Bots have overtaken humans online. Everyone is pricing it, and no two prices match

The whole industry looks like this: over the past year at least five major reports on bots and ad fraud (invalid, fraudulent traffic) have come out. Some of their authors did put a price on it, yet no two numbers from these reports can sit side by side without a caveat. Here’s what each one actually measured, where the numbers agree, and where — deliberately or not — they mislead.

Number one: 57.5% of the internet isn’t human

Cloudflare Radar’s public traffic dashboard (Cloudflare is one of the world’s largest content delivery and hosting networks ¹) showed that as of early June 2026, 57.5% of HTTP requests (a browser’s or app’s technical calls to a server: one for every page, script, image or file it fetches) to ordinary web pages came from automated systems, versus 42.5% from humans ². The key word here is “requests”: Cloudflare counts technical calls to a server, and minutes of attention are invisible to it. A person might look at five sites before buying something; an AI service might look at five thousand, as NBC News puts it ¹. Services like that are called AI agents (software that browses websites on its own, without a human clicking each link, to complete a task — compare prices, book a ticket). Prince admitted the exact crossover date can’t be pinned down: the data is “a bit messy,” he wrote, “but clearly on the other side now” ¹.

Methodology: Cloudflare only sees the slice of global traffic that flows through its own infrastructure, that is, what the company itself serves. Limits: the figure doesn’t distinguish a “harmful” bot (stealing data, faking impressions) from a “helpful” one (a search indexer that helps a site get found). It also says nothing about ad money directly: it measures site traffic in general.

Number two: 124% growth — of what, exactly

DataDome measured a trend. In its State of Bot & Agent Security Report 2026, the company analyzed more than a trillion requests across 75,000 customer sites and tested the defenses of more than 20,000 popular websites (homepages only) [3; 4]. The headline figure: “bad” bot traffic (malicious scanning, scraping, scalping — buying up goods or tickets for resale, credential stuffing, per DataDome’s classification ³) grew 124% year over year, from July 2025 to June 2026, while human traffic grew only about 13% over the same period [3; 4]. Scraping (automated bulk copying of a site’s content, often to train AI) remains the largest attack type — 70.9% of all bad bot traffic, itself up 185% ³. Overall, bots and AI agents make up about 26.5% of traffic in DataDome’s data ⁴, less than half of Cloudflare’s 57.5%. Another figure from the same report: only 2.4% of tested sites had protection against all ten bot types DataDome checked — a share that has fallen for the second year running: 8.4% in 2024, 2.8% in 2025 (DataDome notes that last year’s test set was simpler) [3; 5].

Methodology and limits: DataDome is a commercial vendor that sells bot protection, and its customers are sites already concerned enough about the problem to pay for a solution. They form a self-selected group, likely more attractive to attackers than the average site (large e-commerce, financial services). The company has a direct commercial interest in showing the threat as large as possible, so the numbers should be read as “what a protection vendor sees among its own clients.” They are not a universal figure for the whole market.

Numbers three and four: how much ad money it actually costs

Here a fundamental distinction appears: the first two sources count site traffic overall and say nothing about advertising specifically. For an advertiser this isn’t the same thing at all — a bot scanning a page and a bot clicking an ad are two different cost lines.

Lunio, a vendor that protects ad campaigns from fraud, measured ad clicks specifically: in its Global Invalid Traffic Report 2026, the average share of invalid traffic (IVT — clicks or impressions that don’t come from a genuinely interested human; Lunio counts bots, fraud and accidental clicks here) across 2.7 billion analyzed clicks over 12 months (August 2024–July 2025) was 8.51% ⁶. Despite the “2026” in its title, the data ends in July 2025, so it is more than a year old as of this writing. Applied to global digital ad spend above $740 billion, Lunio calculates that as roughly $63 billion in wasted budget for the year ⁶.

Japan’s Spider AF ran a similar study over a different period and a different data set: 4 billion clicks in the first half of 2026, finding an average fraud share of 5.58% — up from a year earlier (4.32%). Bot clicks grew roughly 2.2 times, and advanced bots that mimic humans now make up 64.4% of all bots in its sample ⁷. Annualized, Spider AF puts ad spend potentially exposed to fraud at $50.6 billion ⁷. The company states plainly in its own methodology that this is a market-size-based estimate — take the fraud share in its sample and multiply it by an estimate of the entire global ad market; nobody measured global losses directly ⁷. Lunio’s $63 billion was produced the same way, by multiplying its sample rate by the whole global market, but Lunio presents it as losses without that caveat ⁶.

Methodology and limits: Lunio used data from its clients in monitoring-only mode (protection switched off) across six ad platforms, eight industries and ten countries; only industries and countries with enough volume made it into the sample ⁶. Spider AF drew on data from 196 countries ⁷. Both companies sell fraud protection, so they share DataDome’s commercial interest.

So two companies measuring almost the same thing (invalid and fraudulent paid clicks) arrived at 8.51% and 5.58% — roughly one and a half times apart — and neither figure is close to Cloudflare’s 57.5% or DataDome’s 124% growth rate. The gap comes from all four measuring different things: a whole site’s traffic versus ad clicks, a share versus a growth rate, different periods and different client samples.

