A referrer policy is a rule that tells a web browser how much of the current page's address to disclose when it requests something else: the full URL, only the site's origin, or nothing at all. The disclosed value travels in the HTTP Referer header and, for page loads and frames, is also readable by scripts through document.referrer. The mechanism exists because a URL often says more than its owner intends. Paths and query strings can carry search terms, account names, order numbers or one-time tokens, and before referrer policies existed, browsers sent most of that to every third party a page touched. Since August 2020, the default in Chrome has been to send the full URL within the same site but only the origin, such as https://example.com/, to anyone else.

How a referrer policy is applied

Whenever a browser follows a link, loads an image or script, fills an iframe or submits a form, it looks up the policy in force and computes a Referer value from the requesting document's address. The policy belongs to the site that sends the visitor, not the one receiving it, so a retailer analysing its traffic depends on choices made by every page linking to it.

Four places can set the policy, from broadest to narrowest:

  • The Referrer-Policy response header, sent by the server with a page, for example Referrer-Policy: strict-origin-when-cross-origin.
  • A meta element in the page's HTML: <meta name="referrer" content="origin">.
  • The referrerpolicy attribute on an individual a, area, img, iframe, script or link element.
  • The noreferrer link relation, written rel="noreferrer", which suppresses the header for that one link.

Narrower settings override broader ones. The header also accepts a comma-separated list, with the browser applying the last value it understands.

The specification defines eight values. They differ along two questions: is the destination the same origin as the page, and does the request move from encrypted HTTPS to unencrypted HTTP, which the specifications call a downgrade?

  • no-referrer: send nothing.
  • no-referrer-when-downgrade: send the full URL unless the request is a downgrade. This was the common browser default until 2020.
  • origin: send only the scheme, host and port, everywhere.
  • origin-when-cross-origin: full URL within the origin, origin only elsewhere.
  • same-origin: full URL within the origin, nothing elsewhere.
  • strict-origin: origin only, and nothing on a downgrade.
  • strict-origin-when-cross-origin: full URL within the origin, origin only to other HTTPS origins, nothing on a downgrade. This is the current default.
  • unsafe-url: always send the full URL, including to HTTP destinations.

An example shows the stakes. A reader on https://news.example/politics/story-123?utm_source=newsletter clicks a link to a retailer. Under unsafe-url or the old default, the retailer's logs and analytics see the whole string. Under today's default they see https://news.example/. Under no-referrer they see nothing, and most analytics tools will file the visit as direct traffic. Under RFC 9110, the Internet Engineering Task Force (IETF) HTTP standard of June 2022, the fragment after a "#" is never sent.

Where it sits in advertising and analytics

Referrer data feeds three systems marketers rely on. Web analytics tools such as Google Analytics 4 (GA4), Adobe Analytics and Microsoft Clarity read document.referrer on the landing page and combine it with Urchin Tracking Module (UTM) parameters to assign each session to a channel. An origin-only referrer is enough to say "organic search" or "referral from news.example", but not which article or which search query produced the click. Google stopped passing search keywords for signed-in users when it moved to encrypted search on October 18, 2011, the origin of "(not provided)".

Server logs record the Referer header for every request, including those blocked from running JavaScript. Chrome's own announcement of the default change warned that "server-side logging or analytics that rely on the full referrer URL being available are likely to be impacted by reduced granularity."

Programmatic advertising uses page context. The OpenRTB bid request, the message a supply-side platform (SSP) sends to bidders, has site.page and site.ref fields for the page URL and its referrer. An ad tag inside a cross-origin iframe sees only the publisher's origin through document.referrer under the default, so header bidding wrappers read the URL from the publisher's page and pass it on, which brand safety and contextual vendors depend on.

Origin and evolution

The Referer header predates the policy by two decades. It was defined, misspelling included, in HTTP/1.0, published as RFC 1945 in May 1996. The standards always acknowledged the privacy problem: RFC 9110 says a browser "SHOULD NOT" send the header from a secure page to a different origin "unless the referring resource explicitly allows Referer to be sent", and lets browsers truncate everything but the origin.

In the early 2010s, browsers experimented with a meta tag using keywords such as "never", "always" and "origin". The World Wide Web Consortium's (W3C) Web Application Security Working Group formalised the idea as the Referrer Policy specification, which reached Candidate Recommendation on January 26, 2017. Browser support for the response header arrived around the same time: Firefox 50 in November 2016, Chrome 56 in January 2017 and Safari 11.1 in March 2018, according to MDN's compatibility data.

The decisive change was the default. Apple's Intelligent Tracking Prevention (ITP) began trimming document.referrer to the origin for domains classified as trackers with ITP 2.3 in September 2019, and in December 2019 Safari 13.0.4 extended its referrer restrictions to all third parties. The Fetch standard, which governs how browsers make requests, changed its default to strict-origin-when-cross-origin in November 2020. Chrome had already moved: a July 30, 2020 post by Google's Maud Nalpas announced the switch for Chrome 85, rolling out to stable in August 2020, as part of what Google then called the Privacy Sandbox. Firefox adopted the same default in version 87 in March 2021, and MDN lists Safari 15 as matching it.

Browsers then began overriding sites. Since Firefox 93 in October 2021, users in Strict tracking protection or Private Browsing have had the looser policies no-referrer-when-downgrade, origin-when-cross-origin and unsafe-url ignored for cross-site requests, according to Google's web.dev guidance. Safari, according to the same guidance, "may cap" cross-site referrers regardless of policy.

