A rigorously pessimistic look at the ecosystem of fake traffic, fantasy analytics, and the collective delusion holding the digital economy together.
March 2026 · ~2,400 words · Estimated real human readers: unknowable
The Numbers
Let’s start with the headline, because it deserves a moment of quiet contemplation before we start laughing or crying — possibly both simultaneously.
According to Imperva’s 2025 Bad Bot Report, which analyzed data across thousands of domains and blocked 13 trillion bad bot requests in 2024 alone, bots now account for 51% of all global internet traffic. This is the first time in a decade that automated traffic has outnumbered human traffic. You, the human sitting there reading this, are now the minority on the network you built.
51% of all global internet traffic in 2024 was non-human. You have been outvoted by scripts.
Of that 51%, about 14 percentage points are “good” bots — search engine crawlers, uptime monitors, and other legitimate automation. The remaining 37% are bad bots: programs explicitly designed to scrape your content, steal your users’ passwords, fake your ad clicks, and generally make a mockery of the concept of “web analytics.” That 37% figure is up from 32% in 2023 — the sixth consecutive year of growth.
Arkose Labs, another cybersecurity firm with a different methodology, puts the bad bot share even higher: 73% of all internet traffic in the technology sector alone. Retail fares almost as badly, with bots responsible for 65% of e-commerce traffic. Social media platforms sit at around 46%. Even the financial services sector — one of the most regulated industries on earth — reports that 45% of its web traffic is automated and malicious.
The internet, in other words, is largely a conversation between machines — most of them up to no good.
The Bot Economy
You might wonder who is running all these bots, and why. The answer is: everyone, for everything.
Competitors scrape your pricing data in real time so they can undercut you by a dollar. Scalper bots hoover up concert tickets in milliseconds and relist them at ten times the price. Travel bots hold phantom airline seats, inflating prices, then abandon the booking at the last second — a tactic that skews seat pricing algorithms and costs carriers real money. Credential-stuffing bots take username-and-password combinations leaked in one data breach and try them across hundreds of other sites, because humans are optimistic about password reuse.
Then there is the growth of Bots-as-a-Service — BaaS, a genuine industry acronym that nobody in Silicon Valley seems to find troubling. Criminal entrepreneurs now offer subscription plans for renting bot armies, complete with customer support, presumably. Need to flood a competitor’s checkout flow? There is a package for that. Want to generate fake engagement on your startup’s product page before a funding round? Rates vary.
The democratization of generative AI has made this substantially worse. Large language models have reduced the technical barrier to building convincing bots from “junior software engineer” to “motivated teenager with an API key.” Advanced bots now mimic mouse movements, solve CAPTCHAs, rotate through residential IP addresses to appear geographically legitimate, and impersonate Chrome browsers so convincingly that Chrome itself cannot always tell the difference. Chrome, by the way, is the most-impersonated browser by bots — accounting for 46% of bot-attributed web requests.
2,000,000+AI-powered attacks blocked by Imperva every single day in 2024.
The Money Burning Quietly in the Corner
Now let us discuss the actual financial hemorrhage this creates, because the numbers here are where cynicism starts feeling like realism.
Digital advertising fraud cost somewhere between $37.7 billion and $140 billion in 2024, depending on which firm’s methodology you trust and how expansively you define “fraud.” The range tells its own story: even the people whose job it is to measure this cannot agree on the order of magnitude. Conservative estimates from Spider Labs put losses at $37.7 billion. Anura’s calculations, which include indirect losses, arrive at $140 billion. Statista projects these losses will reach $172 billion by 2028.
What all these firms agree on is the mechanism: bots click on ads. Publishers get paid for the clicks. Advertisers pay for engagement that never converted because no human ever saw the ad. Estimates suggest that 14% of all clicks on paid search advertisements come from non-genuine sources. For small businesses, roughly 30% of their entire ad spend is wasted on fraudulent clicks.
