Automated Ad Traffic: A Map of the Bots and Scripts That Touch Your Ads

Automated ad traffic is any interaction with an ad, or with the page an ad leads to, that is generated by software rather than by a person acting in the moment. Some of it is legitimate and even necessary, such as the crawlers ad platforms use to check landing pages; some of it is fraud, such as click bots and malware that fake impressions and clicks.

The difficulty for advertisers is that both kinds can turn up in the same logs and reports, and the vocabulary around them is muddled. “Ad click automation” can mean a bidding strategy or a fraud tool, and “non-human ad traffic” can mean a search crawler or a botnet. This guide lays out a map: the industry’s distinction between general and sophisticated invalid traffic, the benign automation you should expect, the malicious automation explained at a conceptual level, how each type tends to show up in your data, and what you can realistically do about it.

What counts as automated ad traffic

It helps to picture automated ad traffic as a spectrum. At one end is software that announces itself and does a useful job, such as an ad platform’s crawler checking a landing page. At the other end is software that hides what it is and exists to make someone money at an advertiser’s expense. Most of the confusion comes from treating the whole spectrum as one thing.

Two clarifications prevent a lot of misreading:

• Automated is not the same as fraudulent. The Media Rating Council (MRC), which sets measurement standards for the advertising industry, defines invalid traffic as traffic that does not meet certain quality or completeness criteria, or otherwise does not represent legitimate traffic that should be included in measurement counts. Non-human traffic from spiders and bots is one of the reasons it gives. A well-behaved crawler is therefore “invalid” for counting purposes, because it is not an audience, without being malicious.
• Invalid is not the same as automated. Google’s own examples of invalid traffic include accidental clicks, competitors clicking by hand and publishers paying users to click. The MRC standard likewise notes that invalid traffic can include illegitimate human activity, which is one reason it does not consider it appropriate to label filtered traffic as “human.” Human click schemes are covered in our explainer on what an ads clicker is.

The industry taxonomy: general and sophisticated invalid traffic

The most widely used framework comes from the MRC’s Invalid Traffic Detection and Filtration Standards Addendum, updated in June 2020. It sorts invalid traffic into two categories based mainly on how hard it is to identify. Google notes that the MRC accredits Google’s invalid traffic defenses for specific services and metrics, so the framework is directly relevant to Google Ads, not just to third-party measurement.

General invalid traffic (GIVT) is traffic identified through routine filtering, using lists or other standardized parameter checks. The standard’s examples include known invalid data-center traffic, bots, spiders and other crawlers, non-browser user agents, prefetched or browser pre-rendered traffic, ads delivered in invisible or illogical sizes such as 0x0 or 1x1, and sessions that cannot render images at all.

Sophisticated invalid traffic (SIVT) consists of situations that are harder to detect and require advanced analytics, multi-point corroboration or significant human intervention. Examples in the standard include automated browsing from dedicated devices, automated browsing from infected and hijacked devices, incentivized human activity, manipulated activity such as clickjacking, falsified measurement events, misrepresented domains and apps, bots masquerading as legitimate users, hidden or stacked ads, adware and malware that inject ads, and cookie stuffing.

The boundary is not fixed. The MRC expects that items now classed as sophisticated may be re-categorized as general over time, once industry bodies turn them into standardized lists and criteria.

Benign automation that touches ads

Ad-quality crawlers such as AdsBot

Google runs crawlers that fetch the web pages ads lead to. According to Google’s documentation, crawling preferences for AdsBot affect Google Ads’ ability to check web page ad quality, and AdsBot ignores the global user-agent group in a site’s robots.txt file, with the ad publisher’s permission, so robots.txt rules only apply to it when they name it explicitly. The same page describes a separate crawler, Mediapartners-Google, that visits sites participating in Google’s publisher ad products in order to provide them with relevant ads. These are page fetches, not ad clicks, and in server logs they appear as declared Google user agents requesting your pages.

Search crawlers, link previews and security scanners

Beyond ad platforms, plenty of software fetches pages that ads point to. Search engines crawl them. Messaging apps and social networks fetch a link to build a preview card when someone shares it. Email and corporate security systems often open links to check them for threats. Uptime monitors and SEO tools request pages on a schedule. Many of these fetch a page without running its analytics scripts, so they show up in server logs far more often than in analytics, but some render pages fully and can leak into reports.

Prefetching and pre-rendering

Browsers and apps sometimes load a page or its resources before a person asks for it, to make navigation feel instant. The MRC lists prefetched or pre-rendered traffic as general invalid traffic where the associated ads were not subsequently accessed by a valid user, and notes that updated industry guidelines require an ad to have loaded and begun to render before an impression is counted. Prefetching is not malicious, but it is not an audience either.

Verification, measurement and testing tools

Ad verification and brand-safety services scan pages to classify content and check where ads appear. Advertisers, agencies and publishers also test tags and pages themselves. The MRC standard encourages reporting known and declared bots that are present with the publisher’s permission, for example for measurement or brand safety, as a separate subset of general invalid traffic so that they are not confused with harmful activity. It also expects internal activity such as software and tag testing to be kept apart from production data.

The common thread is that benign automation should be filtered out of audience counts, not fought. Blocking it indiscriminately can break services you rely on.