Why it matters for marketers

The practical consequence is attribution. Clicks that lose their referrer become direct traffic, a channel that already absorbs app clicks, typed addresses and bookmarks. When Google launched AI Mode in the US in May 2025, its links carried noreferrer attributes, so visits showed up as direct or unknown until Google called it a bug on May 23, 2025. GA4's AI Assistant channel, added on May 13, 2026, identifies sessions by referrer, so it only works when the assistant's referrer survives. UTM parameters became the standard repair, which is why OpenAI began adding UTM tags to more ChatGPT links in June 2025.

Privacy is the second consequence. The default limits what a page leaks passively through headers, but it does nothing about what scripts on the page choose to send. An IMDEA Networks study reported in October 2026 found six of nine AI chatbots passing conversation titles or links to third parties through ordinary tracking tags, the kind of disclosure a referrer policy cannot stop.

Limitations and disputes

The policy governs one header and one DOM property. Any script on a page can read location.href and send the full URL as a parameter, as many tracking pixels do. Research presented at the 2025 Privacy Enhancing Technologies Symposium (PETS) by Radboud University researchers, titled "Referrer Policy: Implementation and Circumvention", examined how third parties work around the restrictions.

Consistency is a second weakness. One link can yield a full URL, an origin or nothing depending on browser, privacy mode and in-app webview. Chrome honours a site's explicit unsafe-url; Firefox in strict mode and Safari do not. Native apps often send no referrer at all. A browser change can look like a shift in behaviour.

Third, the trimming has costs. Businesses that used full referrers for affiliate reconciliation, partner reporting or fraud checks lost those signals in 2020 and 2021. Security teams often prefer no-referrer, while marketing teams wanting referral credit from outbound links prefer origin-level disclosure, and the choice often falls to whoever configures the web server.

  • Referer header. The data itself: the URL the browser actually sends. The policy is the rule that decides what goes in it.
  • noopener. A link relation that prevents a page opened in a new tab from controlling the page that opened it. It affects security, not the referrer. noreferrer implies noopener, but not the reverse.
  • Referral exclusion. An analytics setting, called "unwanted referrals" in GA4, that tells the tool to ignore certain referrers, such as payment gateways, when assigning channels. It changes reporting, not what browsers send.
  • Link Tracking Protection. Apple's Safari feature that strips known click identifiers such as Google's gclid from URLs. It alters the destination address, while referrer policy alters what is said about the departure page.

Recent developments

Browser makers have moved beyond trimming headers to cutting off the scripts that read URLs. Safari 27, rolling out from September 14, 2026, placed LinkedIn's and Bing's tags on its fingerprinting list, restricting their access to referrers and URL parameters and matching them by IP address. A year earlier, Safari 26 turned on Advanced Fingerprinting Protection by default. Google retired most Privacy Sandbox technologies on October 17, 2025, leaving the 2020 referrer default among the programme's lasting changes. As of November 2026, the default policy across Chrome, Edge, Firefox and Safari is strict-origin-when-cross-origin, and the remaining argument is how far browsers should go in overriding sites that ask for more.

Timeline

  • May 1996 - RFC 1945 defines the Referer header in HTTP/1.0, misspelling included.
  • October 18, 2011 - Google moves signed-in searches to HTTPS, removing keywords from referrers ("not provided").
  • November 2016 - Firefox 50 supports the Referrer-Policy header.
  • January 2017 - Chrome 56 supports the header.
  • January 26, 2017 - W3C Referrer Policy specification reaches Candidate Recommendation.
  • March 2018 - Safari 11.1 supports the header.
  • September 2019 - ITP 2.3 trims document.referrer for classified tracker domains in Safari.
  • December 2019 - Safari 13.0.4 extends referrer restrictions to all third parties.
  • July 30, 2020 - Google announces strict-origin-when-cross-origin as Chrome's default.
  • August 2020 - Chrome 85 ships the new default to stable.
  • November 2020 - The Fetch standard adopts strict-origin-when-cross-origin as its default.
  • March 2021 - Firefox 87 adopts the same default.
  • October 2021 - Firefox 93 ignores loose policies cross-site in strict mode and Private Browsing.
  • June 2022 - RFC 9110 restates the Referer rules for HTTP.
  • May 23, 2025 - Google calls AI Mode's referrer stripping a bug.
  • October 17, 2025 - Google retires most Privacy Sandbox technologies.
  • May 13, 2026 - GA4 adds a referrer-based AI Assistant channel.
  • September 14, 2026 - Safari 27 rolls out, restricting LinkedIn and Bing tags' access to referrers.
  • October 2026 - IMDEA study finds chatbots passing chat titles or links to trackers.

Summary

Who: Browser makers (Google, Mozilla, Apple, Microsoft) set defaults; the W3C and WHATWG maintain the specifications; website owners choose explicit policies; analytics vendors, ad tech firms and marketers receive the resulting data.

What: A rule controlling how much of a page's URL a browser discloses in the Referer header and document.referrer, with eight possible values ranging from the full URL to nothing.

When: The Referer header dates from 1996; the W3C specification reached Candidate Recommendation on January 26, 2017; Chrome made strict-origin-when-cross-origin the default in August 2020, with Firefox following in March 2021.

Where: In every browser request, set by the referring site through an HTTP header, a meta tag, an element attribute or a noreferrer link.

Why: Full URLs leak search terms, identifiers and tokens to third parties. Limiting them protects users, but at the cost of attribution detail, which pushes unlabelled clicks into direct traffic and makes UTM tagging and first-party measurement more important.