Oblivious HTTP

HTTP is the foundation of communication for the World Wide Web. By default, HTTP exposes a website user's IP address to the operator of the website, which may enable the operator to gather a profile of information about the user. OHTTP is designed for simple transactions, such as sending web analytics information, rather than general-purpose web browsing. Most implementations of OHTTP involve an application, such as a mobile app, pre-configured to reach out to an OHTTP service for a particular type of transaction. OHTTP protects user privacy by combining message encryption and specially-designed proxy servers. First, the client uses hybrid public key encryption (HPKE) to encapsulate the content of a HTTP request. Since neither the relay nor gateway knows both the source IP address and the content of a request, the relay and gateway would need to collude to cross-correlate messages and de-anonymize them. The gateway and target server are typically operated by the same organization, while the relay is typically operated by a different organization to prevent collusion. Client applications configured to use OHTTP, such as applications designed to use OHTTP for certain API calls, do not need to try to find out whether OHTTP is available from a server. In other cases, if a server operator wants to tell clients that a service supports OHTTP, (February 2024) defines an optional DNS resource record parameter. This mechanism enables a client to discover, after sending a DNS request, that they can send OHTTP requests, although the initial DNS request could expose the client's IP address to the server if not otherwise hidden. == Deployments ==

Cloudflare released an OHTTP relay service in 2022, called Privacy Gateway. Google contracted with Fastly in 2023 to provide Google with an OHTTP relay to implement its experimental anonymous advertising technology. Specifically, Google used OHTTP to help ensure k-anonymity for its Privacy Sandbox initiative. Google also uses a Fastly OHTTP relay as part of its Google Safe Browsing service. Google offers a Safe Browsing Oblivious HTTP Gateway API that enables client applications, such as web browsers, to check whether a URL is on Google's list of unsafe websites without revealing the requester's IP address to Google. In 2023, Mozilla started using Fastly's OHTTP relay service as part of collecting Firefox performance metrics without collecting identifying information about individual users. As of 2024, Apple uses OHTTP in its Private Cloud Compute platform to conceal IP addresses associated with requests to Apple Intelligence tools. Apple published support for OHTTP for its Swift programming language in 2024. Apple said in 2025 that its Enhanced Visual Search uses OHTTP as part of its anonymization strategy. The Internet Security Research Group includes an OHTTP gateway in Divvi Up, a service that enables subscribers to collect software metrics from user devices while collecting minimal identifying information about users. As of 2025, Meta Platforms uses OHTTP in its "Private Processing" functionality for Meta AI tools, including to enable WhatsApp users to request summarization of messages without exposing the requester's IP address to Meta. This uses Fastly's OHTTP relay service. == Related technologies ==

An IETF working group, Oblivious HTTP Application Intermediation (OHAI), is responsible for working on OHTTP standards and collaborating with groups that work on related protocols. It can be used for web browsing. == See also ==