One in Four TikTok Ad Clicks Fails an Invalid-Traffic Test. Measure Yours Before Buying a Tool

If you spend under about $5,000 a month on ads, do not buy click-fraud protection yet. Measure first, using data you already own: the gap between the clicks a platform bills you for and the sessions your own analytics records. That single number tells you more about your exposure than any vendor benchmark, it costs nothing, and it takes an afternoon. Vendor research published this month puts invalid traffic at 24.20% of TikTok ad clicks and 7.57% of Google's, which sounds like an emergency until you work out what a tool costs against what it could recover on a small budget. Below is the order of operations: measure, then use the free controls, then escalate, and only then pay someone.

Step 1: Find your click-to-session gap

Every ad platform reports clicks. Your analytics reports sessions. The two will never match exactly, because of tracking blockers, people who bounce before the page loads, and cross-device weirdness. But the size of the gap is diagnostic, and the trend in the gap is more diagnostic still.

Pull 30 days of clicks per campaign from the ad platform. Pull sessions for the same period, segmented by the same campaign, from GA4 or whatever you use. Compute the gap as a percentage: (clicks minus sessions) divided by clicks. Write it down per campaign, not per account, because invalid traffic clusters in specific placements.

A gap in the 10% to 20% range is ordinary. A gap above 40% on one campaign while your other campaigns sit at 15% is a signal, and the campaign is where you look next. A gap that jumps 20 points in a week without a matching change in your targeting is the strongest signal of all.

Step 2: Check the gap against the placements underneath it

The single most common source of junk clicks on Google is the Display Network and its automatically selected placements, and the most common source on any platform is a geography you did not intend to target. In Google Ads, open the campaign, then Content and Where ads showed for display and Performance Max placements. Sort by cost. Look for apps and sites with high click volume and no conversions at all, which is the classic profile.

Do the same for geography. In Insights and reports, then When and where ads showed, check the user locations report against your targeting. Google's help page on invalid traffic explicitly lists "clicks outside of location targeting" as one of the patterns worth escalating, which tells you it is common enough to name.

Step 3: Use the controls that are already free

Two of them matter, and both are underused.

Exclude the placements. Add every zero-conversion, high-cost placement you found to a shared exclusion list so it applies across campaigns rather than one at a time. This is dull work and it is the highest-return hour in the whole exercise.

Exclude IP addresses. Per Google's documentation, you can exclude up to 500 IP addresses per campaign. The campaign path is Campaigns, then Settings, select the campaign, then Additional settings, then IP exclusions. There is an account-level equivalent under Admin, then Account settings, then IP exclusions, and it is the more useful of the two: campaign-level exclusions are not available for video, hotel, App, Performance Max or Smart Display campaigns, while account-level exclusions apply across Performance Max, Demand Gen, Search, Shopping, Display, Discover and YouTube. You can use an asterisk in place of the last three digits to exclude a block of addresses rather than adding them one by one.

Two limits to be honest about. Five hundred addresses is a small number against a rotating residential proxy pool, so IP exclusions handle the lazy attacker and the annoyed competitor, not the professional operation. And excluding your own office IP is worth doing regardless, because your team's own testing clicks are invalid traffic in the accounting sense even though nobody is committing fraud.

Step 4: Read what the platform already credits you

Google's position, on its own invalid clicks page, is that "You won't be charged for invalid clicks or impressions as they provide little or no value. When Google determines that clicks are invalid, we try to automatically filter them from your reports and payments." Its definition is broader than fraud: "Clicks on ads that aren't the result of genuine user interest, including intentionally fraudulent traffic and accidental or duplicate clicks."

The important word is "try". Filtering happens before billing for what Google catches, which means the invalid clicks you are paying for are by definition the ones its filters missed. That is also exactly what independent measurement claims to capture, and it explains why vendor numbers and platform numbers can both be accurate while disagreeing.

If the pattern persists after you have excluded placements and IPs, Google names the escalation route: "you can submit an investigation request using the Click Quality Form". Submit it with the campaign, the date range, the specific placements or IPs, and your click-to-session evidence attached. A form with numbers on it is treated differently from a form with a complaint on it.

Step 5: Decide whether a tool is worth it

Here is where the published rates become useful rather than alarming. Lunio's 2026 report, based on "2.7 billion clicks across six major ad platforms" measured with "unprotected, monitor-only campaigns to capture the IVT that slips past native platform filters", reports these rates by platform:

Methodology and caveats, because they change how you should read the table. The percentages come from Lunio's published summary, opened 27 July 2026. Lunio sells invalid-traffic protection, so it has a commercial interest in the number being large. The sample is drawn from accounts it monitors rather than from the platforms at random. Its definition includes "bot farms, automation tools, and affiliate arbitrage schemes" plus accidental clicks, which is wider than fraud. And the opened page does not state the measurement date range. Treat the ranking between platforms as more reliable than the absolute levels: the finding that TikTok and LinkedIn are three times worse than Google is consistent with how those inventories are assembled, and it is actionable even if the exact percentages are generous.

Now the arithmetic, ours. A protection tool at $200 a month spent against a $3,000 Google budget has a theoretical ceiling of $227 in monthly recoverable waste, and that assumes the tool catches every single invalid click and that none of them would have been filtered anyway. It will not, and some would. The same $200 spent against a $3,000 TikTok budget has a $726 ceiling, which leaves genuine room. The rule that falls out: a paid tool starts making sense when your monthly spend on a single high-IVT platform exceeds roughly ten times the tool's monthly price. Below that, you are buying a dashboard.

The threshold, stated plainly

Run the measurement quarterly and act on three triggers. If a campaign's click-to-session gap sits more than 20 points above your account average, exclude its placements. If your spend on TikTok, LinkedIn or programmatic display passes ten times what a protection tool would cost, buy the tool and let it prove itself against your own baseline in the first 60 days. And if clicks rise while sessions stay flat for more than a week, file the Click Quality Form the same day, because the evidence you need is the evidence you have just finished collecting.

The wider habit here is measuring your own traffic rather than accepting a platform's account of it. We made the same argument about organic search in measuring your own AI Overview click loss, and about email deliverability in Google's sender rules. Paid channels are the one place where the discrepancy has a price tag attached, which is a reason to check it more often, not less. If paid is carrying more of your acquisition than you would like, the case for publishing is the longer answer.