Programmatic Advertising: What's the Elephant in the Room Nobody Wants to See? 🐘

By Max Legrand · GreyFox Ads · A French perspective on the Open Web

There's an elephant in the programmatic room. And it's wearing a robot costume. 🤖 What happens to advertisers' budgets when more and more online activity is automated — and how can we make sure we're paying to reach humans?

1. The elephant in the room: how much traffic is human? 🐘

According to research from Imperva, around 50% of web traffic has been attributed to automated activity in the period discussed in our original post. Half the visitors to the internet are apparently… bots! 🤖

That's an eye-catching statistic, but an important distinction matters (the figure concerns measured web traffic in a particular study, not the share of advertising impressions bought by brands, and the proportion varies by website and methodology).

Some bots are useful: search-engine crawlers, monitoring services and legitimate automated assistants. Others are malicious, deceptive or simply unwanted. The challenge is distinguishing the two — and ensuring neither is mistaken for a genuine advertising audience.

2. AI is making the question harder to ignore 🤖

With AI assistants and automated agents becoming part of everyday internet use, we expect automated visits to become an even bigger subject for publishers and advertisers. In our original post, we pointed to ChatGPT's rapidly growing popularity in France as a sign of the times.

But more AI-related traffic does not automatically mean more ad fraud (a compliant crawler that does not load or trigger an advert is not the same thing as a bot generating chargeable ad impressions).

The real question is simpler: how much of the media budget is reaching people rather than automated systems? 💸

3. Robots.txt: a useful signal, not a security barrier

In principle, a well-behaved crawler checks a site's robots.txt instructions and identifies itself through its user agent. Publishers can then decide which crawlers to welcome, restrict or serve differently. We discussed that relationship in our earlier article about robots.txt.

However, robots.txt is a voluntary technical convention, not a universal legal requirement or an access-control system. A bot can ignore the file or disguise its identity. And a declared user agent can be spoofed.

Publishers therefore need additional checks if they want to distinguish legitimate automated visits from suspicious ones (and the applicable legal obligations depend on the jurisdiction and circumstances).

4. When bot traffic becomes an advertising problem 💸

Some bots may create page views without genuine readers. If advertising systems mistake those visits for human activity, they can generate invalid impressions, clicks or other misleading signals.

Publishers are not all incentivised in the same way. Some may have little reason to welcome worthless automated traffic; others could be tempted to overlook suspicious visits when those visits appear to inflate inventory. That's a risk, not an accusation against publishers as a group.

Ad servers, SSPs, DSPs and independent verification providers all have roles to play in filtering invalid traffic (IVT). Yet the existence of anti-fraud tools does not make the problem disappear.

Our post cited Unclickable, a documentary by Babis Makridis, as an illustration of how ad fraud can exploit weaknesses in the ecosystem. Its story should prompt scrutiny rather than be treated as a representative measurement of industry-wide fraud.

5. What can advertisers and AdTech platforms actually measure?

None of these checks is perfect. A low measured fraud rate can reflect the limits of detection as well as a genuinely cleaner supply path (so methodology and coverage matter).

6. Three options publishers could explore 🔐

Publishers who want more confidence about who is visiting their properties could consider:

• Login-based experiences: authenticated environments, such as those used by some French media apps, can improve recognition of returning users (without proving that every session is human).
• Stronger security checks: bot-detection and abuse-prevention measures of the kind used by major French platforms, including Leboncoin, can help protect access.
• Telecom-based identity: solutions such as Utiq may provide additional identity signals in supported contexts (but they are not a universal bot-detection solution).

Each approach has trade-offs around user experience, privacy, coverage and cost. The goal should be better-quality human audiences, not erecting barriers for their own sake.

7. The next branding KPI? Human attention 🧠

Our prediction was deliberately provocative: by 2027–2028, Human Attention could become a dominant branding KPI.

Because what is the value of an attention score if there is no human brain behind it? Attention measurement can be useful, but human validity needs to come first (and an attention metric alone does not establish that an impression was seen by a person).

If advertisers lose confidence in digital measurement, they may reconsider how they allocate budgets between online and offline channels. That is a scenario to avoid — not an established forecast.

8. Why GreyFox Ads cares about the quality French Open Web 🦊

At GreyFox Ads, we believe a quality Open Web can deliver real effectiveness for advertisers. Our programmatic Master Deals are designed to help Media Traders access quality inventory with more transparent, efficient supply paths and meaningful filtering.

We also support publishers, programmatic sales houses and trading desks through curation consultancy. The principle is simple: stop paying for noise; focus on genuine opportunities to reach people.

Originally published as a LinkedIn post by Max Legrand. The article preserves the original perspective while clarifying the distinction between bot traffic and advertising fraud.