Google already filters obvious invalid clicks and credits some of them back to your account, so the first step is to understand what it does before adding anything. The gap is the sophisticated traffic Google is conservative about flagging, the lack of detail on what it filtered, and the fact that its credits never become exclusions. To close that gap you score sessions yourself and turn the bots you find into IP and placement exclusions that stop the next click.

What Google’s own filtering does

Google runs automatic invalid-click detection on every campaign. It catches the clearly mechanical stuff well: repeated clicks from the same source, clicks from data-centre ranges, known general invalid traffic. When it identifies a click as invalid before billing, it filters it and you are not charged. When it spots invalid activity after the fact, it issues a credit on a later invoice.

Two limits matter. First, the system is opaque. Your dashboard shows an “invalid clicks” count, but not which clicks, from where, or why, so you cannot act on the detail. Second, it is conservative on sophisticated invalid traffic — residential-proxy bots and automation that imitates a human. Google errs toward not flagging when it is unsure, which is reasonable for a platform billing millions of advertisers, and it leaves the harder traffic for you to catch.

How to spot suspicious patterns in your own data

Before any tool, the Google Ads interface itself shows tells if you look. A few worth checking:

  • Click-through rate that spikes on one placement or one geo while conversions stay flat, which often means clicks without humans behind them.
  • Impressions and clicks arriving at odd hours for your audience, or concentrated on a handful of display placements you never targeted directly.

Segment by placement, by hour, and by geo, and the anomalies tend to surface. The trouble is that the data stops at the click. Google tells you a click happened; it cannot tell you whether a person was on the other end. For that you need a signal from the page itself.

What a detection tag adds

A JavaScript tag on your landing pages reads what Google cannot: the browser. It collects automation markers, fingerprint consistency, behaviour, and network reputation, then scores each session human, suspect, or bot. Above 70 is human, 40 to 70 suspect, below 40 a bot, and every deduction has a named reason on the dashboard rather than a verdict you have to take on faith. The tag is about 13 KB gzipped, loads with defer, and never reads form field values.

This is session-level scoring, which is the layer Google’s count cannot give you. Instead of a number you cannot break down, you get a per-click reason: which click came from a data-centre ASN, which session contradicted its own fingerprint, which cursor moved with super-human regularity.

How ClickLens turns detection into exclusions

Detection is only useful if it stops the next click. ClickLens takes the bots it scores and generates exclusions, then writes them back to the platform. On Google Ads, IP and placement exclusions sync today: when a session scores as a bot from a given IP or display placement, that source is pushed to your account’s exclusion list so future spend skips it. The exclusions reference covers how the lists are built and managed.

The platform coverage is honest about where each integration stands:

  • Google Ads: IP and placement exclusions sync today.
  • Microsoft Ads: built and rolling out.
  • Meta Ads: placement exclusion rolling out (Meta has no advertiser-side IP exclusion).
  • TikTok Ads: report-only, because there is no advertiser exclusion API to push to, so ClickLens reports flagged placements and wasted spend rather than pretending to block.

ClickLens does not replace Google’s filtering or undo its billing. It adds the layer Google is conservative about — the sophisticated traffic — and it makes detection actionable by converting verdicts into exclusions you can audit. See the Google Ads use case for how the two fit together, or run a free audit to score a sample of your own traffic and see what Google’s count is not showing you.