What invalid traffic is, and why click fraud is the narrower term
Click fraud is the narrower of two terms. Google's advertiser documentation defines invalid traffic as "traffic that doesn't represent genuine interest in your business." The category covers accidental clicks, bot traffic and manual clicks "that increase your ad costs or inflate publisher profits," and Google's Ad Traffic Quality Resource Center adds clickjacking (a page built to trick the visitor into clicking an invisible ad) and ad stacking (several ads layered so only the top one is visible). Google notes that "[t]his list isn't exhaustive because many types of invalid traffic exist."
Click fraud is the subset with intent. The Interactive Advertising Bureau's Click Measurement Guidelines of May 12, 2009 define invalid clicks "arising from suspected 'click fraud'" as "a sub-component of Invalid Clicks" that "originate from a user, program or automated agent" accessing a URL (a web address) "for the purpose of manipulating click measurement activity or click-based advertising payments." The same document states the limit of the subject: because "true user intent and all conditions surrounding user activity can rarely be known," it is "unlikely that all Invalid Clicks Arising from Click Fraud are knowable or discoverable."
The standard accredited measurement vendors are audited against is the Media Rating Council's Invalid Traffic Detection and Filtration Standards Addendum of June 2020, which splits the field in two. General Invalid Traffic, or GIVT, is "traffic identified through routine means of filtration executed through application of lists or with other standardized parameter checks": known data-center traffic, declared bots and crawlers, non-browser user-agent headers (the user agent is the string a browser sends to identify itself) and headless browsers that cannot render images. Sophisticated Invalid Traffic, or SIVT, "consists of more difficult to detect situations that require advanced analytics, multi-point corroboration/coordination, significant human intervention, etc.": hijacked devices, incentivized human activity, forced clicks, falsified measurement events and click farms.
What Google credits, and what it will not confirm
Google states that invalid traffic detected before billing "is automatically removed from your billing and campaign reports, so no refunds are necessary," and that traffic detected after the invoice produces "credits in the form of a billing adjustment," labeled "Invalid activity" on the invoice. The "Invalid clicks" columns in campaign reports show what was filtered before billing; the Invalid Activity Credit Report, available for Search and Performance Max campaigns, shows post-billing credits by campaign and network.
An advertiser who suspects traffic the filters missed may "submit an invalid traffic investigation request for activity within the last 60 days." The evidence Google asks for on its About invalid traffic page is the evidence an expert will later ask for: the date range, the campaigns and keywords, and "[w]eb server logs" identifying IP addresses with repetitive or non-converting clicks, browser and device information, and GCLIDs (the Google click identifier, a parameter Google appends to the landing-page URL for each ad click so the visit can be mapped back to the ad interaction).
Google states that "an investigation won't be able to confirm if specific clicks were marked as valid or invalid," because sharing those details could expose its detection methods. No Google Ads report or export contains a per-click IP address or timestamp. The documentation is silent on IP disclosure as such; the accurate statement is that Google will not confirm click-level decisions and its reports carry no click-level record.
The contract: what the advertiser agreed to
The Google LLC Advertising Program Terms for the United States, dated July 29, 2025, set the posture of any claim against Google. A July 1, 2026 revision changes the arbitration language; its text could not be retrieved, and the terms in force on the dates of the disputed clicks control. Section 8 of the July 2025 terms states that "third parties may generate impressions or clicks on Customer's Ads for prohibited or improper purposes and if that happens, Customer's sole remedy is to make a claim for advertising credits within the Claim Period," defined as "within 60 days after the invoice date." The customer "WAIVES ALL CLAIMS RELATING TO ANY PROGRAM CHARGES UNLESS A CLAIM IS MADE WITHIN THE CLAIM PERIOD."
Section 10 limits liability to direct damages and caps them at the amount payable to Google "IN THE THIRTY DAYS BEFORE THE DATE OF THE ACTIVITY FIRST GIVING RISE TO THE CLAIM." Section 13 requires individual arbitration under the AAA Commercial Arbitration Rules, governed by the Federal Arbitration Act, after a written Notice of Dispute and a 60-day waiting period; evidentiary submissions "will be maintained as confidential in the absence of good cause," and class claims are waived. A customer may opt out by webform "within 30 days of the first acceptance date of any version of these Terms containing an arbitration provision." Section 14 applies California law.
The consequence is structural. A claim against Google over invalid clicks is limited to credits, waived after 60 days, capped at a month of spend, arbitrated individually and confidentially, and decided under California law. The dispute that reaches a courtroom is almost always advertiser against the competitor alleged to have clicked, the agency that managed the account, or a publisher or network, where Google's terms do not control.