“Ad click automation”: two very different meanings

The phrase “ad click automation” is used for two activities that have nothing in common.

The first is automating campaign management. Google Ads offers automated bidding, and Smart Bidding refers to bid strategies that use Google AI to optimize for conversions or conversion value in each auction. Rules, scripts and bid strategies of this kind act on your account settings. They are legitimate and widely used.

The second is automating the clicks themselves: software that clicks ads while pretending to be people. That is click fraud, described in the next section.

When a product or service advertises “ad click automation,” ask one question: does it act on your account, or on the ads? The answer separates a campaign management tool from a fraud tool. There is also a link between the two meanings. Smart Bidding requires conversion tracking and optimizes toward the conversions it records, so malicious automation that pollutes clicks and conversions can quietly degrade the legitimate automation you depend on.

Malicious automation, explained conceptually

Click bots

Click bots are programs that click ads while posing as ordinary visitors. Google lists non-human traffic, generated by bots and automated software to mimic how humans browse, as its first example of invalid traffic. Our guide to how ads clicker bots work and why they get caught covers their motives, risks and detection in depth.

Botnets and malware on real devices

Some automation does not run on servers at all but on the computers and phones of people who have no idea it is there. The MRC’s sophisticated category explicitly includes automated browsing from infected and hijacked devices, and adware and malware that carry out deceptive actions such as ad injection and unauthorized overlays. Because the traffic comes from real devices on ordinary home and mobile connections, it is much harder to separate from genuine activity than traffic from a data center.

Click injection and install fraud in mobile apps

App-install campaigns create a particular opening. Where an install is credited to the ad click that preceded it, a fraudulent click reported at just the right moment can claim credit for an install that would have happened anyway. The MRC standard requires valid app installs to be tied to valid impressions and clicks, and notes that short, illogical durations between click and install, or no use and quick removal after install, may signal invalid activity. Our guide to mobile ad traffic looks at in-app quality issues more broadly.

Impression fraud: hidden and stacked ads

Not all fraud involves clicks. Google describes ad stacking, where a publisher layers multiple ads so only the top ad is visible, and clickjacking, which tricks people into clicking an invisible ad. The MRC adds other forms of hidden, covered or transparent ad serving to its sophisticated category. Advertisers paying for impressions may end up paying for ads nobody could see, and clickjacking turns real people’s unintended taps into apparent interest.

Data-center traffic posing as an audience

Traffic from cloud and hosting providers is not automatically invalid, since legitimate users can route through such networks, but sources known to consistently produce invalid traffic are a standard filtering target. The MRC lists known invalid data-center traffic among its general categories, while explicitly excluding routing artifacts of legitimate users.

How each type shows up in your data

Different kinds of automation leave different footprints, and some leave almost none in the reports advertisers usually read. Google Analytics, for instance, automatically excludes traffic from known bots and spiders, identified through Google research and the International Spiders and Bots List maintained by the Interactive Advertising Bureau; you cannot turn that exclusion off or see how much was excluded. On the ad side, Google says its real-time filters catch activity associated with, for example, a denylisted user agent or IP address before it is ever charged.

To work through these footprints on your own site, our guide to bot traffic detection in analytics and server logs explains the signals and how to avoid false positives. For an ongoing view of quality by campaign, device, location and placement, see our method for ad traffic analysis.

What advertisers can do

You do not need to classify every automated request to protect a budget. A short routine covers most of the ground:

1. Watch Google’s invalid traffic reporting. Add the Invalid clicks column and check billing for “Invalid activity” credits. Our guide to Google Ads invalid clicks explains both.
2. Leave legitimate crawlers alone. Blocking AdsBot interferes with Google Ads’ ability to check the ad quality of your pages, so verify requests that claim to come from crawlers instead of blocking them wholesale.
3. Separate testing from production. Keep internal tests, tag checks and monitoring out of the data you use to judge campaigns, or label them clearly.
4. Review quality by segment. Look at engagement and conversions by network, placement, device and hour, so that automation concentrated in one segment stands out.
5. Protect lead forms. Google points out that its filters run after an ad serves and cannot stop invalid traffic from reaching your site, and it recommends reCAPTCHA and server-side validation for lead forms.
6. Use exclusions and settings deliberately. Placement and app exclusions, network choices and targeting settings reduce exposure; our guide to invalid click protection covers the options and their limits.
7. Keep a sense of proportion. Google notes that there is no industry standard for a “normal” invalid traffic rate, and most weak performance has ordinary causes such as targeting, offer or landing-page problems. Treat automation as one hypothesis among several.

Key takeaways

• Automated ad traffic spans everything from Google’s own ad-quality crawler to malware on hijacked devices, and treating it as one category leads to bad decisions.
• The MRC standard splits invalid traffic into general (caught by lists and routine checks) and sophisticated (requiring advanced analysis), and Google’s defenses are accredited by the MRC for specific services and metrics.
• “Ad click automation” can mean legitimate bid automation or fraudulent click generation; ask whether a tool acts on your account or on the ads.
• Benign automation such as crawlers, previews and prefetching should be filtered from measurement, not blocked indiscriminately.
• Advertisers protect themselves best by monitoring invalid-click data, reviewing quality by segment, protecting forms and keeping test traffic separate.