Full Answer

GA4's bot filtering is a checkbox in Admin → Data Streams → Configure Tag Settings, and it is on by default. It cross-references incoming hits against the IAB/ABC International Spiders and Bots List — a database of known crawler user-agents and IP ranges. That handles the obvious traffic: Googlebot, Bingbot, and similar declared crawlers.

The problem is everything the list does not cover. Thales reported that 53% of all internet traffic in 2025 was automated, up from 49.6% a year earlier. A growing share of that traffic comes from sophisticated bots — residential proxy rotators, headless browsers, and AI agents — that present valid cookies, execute JavaScript, and generate events indistinguishable from human sessions. GA4 counts these as real visitors because it has no server-side validation layer to challenge them.

The practical damage is compounding. Inflated session counts distort your cost-per-acquisition. Fake add-to-cart events pollute your funnel metrics. Audience segments built on bot sessions push your ad spend toward non-human lookalikes. A clean data set starts with event-level validation — inspecting each hit server-side before it enters your warehouse — so that every report, every model, and every audience is built from verified human activity. For a deeper look at what clean measurement means in practice, see Seresa's 24-Carat Data Standard.