Number five: when fraud measurement is closer to an audit than a vendor estimate

The closest thing to an independent audit among the available figures comes from the Association of National Advertisers (ANA), together with the Trustworthy Accountability Group (TAG, an industry certification body against fraud) and technology partner Fiducia. Their Programmatic Transparency Benchmark for Q1 2026 is built on impression-level log files (a record of every impression) from 66 advertisers who contributed data (86 participants in total) ⁸. The headline metric is the TrueAdSpend Index: the share of programmatic budget (programmatic means buying ads automatically through real-time auctions) that reaches impressions that are fraud-free, measurable, viewable and not on made-for-advertising (MFA) sites, which are built solely to inflate impression counts ⁸. It stood at 43.3% in Q1 2026 ⁸. In other words, 56.7% of participants’ budgets never reached a qualified impression. Part of it went to intermediary fees (transaction costs), the rest to impressions with quality defects: fraud, impressions that couldn’t be measured, low viewability (whether a banner actually appeared in the visible part of the screen) and MFA sites. Quality defects alone, per the ANA, cost higher-performing advertisers 19% of spend and lower-performing ones 38.4% ⁸. MFA impressions alone made up 1.1% of budget in this benchmark, up from 0.4–0.6% in 2025 ⁸.

The same project this summer produced the first quantified estimate of a new category — “AI slop” (mass-produced AI-generated content with little human input, made to monetize ad placements next to it): between 1.3% and 2.4% of open-web programmatic budget ⁹. The methodology here was doubled — separate domain-level classification and separate automated scoring of rendered pages, with flagged cases checked by human reviewers — and both methods landed on consistent figures ⁹.

A shared industry definition of invalid traffic does exist. The Media Rating Council (a US body that accredits ad measurement methods) distinguishes two types of invalid traffic (the current version of the standard dates from June 2020 ¹⁰): GIVT (General Invalid Traffic — simple, long-known bots caught by blocklists) and SIVT (Sophisticated Invalid Traffic — bots that mimic human behavior and require more complex analysis) ¹⁰. Ad measurement companies rely on this classification, but protection vendors often count by their own definitions: Lunio, for instance, includes accidental clicks in IVT ⁶.

What to do with this, and what we don’t know

The phrase “bots have taken over the internet” is true for site requests and misleading for ad budgets. For a budget, a different question matters: what share of my ad budget went to clicks and impressions that didn’t come from real people. For paid clicks, that’s 5–9% across recent measurements. There’s also a wider figure: between a fifth and more than a third of programmatic budget is lost to impressions with quality defects (fraud, unmeasurable impressions, low viewability, trap sites), and once intermediary fees are added, more than half never reaches a qualified impression. That’s still serious money, but the conversation with a client or a manager is then very different from “half the internet is fraudsters.”

What we don’t know: an independent, industry-agreed methodology that measures fraud the same way across every market and platform doesn’t exist yet — every vendor counts on its own client sample with its own tool, and nearly all of them have a commercial stake in the result. The logic of incentives suggests that bot-protection vendors benefit from a scarier threat and ad platforms from a smaller one. How representative any of this is for individual markets is also unclear — geographic and vertical composition of bot traffic can vary substantially, and none of the cited studies broke out results by individual smaller markets.

The one practical takeaway for any advertiser today: ask every platform and agency which methodology they use to count bots (Media Rating Council’s GIVT/SIVT or their own) and on what sample, and check the answer against your own fraud-detection tool if one is connected to the campaign. Trusting a bare percentage without a methodology behind it isn’t buying protection from fraud — it’s buying another opaque report about it.

Sources

1. ↑NBC News, “Bot web traffic has overtaken human web traffic, data shows,” June 4, 2026 — https://www.nbcnews.com/tech/tech-news/bot-web-traffic-overtaken-human-web-traffic-data-shows-rcna348522
2. ↑Tom’s Hardware, “‘Bots have now passed human traffic online,’ Cloudflare boss laments,” June 4, 2026 — https://www.tomshardware.com/tech-industry/artificial-intelligence/bots-have-now-passed-human-traffic-online-cloudflare-boss-laments-says-agentic-traffic-wasnt-expected-to-eclipse-real-people-until-next-year
3. ↑DataDome, “State of Bot & Agent Security Report, 2026,” published September 22, 2026 — https://datadome.co/resources/bot-and-agent-security-report
4. ↑HelpNetSecurity, “Nearly two-thirds of tested websites fail every bot test,” September 23, 2026 — https://helpnetsecurity.com/2026/09/23/datadome-growing-bad-bot-traffic-report
5. ↑SecureWorld, “Bad Bots Growing Nine Times Faster than Human Traffic, Report Finds,” September 23, 2026 — https://www.secureworld.io/industry-news/bad-bots-faster-than-human-traffic
6. ↑Lunio, “Global Invalid Traffic Report 2026” — https://www.lunio.ai/hubfs/Global%20Invalid%20Traffic%20Report%202026%20(1).pdf
7. ↑Spider AF, “Ad Fraud Investigation Report 2026 First Half Edition” — https://spideraf.com/adfraud-report-whitepaper-2026-firsthalf
8. ↑ANA (Association of National Advertisers), “ANA Programmatic Transparency Benchmark Reveals Widening Gap Between Top and Bottom Advertisers,” May 27, 2026 — https://www.ana.net/content/show/id/pr-2026-05-programmatic
9. ↑PR Newswire / TAG, ANA, Fiducia, “TAG/ANA/Fiducia Analysis Quantifies Level of ‘AI Slop’ in Digital Advertising Supply Chain for First Time,” July 28, 2026 — https://www.prnewswire.com/news-releases/tagana-fiducia-analysis-quantifies-level-of-ai-slop-in-digital-advertising-supply-chain-for-first-time-302836519.html
10. ↑Media Rating Council, “Invalid Traffic Detection and Filtration Standards Addendum” — https://mediaratingcouncil.org/sites/default/files/Standards/IVT%20Addendum%20Update%20062520.pdf