TL;DR
- Digiday reported on 8 September 2026 that Cloudflare data puts bots and AI agents at more than half of all web requests.
- A media agency president said e-commerce clients saw bot traffic rise 80 percent year on year, with performance degrading from Q4 last year.
- Narrowing retargeting parameters to exclude suspect traffic raised that agency's average CPM by 20 percent.
- AI agents add to carts and sign up to newsletters, so filters built to catch visits that bounce no longer catch them.
- A pillow brand founder said he prefers classifying automated traffic to blocking it, and Reuters reported John Lewis agentic searches rose from 0.3 to 2.5 percent of visits in a year.
Automated agents and bots now account for more than half of all web requests, according to Cloudflare data cited by Digiday in a report published on 8 September 2026, and marketers quoted in it disagree about what to do with them. One media agency president told Digiday that his e-commerce clients had seen bot traffic rise 80 percent year on year, that retargeting tools were funnelling media spend toward what turned out to be bots, and that narrowing retargeting parameters to keep them out raised average CPM by 20 percent. A direct-to-consumer brand founder quoted in the same piece said the opposite: he is less interested in blocking automated traffic than in classifying it, because AI assistants already send him traffic that converts several times better than his site average.
What Digiday reported on 8 September 2026
The article, written by Sam Bradley, is built on interviews with agency executives and one brand founder about a measurement problem rather than a platform announcement. Nobody launched anything. The change being described is in the composition of web traffic itself, and the figure at the centre of it is the Cloudflare one: taken together, agents and bots pass more than half of all web requests.
That is a statement about requests, not about buyers. It does not mean half of a given site's visitors are bots, and Digiday does not claim that. What it does mean is that any audience assembled by dropping a pixel on a site and collecting whoever shows up is now being assembled from a stream in which non-human requests are the majority at the protocol level. Retargeting pools, lookalike seeds and site-visitor custom audiences are all built exactly that way.
Why the old bot filters stopped catching them
The mechanism named in the reporting is specific and worth understanding, because it explains why heuristics that worked for years stopped working. David Dweck, president at a media agency, told Digiday that AI agents make the problem harder than classic bots did, because an agent can add items to a cart and sign up to a newsletter. Filters built to catch a bot that lands on a page and bounces do not fire on a session that browses, adds to basket and submits a form. On every behavioural signal those filters use, an agent looks like a good visitor.
Dweck said this poisoned retargeting: the tools kept spending against those sessions, and costs per acquisition spiked. He put the start of the degradation in the fourth quarter of last year, dragging into this year. The timing is easy to misread. A performance decline that starts in Q4 gets attributed to seasonality, to a creative refresh, to an algorithm change or to a competitor. It is a plausible period to have misdiagnosed.
The costs named in the reporting
The clearest number is the one on the fix rather than the problem. Dweck said his clients narrowed their retargeting parameters to exclude suspect traffic, and that doing so increased average CPM by 20 percent. Tightening an audience makes it smaller and more expensive per thousand impressions, so a cleaner pool costs more to reach. Anyone deciding whether to do the same should treat 20 percent as the reported price of that decision at one agency, not as a benchmark.
Other executives quoted described damage further along the chain. Mallory Beck, a vice president of client services, told Digiday that bot activity can inflate impressions and conversions, make campaigns look better than they are, muddy lookalike audiences and eat into frequency caps. That is four separate failures from one cause: reported performance goes up, the seed list you train targeting on gets worse, and impressions you paid to cap on real people get spent on requests that were never people. Colin Maduzia, a senior vice president of experience and product strategy, said rising bot traffic is also driving fraudulent purchases and confusing analytics and attribution.
Some advertisers left rather than tightened. Nola Ladd, a brand media supervisor, said three of her clients had been affected and that bot traffic was the final nail in the coffin for retargeting at one of them, which moved spend to retail media and social. Megan Herling, an executive director of media, told Digiday that clients had cut retargeting as performance declined, and named bots alongside privacy updates and data opt-outs as reasons scale had fallen. Others in the piece moved budget out of programmatic entirely and toward Google, Amazon and Meta.
The counter-argument: classify, do not block
The most useful part of the reporting is that it does not land on one answer. Chad Keller, co-founder of the direct-to-consumer pillow brand Mellow Sleep, told Digiday that his company is less interested in blocking automated traffic than in classifying it, because traffic arriving from AI assistants already converts several times better than his site average. Blanket blocking would throw that away.
Digiday supported the point with a figure from a Reuters report: at the British retailer John Lewis, AI agentic searches rose from 0.3 percent to 2.5 percent of all web visits in a year. That is still a small share, and the growth rate is the interesting part rather than the level. It also makes the distinction real. Some automated traffic is a scraper or a fraud operation. Some of it is a shopper who sent an assistant ahead of them. Treating both as noise costs money in one direction and treating both as buyers costs money in the other.
Tim Lathrop, a vice president of platform digital, pointed to pre-bid verification and inclusion lists as the remedies on the buying side, which is a supply-quality answer rather than an audience-hygiene one.