Advertisers pay for clicks. Bots provide clicks. Humans buy nothing. Everyone’s metrics look great.
The beauty of ad fraud, from a certain morally flexible perspective, is that it is structurally very difficult for anyone in the supply chain to have a strong incentive to fix it. Publishers get paid for impressions and clicks, real or fake. Ad networks skim a margin on volume. Agencies report impressive click-through rates to clients. Only the advertiser is losing money — and they are usually measuring success using the same compromised analytics that cannot distinguish a bot from a customer.
Your Analytics Dashboard Is an Emotional Support Tool
Which brings us to Google Analytics, the instrument of choice for approximately 86% of websites that use any analytics at all, and one of the most quietly unreliable numbers-generators in corporate history.
Google Analytics does not give you your website’s actual traffic. For sites with meaningful volume, it uses data sampling — analyzing a subset of your sessions and extrapolating the rest. Google’s own documentation states that standard Analytics sampling kicks in at 500,000 sessions for any given date range query. If your site had 5 million pageviews last year, only 500,000 of those sessions are analyzed with precision. The data for the remaining 4.5 million — 90% of your traffic — is a statistical inference.
Would you like unsampled data? Google Analytics 360 is available for approximately $150,000 per year. Enjoy.
20.3%of website traffic data is missing from Google Analytics for sites using cookie consent banners (Orbit Media study).
But the sampling problem is arguably not even the biggest issue. There is also the matter of what Google Analytics is failing to count at all. A study by Orbit Media comparing GA4 against a cookieless analytics tool found that even websites without cookie consent banners are missing an average of 11.2% of their traffic data. Sites that do use consent banners — which are legally required in the EU and California — are missing an average of 20.3%. Since approximately 500 million people live in jurisdictions where consent banners are required, a meaningful chunk of your European and Californian audience is essentially invisible to Google Analytics.
Meanwhile, bots that Google has not catalogued in its IAB/ABC exclusion list — which is a paid list, incidentally — pass through GA’s filters and inflate your numbers from the other direction. You are simultaneously undercounting real humans and overcounting fake ones. The net result is a dashboard number that represents neither your actual audience nor your actual bot traffic with any fidelity.
GA4 has added further complications. Its session-attribution model has a documented tendency to over-represent Google paid traffic. If a visitor first clicks a Google ad and then immediately selects an organic search result, GA4 attributes the entire session to paid search. Attribution data can also shift for up to 12 days after the initial visit. You may make a strategic decision based on Monday’s data, only to find that by Wednesday the data has quietly changed its mind.
The number that goes up in your analytics dashboard may not correspond to any reality. But it went up. Congratulations.
The Peculiar Psychology of Vanity Metrics
Here is where things get philosophically interesting.
Website owners largely know that their traffic numbers are not clean. The conversation about bots and analytics inaccuracy is not new or esoteric — it is a standard topic in digital marketing circles. And yet the behavior of most website owners, when their GA dashboard shows an uptick, is not epistemically cautious investigation. It is dopamine.
A website owner who discovers that their unique visitors are up 23% month-over-month rarely leads with “but how much of this is bot traffic, and how much is the GA sampling rate masking real decline in specific segments?” They lead with “the numbers are up.” The number went up. Something must have worked. Post a LinkedIn update. Put it in the quarterly deck.
If the number goes up, the meeting goes well. What the number represents is a philosophical question for another quarter.
This is not stupidity. It is a rational response to incentive structures. Marketing teams are evaluated on traffic growth. Investors ask about monthly active users. Advertisers pay for eyeballs. In each case, the metric that gets rewarded is the one that looks good, not the one that is most accurate. The ecosystem has evolved to produce impressive numbers, and it has gotten very good at that specific task.
Fortune magazine noted in 2025 that bot-inflated vanity metrics are increasingly distorting venture capital investment decisions — with startups showcasing raw user sign-ups or app downloads that are rarely audited independently, and investors relying on these figures to assess company valuations. The AI investment boom, that same piece observed, is being built partly on a foundation of traffic metrics that include an unknowable proportion of non-human activity.
