Google has published a Google Ads Help Centre page stating that its invalid traffic filters do not, by themselves, stop bogus submissions from reaching advertisers' lead forms. The page places reCAPTCHA, double opt-in email confirmation and server-side validation on the advertiser's side of what the company calls a shared responsibility. PPC News Feed reported the document on September 17, 2026.

In Short

Google wrote down that its anti-bot systems mostly judge ad clicks after the ad has already shown, so bots and careless people can still fill in a company's contact form. That matters for any business paying Google to find customers, because junk form entries land in sales lists and can teach Google's automated bidding the wrong lessons. Google now says checking those forms, with tools such as reCAPTCHA and email confirmation links, is partly the advertiser's job.

What Google put in writing

The page, titled "Prevent invalid leads", sits under the Fix issues and Reporting issues sections of the Google Ads Help Centre. It carries a 2026 copyright line and no publication date. PPC News Feed, the publication that first surfaced it, credited Hana Kobzová with spotting the page and described it as a document for lead generation advertisers that "emphasizes that maintaining high lead quality is a shared responsibility."

Google's own wording is blunter than most of its help material. According to Google, Google Ads removes invalid trafficto protect advertiser budgets, but "these filters don't prevent invalid leads on their own." The reason given is timing. "Most traffic checks happen after your ad serves," the page states. Because of that, according to Google, users or bots can still reach a website and submit junk or low-quality forms, and real people can enter incorrect details such as invented email addresses or phone numbers.

That sentence describes two separate problems. One is automated: scripts that reach a landing page and post data. The other is human: genuine visitors who type a false address to get past a gate. Google's filters, which exist to decide whether a click is billable, were never designed to judge the second category at all.

The page then lays out what Google says it does. It describes a multi-layered defense system with two parts. The first is automated protections, filters that continuously scan traffic data for interactions that do not match human behaviour, backed by a specialised Ad Traffic Quality team that runs manual investigations. The second is policy enforcement. According to Google, it rejects sites or apps that violate its policies, performs regular checks on its network, and "may suspend or remove publishers for policy violations, including invalid traffic-related policies."

No numbers accompany any of it. The page gives no detection rate, no share of traffic screened before serving as opposed to after, and no indication of how long post-serve reviews take. It also offers no data on how often invalid leads occur across Google Ads lead generation campaigns.

Billing credits are not lead cleanup

A supporting change arrived on a second Google page. According to PPC News Feed, Google revised its "About invalid traffic" documentation to clarify that "any invalid traffic detected before the month-end billing is excluded from charges, preventing the need for refunds." Where invalid traffic is identified after billing, PPC News Feed reported, Google issues credits that appear as adjustments on future invoices. Google's About invalid traffic page also states that advertisers can request an investigation into activity from the previous 60 days, and that the Invalid clicks column in campaign reports shows traffic already filtered and not charged.

The distinction matters because a credit reverses a charge. It does not delete a form submission from a customer relationship management system, and neither of the two Google documents says whether a conversion recorded from a click later classified as invalid is removed from the data Smart Bidding learns from. The prevention page leaves that question unaddressed.

Campaign-level visibility into those credits is recent. Google published help documentation for the Invalid Activity Credit Report on June 1, 2026, breaking credits down by campaign and network with adjusted performance metrics, though coverage is limited to Search and Performance Max. Native controls have their own limits: in April 2026, a Spanish agency showed that Google Ads IP exclusion lists could be bypassed by separating the address that harvests a valid click identifier from the one that later uses it.

Three controls at the form

The technical section of the page lists three measures under the heading "Implement technical safeguards on lead forms". Each is described in a sentence or two, and none comes with configuration detail.

reCAPTCHA

The first instruction is one line: integrate reCAPTCHA, Google's own CAPTCHA service, on web forms. The page does not specify a version, a score threshold or where in the submission flow the check belongs. Neither Google document raises consent, although European advertisers face a live question there. An Austrian court decision reported by PPC Land in April 2025 found that Google reCAPTCHA required consent before it could lawfully run, which places the tool Google now recommends inside the same consent flow as advertising tags.

