Your retargeting pool is full. It is just not full of people

The pool is full. It is not full of people

A fox counts tracks before it counts rabbits. Marketers have spent a decade counting tracks and calling them customers, which was defensible while most of the prints in the mud were made by feet.

Read nextMeta Prospecting vs Retargeting: Budget Split Guide/Agentic browsing just won its first appeal

That stopped being true this year. Cloudflare reported in June 2026 that automated clients now pass 57.5 percent of HTML traffic on its network against 42.5 percent from humans, a crossover its chief executive had expected around the end of 2027, as covered by Tech Times and Let's Data Science. Eighteen months early, in other words.

The reason this lands on media buyers rather than on hosting bills is simple. A remarketing tag does not ask who is visiting. It records that a session happened and drops the identifier into a pool. bot traffic therefore does not just cost bandwidth, it quietly writes itself into your retargeting audiences and then asks you to bid on the result.

The number that reached the invoice

Practitioner evidence arrived this week. PPC Land reported on 8 September that David Dweck, president of the agency GoFish, is seeing clients whose bot traffic has risen 80 percent year over year, and that the adjustments made to retargeting have pushed cost per thousand impressions up by an average of 20 percent.

Read that carefully, because it is a cost of filtering rather than a cost of fraud. The agency is paying more per thousand to reach a cleaner slice of a dirtier pool. Nobody stole the money. The ground simply moved under the buy.

Why the CPM climbs when the pool gets dirty

The mechanism is unglamorous. A retargeting pool is a list of identifiers with an implied promise: these were people, and they were interested. Fill a third of that list with automated sessions and two things happen at once.

First, the deliverable audience shrinks while the nominal audience grows, so the exchange sees more supply for the same real demand and the auction stops behaving. Second, the buyer reacts by narrowing, adding filters, shortening windows and excluding suspect placements, and every one of those narrowings raises the price of the impressions that survive.

None of that is ad fraud in the legal sense, and calling it that muddies the response. ad fraud is deliberate misrepresentation of inventory or traffic for money. What is happening here is mostly indifferent machinery: crawlers, scrapers and agents doing their job, landing on a page and tripping a tag that was never designed to ask them for identification.

The distinction matters commercially. Fraud is a case for a vendor, a clawback and possibly a lawyer. Contamination is a case for a better retargeting strategy, because no supplier is going to hand back money for sending you a crawler that behaved exactly as crawlers do.

That is a hosting complaint rather than a media one, and it is the same fact arriving at a different door. When the people running the servers and the people buying the media start describing the same weather, it is usually weather.

Where the budget quietly moves

Follow the money and the answer is already visible: toward inventory where identity is declared at the door rather than inferred from behaviour. Social platforms and retail media networks know who is logged in. An open-web retargeting pool only knows who once loaded a pixel.

That is why this is a paid social story rather than a programmatic one. The shift is not a preference for a channel, it is a preference for a signal, and the channels holding a login are the ones that keep working while the open web's inference gets noisier.

That last row deserves its own sentence. made for advertising inventory was already the least defensible line in most plans, because the pages exist to carry impressions rather than readers. Automated traffic makes those pages cheaper to fill and harder to distinguish, which is exactly the wrong combination.

What not to do about it

Do not respond by buying a bigger exclusion list and calling it a strategy. Exclusions are a hygiene layer, not a plan, and every additional filter narrows the auction you are competing in. The buyers who lost the most money to this in the last year were the ones who filtered first and measured afterwards.

What bot traffic does to a measurement stack

Two industry bodies already publish the vocabulary for this, and most teams have never opened either. The IAB Tech Lab maintains the standards that define and detect invalid traffic, and Cloudflare's own bot management documentation sets out how automated clients are classified before they ever reach your tag. Reading the definitions is the cheapest hour in this whole exercise.

The distinction those documents draw is the one your reporting needs. A verified crawler that identifies itself is a different animal from an unlabelled client pretending to be a browser, and bot traffic that announces itself can be excluded at the edge rather than filtered in the auction. Most teams do neither and pay for both.

There is a measurement wrinkle worth naming. Rising bot traffic can flatter a click-through rate at the same time as it inflates a pool, because the weakest impressions leave first. Optmyzr and other reporting vendors have been tracking exactly that pattern in paid accounts this year, which is why their aggregate reads are worth putting beside your own before anyone declares a creative win.

The fox test applies. If a number improved and you cannot name what left the field, you have not found a win, you have found a hedgerow with a gap in it.

Five fixes that survive the next crawler wave

These are ordered by what they cost, cheapest first. None of them require a new vendor, and all of them hold whether automated share settles at 57 percent or keeps climbing.

The fourth and fifth of those are the ones teams skip, because one feels like admin and the other feels like a confession. They are also the two that turn a vague anxiety about ad fraud into a line a finance director can read.

If you want the deliverable-share metric built and the pools rebuilt behind it, that is folkfox paid social, and it runs alongside the search discipline in PPC. The same measurement problem turns up in regulated categories, which is why it recurs across iGaming marketing and FinTech marketing.

For the wider market read, Digiday's reporting on agencies building their own audit tools and AdExchanger's daily roundup both show buyers instrumenting first and arguing later. That is the right order for bot traffic too: instrument the pool, then argue about the filter.

What this evidence cannot tell you

Two limits, stated plainly, because a piece about measurement quality that overclaims would be self-defeating.

The 57.5 percent figure is Cloudflare's view of Cloudflare's network. It is a very large sample and it is not the whole web, and a site behind a different provider may see a different mix. The 80 percent rise and the 20 percent CPM increase are one agency's client base, described by that agency's president. Both are credible practitioner evidence, and neither is an industry benchmark.

The second limit is causal. A CPM can rise for several reasons at once: more advertisers in the auction, seasonal demand, a changed bid strategy, or a narrowed audience. Attributing all of it to bot traffic would be the same error as attributing none of it. Take your own baseline, then argue from that.

There is a cheerful footnote. Some of the automated traffic is arriving with a person behind it: assistants fetching a page on someone's behalf. Brands that treat every non-human request as waste will filter out the very visits that are about to matter, which is why the fix is a better retargeting strategy rather than a blanket block.

Read that alongside our earlier work on agentic browsing and access rules, and on splitting prospecting from retargeting budget. The fox does not block the whole hedgerow because something rustled in it.

One more limit, and it is the one most likely to bite. Deliverable share is not a standard metric, so nobody will hand you a benchmark for it. Measure your own, hold the definition steady, and compare against yourself rather than against a figure from a vendor deck.

Then treat bot traffic the way a fox treats weather rather than the way it treats a predator. It is a condition to plan around, not an enemy to defeat, and the operators who prosper are the ones who priced it into the plan before the invoice explained it to them.

One closing discipline. Put bot traffic on the agenda as a measured share rather than a mood, review it beside CPM every month, and the conversation stops being about blame. A pool nobody audits is a promise nobody kept, and bot traffic is simply the reason the promise came due this year.

Frequently asked questions