What the reported cases establish
No court has held Google liable for click fraud in the sources read for this page, and the history supplies the language an opposing expert will quote.
Lane's Gifts & Collectibles v. Google, a class action in the Circuit Court of Miller County, Arkansas, was reported in 2006 to have settled for up to $90 million in advertising credits and attorneys' fees; the figures rest on news reports. The report prepared in connection with the settlement by Alexander Tuzhilin of NYU Stern found Google's efforts "reasonable" and stated the problem every expert in this field inherits: "There is no conceptual definition of invalid clicks that can be operationalized."
Singh v. Google LLC, No. 5:16-cv-03734-BLF (N.D. Cal.), is the direct click-fraud-rate case. The plaintiff alleged that Google's statement that "[o]n average invalid clicks account for less than 10% of all clicks on AdWords ads" was false; his expert put the rate at 14 percent. Dismissing the second amended complaint on June 2, 2017, Judge Freeman called the plaintiff's own click experiment "utterly implausible." Denying class certification on January 10, 2022, the court wrote that the agreement "makes clear that Google cannot detect all click fraud," and that a damages model built on the gap between actual fraud and 10 percent "would make Google a guarantor that advertisers never pay for a fraudulent click." On November 15, 2021 the court had sealed parts of the record as "highly sensitive and detailed technical information" about Google's filters. The less-than-10-percent figure is no longer on Google's pages and belongs on the record only as what Google said at the time.
Woods v. Google, later Cabrera v. Google LLC, No. 5:11-cv-01263-EJD (N.D. Cal.), is often cited as a click-fraud case and is not one. The claims that settled under the final approval order of August 29, 2025, with a $100 million common fund, concerned Smart Pricing and location targeting; the theory of "secret agreements with its Special Partners to generate invalid clicks" failed at summary judgment on September 28, 2017 for lack of evidence.
The criminal baseline is United States v. Zhukov in the Eastern District of New York. The Department of Justice release of November 27, 2018 describes a thirteen-count indictment for the Methbot and 3ve schemes, which "falsified billions of ad views" through more than 1,900 rented servers and more than 1.7 million infected computers. Those schemes defrauded display advertising with fake impressions, not paid search with fake clicks.
What the advertiser's own records can and cannot show
Web server logs record, for every request, the IP address, the user agent, the referrer (the page the browser reports it came from), the timestamp and the requested URL, including the gclid parameter. Those are the fields Google itself asks for, and Google states that "[e]ven if you find several entries with the same GCLID, you will only be charged for at most one click," which gives the expert a usable rule: repeated requests carrying one GCLID are one billed click, however many visits the analytics show. Google Ads exports supply the billing side: the invalid clicks columns, the credit report, invoices and change history. Lead records tie GCLIDs to outcomes.
From those sources the expert builds a pattern opinion: clicks concentrated in a narrow IP range, at machine-regular intervals, from outside the targeted geography, with non-browser user agents, and a conversion rate that collapses during the spike. Each pattern maps to a GIVT or SIVT category, and the opinion should say which.
The same records cannot establish four things. They cannot show which clicks Google treated as valid or invalid: "Google Ads removes filtered invalid clicks from your reports, but your website analytics might still record the visit," so a visit in the logs is not a billed click. They cannot identify a clicker from an IP address, because Network Address Translation "allows hundreds or thousands of devices to share one public IP address." They cannot prove intent, for the reason the IAB stated in 2009. And they cannot treat a zero-second session as a bot, since "[m]any analytics tools require a second click to record visit duration." Google adds that third-party tools "might flag traffic as invalid" that it "already filtered and excluded from your bill."
In my experience the opinion that holds up states these limits in its own text: it describes the pattern, names the category, quantifies the clicks and spend that fit it, and says expressly that Google's click-level determinations were unavailable and that the platform may already have credited some portion. The opinion that fails asserts a dollar figure of fraud equal to every click a vendor tool flagged.
What still exists when the dispute arrives
Google's investigation window is 60 days; its Ad Traffic Quality advertiser page states that "Google disclaims all liability for traffic accrued 60 days prior to the date of requesting an investigation"; the contract's Claim Period is 60 days after the invoice date. A dispute that reaches counsel in month four has passed all three.