The reported figures in one place
Every figure below appeared in Digiday's report of 8 September 2026 and is attributed there to the person or source named.
| Figure reported by Digiday, 8 September 2026 | Value |
|---|---|
| Share of all web requests from bots and agents, per Cloudflare | More than half |
| Year-on-year rise in bot traffic across one agency's e-commerce clients | 80% |
| Change in average CPM after narrowing retargeting parameters | Up 20% |
| John Lewis agentic search share of web visits, over one year, per Reuters | 0.3% to 2.5% |
| Clients one executive said were affected by bot traffic | Three |
What the report did not say
There is no Thailand figure in the piece, and no bot-share breakdown by country or region at all. The Cloudflare number is global and stated as a share of web requests, so it cannot be converted into a share of any individual advertiser's traffic. Do not let a vendor quote it back to you as if it described your account.
The reporting also does not name a tool that reliably separates AI agents from human visitors, does not say what proportion of the 80 percent rise was agents rather than ordinary bots, and does not quantify how much of the reported CPA increase was caused by bots rather than by the privacy changes and opt-outs mentioned alongside them. It is a set of practitioner accounts, not a controlled study, and one of the practitioners quoted disagrees with the others about the conclusion.
What to check in your own account
The story gives you a pattern to test rather than an instruction to follow. The signature is an audience that grows while the outcomes built on it do not.
- Compare audience size against conversions over the same window. If your site-visitor remarketing list has grown month on month while conversions from it have been flat or falling, the extra members are not buying, and inflated membership is the reported symptom.
- Look at sessions with an add-to-cart or form submission but no downstream behaviour that a human produces, since agents were reported to complete exactly those actions.
- Check whether cost per acquisition on remarketing campaigns started drifting in the fourth quarter of last year, which is the window one agency president gave for the degradation, and compare it with your prospecting campaigns over the same period. A divergence between the two points at the audience rather than at the market.
- Look at your frequency reports. Caps burned against non-human requests mean real people saw fewer impressions than you paid for, which shows up as reach falling while frequency holds.
- Segment traffic by referrer and look at what arrives from AI assistants separately before deciding to exclude anything, because the counter-example in the reporting is a brand whose assistant-referred traffic converts above site average.
Most of this is visible in a properly configured analytics property, and a lot of accounts cannot run these checks because their measurement was set up to count sessions rather than to segment them. If your GA4 setup cannot show you conversion rate by referrer and by audience over a 12 month window, the audit above is the first thing it should be able to do.
What this means for Thai marketers
The Cloudflare figure is a global share of web requests and Digiday gives no Thailand number, so nothing here says what proportion of a Thai site's traffic is automated. The mechanism, however, does not care where the server is. Any remarketing audience assembled from site visitors is assembled from the same public web, and an agent that fills a cart on a Bangkok e-commerce site looks exactly as human to a pixel as one filling a cart in Chicago.
The part that translates most directly is the cost trade-off. Thai advertisers running remarketing on small audiences already sit close to the minimum size thresholds the platforms enforce, so tightening parameters can push an audience under the threshold and stop delivery entirely rather than merely raising CPM by 20 percent. Checking audience size before tightening is worth more here than the tightening itself.
The second consideration is where budget goes if remarketing is cut. Several advertisers in the report moved spend to retail media, social and the large platforms. In Thailand the equivalent shift runs toward marketplace advertising and LINE, and it carries its own measurement questions rather than solving the one described here. If you are weighing that move for an online store, the audience question and the channel question are worth answering together with your ecommerce marketing plan rather than separately.
Frequently asked questions
Does this mean half my website visitors are bots?
No. The Cloudflare figure cited by Digiday describes more than half of all web requests across the web, not the visitor mix of any individual site. Requests include crawlers, API calls and automated fetches that never resemble a session in your analytics. Your own share can only be established from your own data, and the report gives no per-site or per-country breakdown.
Is there a figure for bot traffic in Thailand?
No. The source gives no Thailand-specific or regional bot-share figure, and no breakdown by country. Anyone quoting a Thai bot percentage sourced to this report is inventing it.
Should I turn off retargeting?
The report does not recommend that, and the practitioners in it did different things. Some narrowed their retargeting parameters and accepted a 20 percent higher average CPM, some cut retargeting and moved budget to retail media and social, and one brand founder said he would rather classify automated traffic than block it because assistant-referred visits convert above his site average. The decision depends on what your own audience-versus-conversion data shows.
How do I tell an AI agent apart from a human visitor?
The report does not name a reliable method, which is part of why the executives quoted are split. It does state the behaviour that defeats older filters: agents were reported to add items to carts and sign up to newsletters, so a filter that only catches visits that bounce will not catch them. On the buying side, one executive pointed to pre-bid verification and inclusion lists.
Do I have to do anything this week?
Run one comparison: audience size against conversions from that audience over the last 12 months. If the list is growing and the conversions are not, you have the symptom described in the report and a reason to look further. If both move together, this story is context rather than an action item.
Where to take this next
The honest summary of the reporting is that the composition of web traffic changed faster than the filters built to describe it, and that the industry has not settled on whether the answer is exclusion or classification. What the people quoted do agree on is that audiences built from raw site visitors now carry automated sessions that behave like buying intent, which is what the older filters were never built to separate. If you want to know whether your own remarketing pools show the pattern, the check is a comparison you can run this week in your analytics, and it is worth running before any budget moves.
