← Back to VPN researchResearch and benchmarks

VPN and Invalid-Traffic Benchmarks: Why 6–20% Is a Range, Not a Promise

Advertisers often ask for one number: what percentage of paid clicks are VPN or bot traffic? Research does not support a universal answer. The rate changes with the denominator, channel, device mix, industry, geography, and definition of invalid traffic.

Three different measurements

Invalid traffic can mean a click that is not genuine user interest, a programmatic impression that fails a quality standard, an onsite session generated by automation, or a business event that does not produce a real customer. These are related but not interchangeable measurements.

What recent benchmarks show

Lunio’s published click dataset reports 6.03% for Retail, 6.48% for Software & IT, and 8.20% for B2B SaaS, with higher averages in some paid channels. Pixalate’s Q1 2024 open-programmatic benchmark reports 12% desktop-web and 10% mobile-web IVT across a much larger impression denominator. Fraud0’s 2025 study reports 21% invalid onsite traffic in its customer dataset. Imperva reports 51% automated traffic across all web traffic in its 2024 dataset, including good and bad automation.

Those numbers describe different universes. They should not be stacked together or presented as the amount Google or Meta owes an advertiser.

How to use the range responsibly

  • Use it to justify a sample audit when spend or CPC is material.
  • Report your own observed rate with the exact denominator.
  • Break out VPN/proxy evidence from confirmed automation and from low-quality but human traffic.
  • Reconcile the result with ad-platform invalid-click columns and conversion data.

For the product view, visit BotRefund VPN Detection. For the attribution mechanics, read why VPN clicks can look local.

botrefund.com