Reporting data lasts longer. Under the Google Ads Data Retention Policy, beginning June 1, 2026, hourly, daily and weekly data "will be available for 37 months," monthly and longer-period data "is available for 11 years," and after the retention period data "will not be accessible via the Google Ads interface or APIs"; the policy does not say the data is deleted. Change history covers "the past 2 years." Server logs rotate on the hosting provider's schedule, often measured in days, and they are the only click-level record the advertiser controls, so preserving them is the first step in any paid-search matter. Platform data beyond that arrives, if at all, by third-party subpoena, and the Singh sealing order is the precedent to expect: filter logic treated as trade secret under a protective order.
Frequently Asked Questions
Can I sue Google for click fraud on my Google Ads account?
Rarely in court, on the July 29, 2025 Advertising Program Terms. Section 8 makes a claim for advertising credits within 60 days of the invoice date the customer's sole remedy for clicks generated by third parties for improper purposes, waives claims not made in that period, and leaves credits to Google's reasonable discretion. Section 10 caps liability at the amount payable in the thirty days before the activity, and Section 13 requires individual AAA arbitration unless the customer opted out within 30 days of first accepting an arbitration version. No court holding Google liable for click fraud was located. Counsel is required to assess the terms in force on the dates at issue, including the July 1, 2026 revision.How do I prove a competitor is clicking on my ads?
Mostly from your own web server logs and analytics, since Google will not confirm which clicks it treated as invalid. The logs record each request's IP address, user agent, referrer, timestamp and the GCLID in the landing-page URL. An expert looks for repetition from a narrow IP range, machine-regular timing, clicks outside the targeted geography, non-browser user agents and a conversion rate that collapses during the spike, then maps the pattern to the MRC's GIVT and SIVT categories. The limits are real: Google notes that NAT lets thousands of devices share one IP address, so tying a pattern to a named competitor usually needs discovery from that party, not the logs alone.Does Google give you the IP addresses of people who clicked your ads?
No Google Ads report or export read for this page contains a per-click IP address or timestamp; the campaign reports show invalid-click counts and the Invalid Activity Credit Report shows credits by campaign and month. Google states that an investigation cannot confirm whether specific clicks were marked valid or invalid, because sharing that would expose how it detects invalid traffic. Google's documentation does not contain an express statement about IP disclosure, so the accurate description is that its reports carry no click-level record and it will not confirm click-level decisions. The IP addresses available to you are the ones in your own server logs.What is the difference between invalid traffic, click fraud, GIVT and SIVT?
Invalid traffic is Google's broad term for any activity that does not represent genuine interest, including accidental clicks, bots and manual clicks meant to raise costs. Click fraud, as the IAB defined it in 2009, is the subset generated for the purpose of manipulating click measurement or click-based payments; it requires intent, which the IAB says can rarely be known. The Media Rating Council's June 2020 addendum divides invalid traffic into General Invalid Traffic (GIVT), caught by routine list and parameter checks such as data-center IPs and declared bots, and Sophisticated Invalid Traffic (SIVT), which needs advanced analytics and human review, such as hijacked devices, click farms and falsified measurement events.Is there an arbitration clause in the Google Ads terms, and can I opt out?
Yes to both, under the July 29, 2025 United States terms. Section 13 requires individual arbitration of all disputes arising out of the programs, administered by the AAA under its Commercial Arbitration Rules and governed by the Federal Arbitration Act, after a written Notice of Dispute and a 60-day waiting period; class and representative claims are waived and evidentiary submissions are confidential absent good cause. Section 13(F) allows a customer to opt out by webform within 30 days of first accepting any version of the terms containing an arbitration provision. Google's help page says a July 1, 2026 revision changes the arbitration language, so check the version in force when the clicks occurred.How long does Google keep Google Ads click data and change history?
Under the Google Ads Data Retention Policy, beginning June 1, 2026, hourly, daily and weekly reporting data is available for 37 months and monthly, quarterly and annual data for 11 years; after that it is not accessible through the interface or API, and the policy does not say it is deleted. Change history covers the past two years only. Invalid traffic investigations cover only the last 60 days, and the contract's Claim Period is 60 days after the invoice date. Your own server logs, the only click-level record you control, rotate on the hosting provider's schedule, so preserving them is the first step.What can an expert establish about click fraud from my server logs?
A pattern, quantified and categorized, but not Google's billing decisions and not a clicker's identity. From the logs an expert can count requests by GCLID (Google charges at most one click per GCLID), isolate concentrations by IP range, timing, geography and user agent, compare conversion rates inside and outside the spike, and assign each pattern to an MRC GIVT or SIVT category. The opinion should state that Google's click-level validity determinations were unavailable, that Google may already have filtered or credited part of the traffic, and that zero-second sessions and shared IP addresses are not proof of automation on their own.Published