Docs

AI Agent & Bot Traffic Tracking

Automated and AI agent traffic now rivals human traffic — track it separately before it silently inflates your engagement and conversion metrics.

Analytics

Automated traffic has stopped being a rounding error. Security vendors tracking web traffic in 2026 report agent-driven requests growing many times faster than human traffic, with some measurements now showing automated requests making up more than half of all HTML traffic on the open web. Shopping agents, AI browsing assistants, scrapers, and plain bots are all mixed into the same event stream your analytics tool treats as “users.” Most mobile and web analytics pipelines were built on the assumption that a session means a person, and that assumption is now wrong often enough to matter.

The damage isn’t abstract. DAU/MAU, session duration, funnel conversion, and retention curves all get pulled in whatever direction the automated traffic happens to skew. A legitimate AI shopping agent completing a purchase on a user’s behalf looks nothing like a human browsing session, but it still counts as one in a funnel report — and a scraper hammering your product pages looks like enormous engagement with zero intent. Teams making roadmap or spend decisions off blended numbers are, in effect, optimising for whatever mix of humans and machines happened to show up that week, not for their actual users.

Data Points to Track

  • traffic_classification per session or event — human, verified_agent (a known, allow-listed AI agent acting on a user’s behalf), suspected_bot, or unknown
  • Identity and network signals feeding that classification — user-agent string, TLS/JA3 fingerprint hash where available, ASN and IP reputation
  • Behavioural signals — navigation timing, input cadence, and interaction patterns that distinguish scripted traffic from human variability
  • Agent-mediated conversions, tracked separately from human conversions so attribution and revenue reporting don’t quietly blend the two
  • Daily and weekly non-human traffic share, broken out by channel and platform, so a spike is visible before it distorts a reporting period

Setup Steps

  1. Add a classification layer ahead of your analytics pipeline so every event arrives pre-tagged with a traffic classification rather than being scored after the fact.
  2. Maintain an allow-list of known, legitimate agents (verified shopping or booking assistants acting for real users) so they’re separated from suspected bots rather than lumped together.
  3. Segment every core dashboard by traffic classification — funnels, retention, DAU/MAU — so “human-only” is a selectable view, not something reconstructed manually after the fact.
  4. Set an alert threshold on non-human traffic share by channel, so a sudden jump gets investigated before it lands in a monthly report.
  5. Re-baseline historical comparisons once classification is live, since prior periods likely include unclassified automated traffic that will make current numbers look like a discontinuity rather than a correction.

Actionable Insights

If suspected-bot share is climbing on a specific channel or landing page, that’s usually a scraping or ad-fraud signal worth investigating at the source, not a traffic-quality problem to just filter around. If verified-agent conversions are a growing share of revenue, your last-click attribution model is likely undercounting agent-mediated purchases and needs a distinct attribution path rather than being folded into human conversion rate. And if a retention or engagement metric moved sharply the same week non-human traffic share moved, treat that as the more likely explanation before concluding the product itself changed user behaviour.

Expert help

Need help tracking this in your app?

Our team sets up analytics pipelines for mobile and web teams every day. Talk to us and get your first events flowing in under an hour.

Talk to an expert