This creates a wonderfully recursive problem: we are using AI to generate more bot traffic, which inflates the metrics that justify further AI investment, which produces more capable bots, which generate more traffic. The ouroboros, but for shareholder value.
The Measurement Problem
The savvier reader may at this point note a certain irony: every statistic in this article has been produced by firms that sell bot-detection and analytics products. Imperva sells DDoS protection and bot mitigation. Arkose Labs sells CAPTCHA and fraud prevention. Anura sells invalid traffic detection. These companies have a modest financial interest in the world believing that bot traffic is large and terrifying.
This does not mean their numbers are wrong. It means their numbers should be held with the same calibrated skepticism we are applying to everyone else’s traffic data. The firms measuring the fake traffic are not, themselves, entirely free of incentive to make the fake traffic seem maximally alarming.
We are, in other words, estimating the size of the problem using methodologies we cannot fully audit, provided by parties with skin in the game, about behavior specifically designed to evade detection. The actual percentage of fake internet traffic is — and this is the epistemically honest position — genuinely unknowable. The real number is somewhere between “a lot” and “almost everything, depending on the sector and time of day.”
Google, for its part, does not tell you. The company’s bot exclusion filter silently removes traffic that matches known bot signatures without surfacing how much was removed or by what criteria. Your real-time report shows 47 active users. Some of them are your actual customers. Some of them are scrapers. Google has an opinion about how many of each, and that opinion is embedded in your data without a footnote.
A Modest Proposal
There is no tidy solution to offer here, which is itself a data point worth noting. The industry has been aware of the bot problem for over a decade. The BOTS Act was passed in 2016. The FTC issued rules on fake AI-generated reviews in 2024. Cybersecurity firms have blocked trillions of bot requests. Bad bot traffic has grown every year anyway.
The trajectory is toward more bots, not fewer. AI has made bot creation cheap and accessible. The financial incentives to generate fake traffic remain intact throughout the advertising supply chain. Privacy regulations are making accurate human traffic measurement harder. And the analytics tools most people use are, by design or limitation, not built to tell you the uncomfortable truth about your numbers.
The most honest thing a website owner can do is treat their analytics as directional rather than absolute — a rough instrument for detecting trends, not a precise count of real human engagement. The second most honest thing is to acknowledge that the metric that makes the quarterly presentation look good is probably not the metric that reflects business reality.
The least honest thing — but, statistically speaking, the most common — is to see the number go up and simply feel better.
The internet is real. The traffic is complicated. The dashboard is a story you tell yourself.
Sources: Imperva 2025 Bad Bot Report (Thales Group) · Arkose Labs 2024 Bot Traffic Analysis · Orbit Media GA4 Accuracy Study · Anura Ad Fraud Statistics 2024 · Spider Labs Ad Fraud White Paper 2025 · Statista Digital Advertising Fraud Projections · Fortune, July 2025 · Matomo / Plausible Analytics accuracy comparisons · Google Analytics documentation on data sampling
• Amazon’s Competitive Moat Gets Deeper and Wider
• Thankfulness… The Mayflower Story
• Another Hurricane Looms: Gulf Coast Faces Fresh Threat Amid Ongoing Storm Destruction
• Office Depot Sells Florida Headquarters
• Tampa Digital Marketing with Florida Website Marketing
About the Author
Brian French is the CEO of Florida Website Marketing and Florida AI Agency. For over 15 years, Brian served as an Internet Marketing Professional for BoardroomPR, one of Florida’s largest public relations firms. He is a specialist in local SEO, AEO, and AI-driven marketing strategies tailored for the Florida business landscape. Connect with Brian on LinkedIn Visit his websites FloridaWebsiteMarketing.com and FloridaAIAgency.com or text him at 813 409-4683 for a consultation.
About the Author
