Technical Brief

Bot Detection Logic — Specification

Learn about the five areas of detection evidence and safeguards against mistaken exclusions.

Last updated: September 29, 2026

1. Design philosophy

User-Agent, IP and rendering attributes can be shared or spoofed. A single attribute does not independently authorize excluding a real reader from advertising.

Browser consistency, automation records, interaction timing, network context and visit history are combined. Unavailable data stays missing; evidence confirming Bot is separate from evidence supporting Human.

Verdict reasons and observation limits are disclosed. Validated internal rules are not customer-adjustable, and a numeric score alone determines neither the final classification nor advertising action.

2. Five areas of detection observations

Browser integrity, automation traces, interactions and network context are evaluated in multiple layers. Classification depends on independent evidence and Human safeguards, beyond a weighted score.

Layer 1: Network

Connection information is distinguished from environment claims made by the browser.

UA/OS contradiction

Compare OS and browser claims from User-Agent, navigator.platform and Client Hints. Raw TCP TTL is not used for OS inference in the current deployment.

TTL hop analysis

Edge-dependent

Raw TCP TTL requires a network-edge observer. It is currently unavailable and hop count is not evidence confirming Bot.

Layer 2: Protocol

Transport characteristics require a trusted observer. They are unavailable in the current deployment.

TLS JA4 fingerprint

Edge-dependent

TLS ClientHello characteristics cannot be observed by the browser tag alone. They are not collected in current production.

HTTP/2 SETTINGS frame

Edge-dependent

HTTP/2 transport characteristics also need an edge observer. Unverified client claims are not accepted as independent transport evidence.

Layer 3: Browser

Client-environment fingerprints captured via JavaScript.

Client fingerprint analysis

Evaluate WebDriver, automation-framework artifacts, and consistency of UA, Client Hints, screen and APIs. Software rendering or a vendor name alone confirms neither Bot nor ad exclusion.

Layer 4: Identity

Network origin provides supporting context. Shared connections and WebView reader protections take priority.

Datacenter IP detection

Known datacenter ranges provide supporting evidence. A datacenter IP alone does not confirm Bot or permit media exclusion.

Shared-network and WebView protection

Known reader environments such as in-app browsers receive exclusion safeguards. Geography or timezone mismatch alone does not promote Human to an exclusion target.

Layer 5: Behavior

Interaction timing and repetition are assessed together with other evidence.

Frequency / repeat-click detection

Observe frequency over five minutes using a site/IP/fingerprint key. The window is internally managed; frequency alone does not confirm Bot or authorize advertising action.

Behavioral honeypot

Interactions with elements outside normal visible operation provide additional automation evidence. Media decisions also require other independent evidence and reader safeguards.

User behavior analysis

Evaluate ordering, intervals and regularity of clicks, scrolling and input, plus repetition across visits. Short dwell, missing observations and truncated records remain distinct.

Ad-click fraud (click farm)

Ad click IDs, interaction and dwell provide supporting observations. A short visit or absence of interaction alone does not confirm Bot or authorize ad exclusion.

3. Layered evidence, classification and media safety

Browser integrity, execution environment, interaction and network evidence contribute to classification. The classification is projected onto a display risk score; this score is not the probability of a Bot.

Internal classifications (separate from the main display and permission for media actions):

  • HUMAN: internally inferred from browser and interaction evidence, not independently verified Human ground truth. The customer-facing Normal traffic group also includes UNKNOWN and other unresolved states; diagnostic information retains the distinction.
  • SUSPICIOUS: concerning evidence without a confirmed Bot verdict. It is not counted as successful Bot detection or exclusion.
  • BOT: classified from automation evidence, not a reference score alone. Pixel delivery and Google Ads IP candidates require additional safety conditions.

Cross-Layer Convergence

Bot evidence and Human interaction requirements are evaluated separately, so missing interaction data does not erase clear Automation evidence. Media exclusion additionally requires corroboration and safeguards. Missing observations and Detector failures are not forced into a Human or Bot classification.

4. Human-First Safeguards

Detection protects normal users from misclassification. After a Bot verdict, connection follows the switch, destination, plan and pause settings without requiring further Bot proof. Google Ads separately checks shared-IP risks.

24-hour cooldown

A Google Ads IP candidate with a recorded safety veto is held from re-addition for at least 24 hours. The evidence and current safeguards are checked at each synchronization.

Seven-day IP safety window

New Detector observations across all sites linked to a Google account are checked. Non-BOT observations, WebViews, verified crawlers and whitelists veto exclusion. Missing classification coverage also prevents additions.

Methodology

Human FPR = confirmed Human sessions incorrectly classified as BOT ÷ all confirmed Human sessions. Natural production traffic is not automatically labeled Human; evaluation labels are compared with Detector results.

Human FPR below 0.1% is an evaluation target, not a guarantee of current performance. Formal evaluations include sample sizes, environment composition and confidence intervals.

Evaluating the new Detector

Confirmed Human sessions and controlled Automation are evaluated separately. Historical IP-list audits and small diagnostic samples are not presented as the new Detector’s overall false-positive rate or ad-exclusion success rate.

5. Compliance & Performance

Measurement data

We process information such as IP addresses, browser information and fingerprints, page and referrer URLs, ad-click identifiers and interaction data. Non-Bot quality measurement also records whether a purchase was observed. When conversion tracking is used, we process conversion records and the purchase value, if supplied.

No third-party cookies

Bot verdicts do not use cookies. Return-visit measurement uses a separate first-party cookie for each site, respects consent and browser privacy preferences, and can be disabled by the customer. Optional conversion tracking and advertising pixels are separate features.

Performance

The measurement tag loads asynchronously and is served compressed. Page-speed impact depends on the host page and device. Check loading performance on your own pages.

Retention by data category

Ordinary visit details are normally deleted on a seven-day schedule. Bot analysis archives and qualifying non-Bot quality-candidate archives are kept indefinitely, with no automatic expiry, and are generally retained after the customer’s contract ends, for fraud-prevention analysis and the verification and improvement of classification accuracy. Ordinary conversion records follow a 90-day schedule. For conversions matched to qualifying non-Bot quality candidates, the conversion fact, internal record ID and value, if supplied, remain in that archive. Separate invalid-click evidence records follow a 180-day schedule. Deletion of source records may be deferred until their archive copies are verified. Aggregate and ad-platform connection records outside these archives follow their own retention rules. See the privacy policy for details.