At a location where 3G/4G Data is prohibited, would it be practically possible to extract user agent strings from 3G/4G Data and compared to a list of known mobile browsers, assuming that the correct equipment is used to capture the data, and the necessary licences have been obtained?
Mobile carriers have limited capabilities of performing mass deep packet inspection on their infrastructure. One proof is the lack of incentive for many carriers to detect DNS tunneling through their mobile networks (DNS traffic is not being charged).
This document presents an overview of 3G and 4G mobile services and methods supporting the lawful interception of targets subscribing to these services: http://www.aqsacom.com/resources/pdf/LI-3G-4G-AQSA_WP_2012_01.pdf
These interception systems cover a wide range of services and technologies, including wire-line voice, wireless voice, wired and wireless data, and emerging services such as VOIP. Deep packet inspection can be performed during these intercepts and data such as user agent strings can be extracted.