Click Fraud Statistics 2026: Ad Fraud and Bot Traffic Data

This page collects the click fraud, ad fraud and bot traffic statistics that hold up to checking. Every figure below names its publisher and the year the data covers, and links to the original or to reputable coverage of it. We opened each source before listing it. Figures that only appear on click-fraud vendors' own blogs are left out, because they come from those vendors' customer data and are hard to verify independently.

Read the numbers by their unit. Most public studies measure impressions in open programmatic inventory or requests across the web, not clicks on Google Search or Meta ads. That difference matters, and the last section explains how to turn context into an account-level benchmark.

Key statistics at a glance

The five figures in the summary above are the ones most worth quoting, because each comes from a large dataset with a stated scope.

Market size and the cost of ad fraud

The most cited global estimate is Juniper Research's: $84.2 billion lost to ad fraud in 2023, about 22% of global digital ad spend, rising to a forecast $172.3 billion by 2028. Industry anti-fraud standards also have a measurable effect: TAG estimated they saved US advertisers $10.8 billion in 2023.

Two caveats apply. MediaPost reported that Juniper's 2023 study was produced in collaboration with an anti-fraud vendor and that no detailed methodology was published, so the dollar totals are directional. TAG's $10.8 billion is a modeled estimate of avoided losses, not a directly observed sum. We did not find a newer Juniper estimate published since 2023.

For what these totals mean for a single account, see How Much Does Click Fraud Cost?.

Invalid traffic rates by channel

Invalid traffic (IVT) rates differ sharply by channel. Mobile app inventory is the worst measured channel, at 41% of open programmatic impressions in Q2 2026, against 26% for CTV and 20% for web. Channels certified by TAG hold IVT under 1%.

Pixalate states that its data comes mainly from buy-side open auction programmatic traffic, so these rates describe open-exchange display, app and CTV inventory. They do not describe Google Search clicks.

Search and social: neither Google nor Meta publishes an aggregate invalid click rate, and we found no independent, methodology-backed public benchmark for paid search or paid social clicks. Google says it "catches most invalid traffic shortly after the ad interaction" and that "you aren't charged for invalid traffic detected before billing" (Google Ads Help). The per-platform click rates that circulate online come from click-fraud vendors' own customer data, which this page excludes. For risk by Google Ads campaign type, see Invalid Traffic Risk by Google Ads Campaign Type.

Bot traffic share of the internet

Bots now generate slightly more web traffic than humans. Thales (Imperva) measured automated traffic at 53% of web traffic in 2025, and Cloudflare measured humans at 47% of HTML requests on its network as of December 2025.

These datasets come from each company's own network or customer base. HUMAN states that its report "does not represent the totality of internet traffic", and the same limit applies to the others. Their direction agrees: automation is growing faster than human use. For how this shows up in paid campaigns, see Google Ads Bot Traffic: Detect and Block Fake Clicks.

Click farms and device fraud operations

Click farms and infected-device networks are hard to count, so the reliable figures come from law-enforcement takedowns and published threat research. Two 2025 cases show the scale: a SIM-farm service in Europe linked to around 50 million fake online accounts, and an Android botnet of over 1 million devices used for ad fraud and click fraud.

We did not find a recent peer-reviewed study that measures click-farm activity in paid search. For how click farms work and how to spot them, read What Is a Click Farm? and Bot Farms and Google Ads Click Fraud.

Google and Meta platform figures

Google and Meta publish enforcement totals, not invalid click rates. In 2025 Google blocked or removed 8.3 billion ads and suspended 24.9 million advertiser accounts. Meta removed over 159 million scam ads.

Meta disputed the Reuters report: a spokesman said the documents "present a selective view" and called the internal 10.1% estimate "rough and overly-inclusive". The Google figures cover policy enforcement against bad advertisers and publishers. They are not invalid click counts. Invalid clicks are filtered separately and appear in your own account's Invalid clicks column (Google Ads Help). For Meta specifics, see Meta Ads Click Fraud and Meta Ads refunds for invalid clicks.

Industry and vertical figures

Credible public data on invalid-click rates by advertiser industry does not exist. What does exist is industry data on bot attacks, AI traffic and app categories. Financial services absorbed 24% of bot attacks in 2025, and three industries took more than 95% of AI-driven traffic.

The app-category figures describe where ads ran (the publisher's app), not the advertiser's industry. For advertisers, the practical rule still holds: high-CPC lead-generation verticals such as legal, finance, insurance and home services lose more per bad click, so they justify closer monitoring. That is a cost argument, not a measured fraud rate.

Affiliate and mobile app fraud

Mobile app inventory carries the highest measured invalid traffic of any channel, and app install fraud is concentrated in a few traffic sources. AppsFlyer found that the fraud gap between affiliate traffic and self-reporting networks reached 36x.

We did not find a methodology-backed public figure for total affiliate fraud losses. The affiliate totals that circulate come from vendors without published methods. For the mechanics, see Click Fraud in Affiliate Marketing and Mobile App Install Fraud.

AI agents and agentic traffic

AI-driven traffic is the fastest-growing category online. HUMAN measured agentic traffic growth of 7,851% in 2025, and Cloudflare found AI bots made up 4.2% of HTML requests on its network.

Agentic traffic matters for advertisers because agents browse product and search pages the way shoppers do. Most of it is not malicious, but an agent that clicks an ad on someone's behalf is not a buyer you can retarget or close. See AI Agent Clicks and Invalid Traffic in Google Ads and AI Agents and Ad Fraud.

How to use these numbers against your own account

Public statistics show the problem is real. They cannot tell you what share of your own budget is wasted. Pixalate's 41% mobile app rate is a measure of impressions in open exchanges, and it does not mean 41% of your Search clicks are fake.

Before quoting any figure, check four things:

• Unit: impressions, clicks, requests, installs or leads.
• Scope: open programmatic, a vendor's customer base, or a platform's whole network.
• Filtering: measured before or after the platform filtered invalid activity.
• Method: whether the publisher explains how the number was produced.

Then build your own baseline over 30 days, or 90 days if volume is low:

If an account reports 100 leads on $10,000 and sales accepts 50, reported CPA is $100 but qualified CPA is $200. That gap is not all fraud, but it is the pool to investigate first. For the investigation steps, see How Invalid Traffic Damages Lead Quality in PPC and How to Reduce Click Fraud Without Hurting Conversions.

How we chose these sources

We included figures from research firms, industry bodies, platform disclosures, law enforcement and threat-research reports with a stated dataset. Where the original was not reachable, we linked reputable trade coverage and named it as coverage. We excluded figures that appear only on click-fraud vendors' own blogs or customer-data reports. Several publishers listed here (HUMAN, Pixalate, DataDome, Thales, AppsFlyer) also sell security or measurement products. We cite their research, not their tools. Figures are labeled with the year the data covers. We will replace them as newer editions are published.

Related reading:

• How Click Fraud Works in 2026
• Google Ads Traffic Quality Review
• Invalid Traffic Risk by Google Ads Campaign Type
• Invalid traffic (glossary)