-Browser | Mobile Safari |
X-Device-Browser-Version | 18.1 |
X-Device-Engine | WebKit |
X-Device-Engine-Version | 605.1.15 |
X-Device-Model | Apple iPhone |
X-Device-Type | desktop, mobile, tablet or other |
X-Device-Mobile | true or false |
Bots and AI
| Header | Example value |
|---|---|
X-Device-Bot | true or false |
X-Device-Bot-Score | 100 says it is a bot, 90 known bot network, 80 fake or headless browser, 0 nothing found |
X-Device-Bot-Name | GPTBot |
X-Device-Bot-Category | AI crawlers |
X-User-AI | true or false |
X-User-AI-Name | OpenAI |
X-User-AI-Bot | ChatGPT-User |
X-User-AI-Type | agent (fetches a page for a person who asked) or crawler (collects pages for training or search) |
The verdicts come from the same bot rules as Measurebase's bot reporting and the Bot Protection power-up, so your container, your dashboard and the blocker always agree.
Ad blocker
| Header | Example value |
|---|---|
X-User-Adblocker | true or false |
Only with Enhanced Ad Blocker Protection on: its script checks for an ad blocker in the browser and passes the verdict along with each hit.
Reading headers in GTM
GTM's server container has a built-in Request Header variable type. Point one at, say, X-GEO-Country, and it is available to any tag or trigger like any other variable.
To report on a header in GA4, add it to your GA4 server tag as an event parameter and register that parameter as a custom dimension (event scope). The tracking audit checks this for you: when Data Enrichment is on and your GA4 tag forwards none of the headers, or none of the newer ones, it proposes a fix that creates the variables and adds the parameters to the tag.
Turning off what you don't need
Every header is on by default. If a signal does not apply to your setup, uncheck it on the domain's Data Enrichment page and save: fewer headers on the wire, same reliability for the ones you keep.
Bot detection here vs. the full picture
The bot headers judge a single request the moment it arrives, which is what a trigger needs. For the fuller picture (which bots, and how much of your traffic they are over time) see bot & crawler traffic detection, Measurebase's dedicated reporting for that.