Live: Samsung Unpacked Live Updates Galaxy S23 Ultra First Look Apple's iOS 16.3 Release 9 Ways to Celebrate Black History Month Best Indoor Plants HomePod 2nd-Gen Review 12 Best Cardio Workouts Salami, Sausage Recalled
Want CNET to notify you of price drops and the latest stories?
No, thank you

Questions mount as Facebook advertisers lose to clickbots

A relationship with a startup sours when 80 percent of pay-per-click ad traffic turns out to be costly, invalid traffic. The issue may not be isolated. Is Facebook doing enough to solve the problem?

On Monday, a startup revealed that it was ending its presence on Facebook, alleging it had paid the social network for a shocking amount of automated ad clicks. In its examinations, Limited Run charged that at least 80 percent of the clicks came from invalid traffic, or clickbots.

Facebook gets paid whenever someone clicks on an ad that advertises an ad client's page. It's called pay-per-click advertising.

The situation continued despite complaints to Facebook, and then when Facebook told Limited Run it would need to pay $2,000 monthly to be able to update the company's Page name, enough was enough.

Despite a sizable outcry from tech forums such as Reddit's r/technology and Hacker News, Facebook issued a troublingly unsatisfying statement -- and Limited Run has deleted its Facebook presence entirely.

But now it looks like Limited Run's claims were just the tip of the clickbot revenue inflation iceberg.

As Limited Run's statement made the Internet rounds, it was clear that it was absolutely standing by the claims that they'd been paying Facebook for the 8 out of 10 fake ad clicks. 

Meanwhile in the forums, a significant number of other Facebook ad buyers started to speak up with disturbingly similar and detailed stories.

The first red flag for Limited Run was JavaScript, or lack of it.

Limited Run's staff were accustomed to 1 to 2 percent of users coming in with JavaScript off. The fact that 80 percent users were clicking in with JavaScript off was a discrepancy that raised a big red flag.

Limited Run decided to put a logger on the site to track where the users were coming in from and what they were doing. From this, they determined 80 percent of the clicks from Facebook were bots.

...So we did what any good developers would do. We built a page logger. Any time a page was loaded, we'd keep track of it. You know what we found? The 80 percent of clicks we were paying for were from bots. That's correct.

Bots were loading pages and driving up our advertising costs.

So we tried contacting Facebook about this. Unfortunately, they wouldn't reply.

On the now-deleted Limited Run Facebook page Rob Wheatley stated:

Same problem here. Only 40 percent of the clicks I'm charged for actually result in any request to my site (using the Apache logs and Google Analytics to check). Of those, I get a 92 percent bounce rate (same ad elsewhere results in a <20 percent bounce rate). 

I've targeted the ad with various things including location, restricting the ad to the U.K. only, but 7 percent of the traffic that hits comes from other countries. Looking at the bounces, most do not request all elements on the requested page.

Over on Reddit, this sounded all too familiar to playing card retailer Alex Issacs who wrote:

I can confirm this. I used Facebook to advertise my page and went from ~2,000 fans to over 6,000 within several months...Guess what?

Bots/hijacked accounts/fake accounts. How do I know? Many of them have NO friends. Then I noticed something really scary...repeats. Actual pictures showing up more than once for new likes. Very, very few of the accounts were from the USA...

I ended the ad program recently and the bots stopped.

Professional pay-per-click campaign manager Bryce Hanson chimed in:

I realized this with my company's page. We have been advertising for several months and have grown from 0-3,000+ likes. Choosing any fan at random leads to a profile of someone that "likes" thousands of other incongruous pages.

We're discontinuing Facebook advertising this month and increasing our spend in AdWords. I suggest other businesses do the same.

While not exactly Limited Run's methodology, another former Facebook advertiser offered yet another story:

I did a full blown ad campaign on Facebook for a popular rock band in Asia, with a fairly large budget. I ended up suspending the campaign after just a few days when the expenses ran up into the hundreds of dollars per day, with very, very few verifiable visits (e.g. getting full visitor data). 

As a last ditch effort I even made it so that the page required you to have JavaScript enabled otherwise it would display a blank page. We served up literally tens of thousands of white pages.

Also another point, the false/bot visits we got lasted only seconds (e.g. bot loads page, exits without follow through), whereas real verifiable visits lasted anything from 10 seconds to many minutes, with follow up clicks and "normal" visitor behavior.

Click fraud or invalid traffic?

Three weeks ago the BBC conducted its own Facebook ad click experiment, with suspect results and an interesting observation about geographic locations of the fakes.

Within 24 hours, VirtualBagel had acquired over 1,600 likes...

Nearly all of the "likers" came from India, Egypt, Indonesia and the Philippines. The statistics showed that the page was most popular in Cairo, with 75 percent of "likes" coming from 13- to 17-year-olds.

Some of those liking the page did not appear to be who they said they were.

One user, who called himself Ahmed Ronaldo, listed Real Madrid as his employer, and featured the footballer Cristiano Ronaldo as his profile picture. Mr Ronaldo also likes more than 3,000 other pages.

Interestingly, geographic demographics for "wet bots" such as Mechanical Turks (clicks for hire) show that most "Turks" are coming from India (the cheapest labor), and the Daily Beast priced them in Egypt, the Philippines and other available locations.

Weeding out clickbots is certainly a challenge and there is a lot of debate about identifying and eradicating them.

Google's position on fake clicks is strong, and to its credit Google strongly outlines the harm clickbots do to advertisers and the PPC ecosystem -- and how allowing the behavior hurts long tail business strategies for everyone involved:

By maintaining our advertisers' trust and providing a level playing field for all participants in the auction, we make it easier for advertisers to accurately plan their spending and calculate bids which make economic sense for their business. This predictability results in better return on investment, which can lead to increased spend.

A serious question in the background remains: whose bots are they?

Limited Run was emphatic to state that they were not saying Facebook was behind the bots. Some commenters suggested that Limited Run was the victim of a malicious competitor, who had perhaps hired bots to harm Limited Run. 

However, in light of the fact that this doesn't seem to be an isolated incident or genre-specific, this argument has no weight.

Only those with access to richer data might be able to find out who created these bots, and why.

Is Facebook doing enough?
Though while pay-per-click giant Google aggressively goes after bots and fake click scams, Facebook's inactivity might look like the social media behemoth is turning a blind eye to the problem.

After all, it's certainly true that Facebook has an abundance of detailed information on users clicking on ads, including (but in no way limited to) their user behavior across multiple websites, friends, posts, location, 'non ad-click activity' to 'ad-click activity' ratio) which could be used to split a percentage of humans from clickbots or Mechanical Turks.

Company filings published this week reveal that Facebook knows it has more than 83 million "illegitimate" accounts -- 8.7 percent of its "active" user base.

Unfortunately, some advertisers have decided that whatever Facebook might be doing about the problem, it's just not enough to keep their business.

Facebook has been reached for comment and updates. Responses will be published in this article.