How to find bot and AI agent traffic in Google Analytics 4

Agentic traffic is changing what your visitor numbers mean. AI agents now browse sites and fill in forms for the people who send them, and many of them run inside an ordinary browser. Google Analytics 4 counts that visit the same way it counts a person, so your engagement and conversion rates can drift while the business underneath stays the same. This guide starts with what GA4 already does about bots and the checks you can run yourself, then shows how to get a true split between human and automated traffic.

Does GA4 filter bot traffic?

Yes, for bots it already knows about. GA4 automatically excludes traffic from known bots and spiders, which Google recognizes using its own research and the IAB International Spiders and Bots List, according to Google's Analytics help page on known bot traffic. The exclusion runs on every property and stays on. GA4 also gives you no figure for how much traffic it removed, so the filter works quietly and you see only what remains.

Why AI agents get through

The known-bot list catches crawlers and scripts that announce themselves or come from recognized sources. An AI agent working inside a real browser behaves differently, because it loads your pages, runs your tags and fires the same events a visitor would. It also sits outside the known-bot list, so GA4 records it as a user.

Edge bot checks have a similar gap. They look at the request and ask whether it came from a real browser, and an agent running in a real browser with a clean connection answers yes. What separates the agent from a person is how the visit behaves on the page, which is the layer GA4 reports on without judging.

How to check bot traffic in GA4

GA4 has no single report for agent traffic, so the work is to look for patterns that real people rarely produce. Each of the checks below uses standard GA4 reports, and together they tell you whether automated traffic is likely shaping your numbers.

1. Compare engagement by channel. Open Reports, then Acquisition, then Traffic acquisition. Look at engagement rate and average engagement time for each session default channel group. A channel with a sudden jump in sessions alongside very low engagement time, or with engagement times that look unusually uniform, deserves a closer look.
2. Match traffic spikes against conversions. In the same report, add your key events as a column and set the date range around any spike. People who arrive in a wave from a real campaign tend to convert at something close to your usual rate. A spike that adds sessions and leaves key events flat often points to automated visits.
3. Watch Direct and Unassigned. Agents often arrive without a referrer or campaign tags, so their sessions land in Direct, and sessions GA4 cannot place land in Unassigned. Growth in either channel with no matching change in your marketing is worth investigating.
4. Look for unusual locations. Open Reports, then User, then User attributes, then Demographic details, and switch the dimension to Country or City. Traffic concentrated in a city where you have no customers, especially one that hosts large data centers, is a common sign of automation.
5. Check screen resolution and browser. Open Reports, then Tech, then Tech details, and switch the dimension to Screen resolution, then to Browser. Automated browsers often report a default window size, so one resolution taking a large share of sessions, or a browser version far older or newer than the rest of your audience, stands out.
6. Combine the signals in Explore. In Explore, start a free form exploration with Session default channel group, City and Screen resolution as rows, and add Sessions, Engagement rate and Key events as values. This puts the patterns side by side, so a cluster with high sessions, low engagement and no key events is easy to find.

Each of these checks points to likely automation, and none of them confirms it. A real customer can browse from a data center city on a work VPN, and a campaign can underperform for ordinary reasons. That uncertainty is the limit of what GA4 can tell you on its own.

How to exclude bot traffic in GA4

GA4 gives you fewer controls here than most people expect. Data filters, under Admin, then Data collection and modification, then Data filters, support two filter types, internal traffic and developer traffic. You can use the internal traffic filter to exclude IP addresses you define in your data stream's tag settings, which suits a known source such as an office network or a monitoring service you run yourself. A data filter changes what GA4 keeps from the moment it is active, so test it in its testing state before you switch it on.

For everything else, the practical route is to view your reports without the suspicious traffic. In Explore, build a segment that excludes the cities, resolutions or channels you flagged above, and compare your key metrics with and without it. This leaves your raw data untouched and gives you a cleaner working view, though it still depends on how well the patterns you chose match the traffic you meant to remove.

What is agentic traffic?

Agentic traffic is visits from AI agents acting for people, such as browsing products, comparing prices, filling in forms, signing up or checking out. It arrives in two forms. Some agents declare themselves with a signed request or a known user agent, so a site can identify the agent and decide how to treat it. Others act like a person's browser, and analytics counts them as visitors. The second group is the one that skews your metrics, because it looks like your audience. You can read more on our agent traffic page.

How fast is agentic traffic growing?

Quickly. In Welcome to the B2A economy, published by a16z on 11 November 2026, Olivia Moore and Justine Moore cite industry data showing agentic browser traffic grew 8x between August and October 2026. They also report that AI-driven traffic to Shopify stores grew eightfold year over year in the first quarter of 2026. Both figures point the same way, toward a growing share of your sessions coming from software working for someone.

Should you block AI agents?

Blocking everything is a tempting first move, and it costs you the agents that bring real customers. The same a16z piece notes that most enterprises still block agent traffic over fraud and chargeback concerns, and argues that "they'll have to embrace an increasingly valuable wave." An agent comparing your prices or completing a purchase is often doing exactly what a customer asked it to do. The better first step is to measure how much agent traffic you have and where it goes, then decide what each agent may do.

Get a true split of human and automated traffic

Passive Signals read every visit in the background and report how much of your traffic is human and how much is automated, AI agents included. Each visit lands in one of three groups: human, automated, or not enough to tell. They run in shadow mode, so your visitors see no change and nothing is blocked while you read the report.

Passive Signals look at how the visit behaves on the page, which is the layer an agent in a real browser has to pass through. That lets them flag an agent running in a real browser with a clean IP address and genuine cookies. In our lab, we caught 99% of AI-agent runs (290 of 292), including 59 of 59 from agent tools we never tuned on, while flagging under 1% of real people (3 of 523 visits).

With that split in hand, you can read your funnels and sign-up numbers knowing how much of each one came from people. Passive Signals are free to start, and you can sign up here.

Step two: decide what agents may do

Once you can see your agent traffic, the next question is what each agent may do on your site. Proof of agent gives you a choice for every action that matters. You can let an agent act when the action is low risk, ask the real, unique person behind the agent to approve with a quick, anonymous HumanCheck, or block the agent. Proof of agent runs on your site through AgentCheck, which is in early access.

GA4 will keep telling you how many sessions you had. Passive Signals tell you how many of them were people, and proof of agent lets you decide what the rest may do.