Double opt-in

The second measure is double opt-in. According to Google, when a user submits a form, an automated email carrying a unique confirmation link is triggered. The lead is marked as valid, or advanced into email sequences, only after the link is clicked. Google says this confirms the address is "real, active, and human-monitored."

The mechanism adds a gap between the form submission and the point at which a lead is treated as genuine. Google's documents do not say which of those two moments the advertiser is expected to report as the conversion.

Server-side validation

The third measure addresses the attack the other two cannot. According to Google, sophisticated bots can bypass browser controls and post data directly to a form endpoint, skipping any check that runs in the visitor's browser. The page tells advertisers to have developers write server-side validation scripts. Under Google's specification, the server must verify that email addresses have valid domains and that phone numbers match legitimate regional formats before it accepts the submission and pushes it to the CRM. The page does not define what a valid domain check involves.

None of the three measures is new advice. On October 18, 2022, the Google Ads Liaison account replied to an advertiser reporting junk leads from Performance Max by listing the same three measures - server-side validation, double opt-in and reCAPTCHA - according to Search Engine Roundtable. What has changed is the format. A reply on social media has become a standing help page with its own place in the documentation tree.

Lead goals and the protections they trigger

The second half of the prevention page covers campaign settings. It directs advertisers toward lead-specific goals, naming Qualified lead, Converted lead, Book appointment and Request quote, alongside the Google tag, enhanced conversions and content suitability controls, including content, placement and brand exclusions.

A linked page, "Best practices for generating high-quality leads", explains why the goal choice matters. According to Google, goals such as qualified lead, converted lead, book appointment or request quote "automatically trigger invalid traffic protections, built specifically for lead generation campaigns." Neither document describes what those protections do. The claim itself has a history: PPC Land reported in February 2024 that Google's Performance Max lead generation guidance already described qualified lead and request quote goals as triggering built-in protections against invalid traffic.

The best practices page sets numeric conditions for the conversion action used in bidding:

  • Conversion volume: at least 15 conversions in the last 30 days at account level.
  • Data freshness: conversion data uploaded regularly, ideally daily, where enhanced conversions for leads or offline conversion imports are used.
  • Conversion delay: ideally, a conversion action that happens within seven days of the ad interaction.

Google also tells advertisers to avoid selecting goals from multiple stages of the lead journey for optimisation. Those thresholds pull against each other in lead generation. A qualified or converted lead is typically confirmed by a sales team after review, which can take longer than seven days and generates fewer events than raw form fills. Offline timing has consequences of its own, as PPC Land reported when it found that Google Ads attribution ignores offline conversions uploaded after 7 days.

The data plumbing behind it

According to Google, advertisers using offline conversion imports can upgrade to enhanced conversions for leads, which grounds measurement in first-party data rather than the Google click ID and adds tracking of engaged-view and cross-device conversions. The page also points to Google Ads Data Manager, which Google says simplifies tag implementation, connects to CRM partners such as HubSpot and Salesforce, and eases use of Customer Match and enhanced conversions for leads.

That path has been narrowing on the developer side. Google said in May 2026 that the Google Ads API would stop accepting new adopters of offline conversion imports from June 15, 2026, including enhanced conversions for leads, directing new integrations to the Data Manager API. Google also merged its enhanced conversions products into a single toggle during 2026.

The best practices page adds a native lead journey mapping tool, built through data import or a drag-and-drop interface, where advertisers attach conversion actions, untracked steps and business metrics such as conversion values and delays to each stage. Lead journey mapping was part of the 42 lead generation announcements Google tied to Marketing Live 2026on May 20, 2026.

Reach recommendations beside the safeguards

The same best practices document spends most of its length on expanding reach. It recommends value-based bidding through Maximise conversion value or Maximise conversion value with Target ROAS where leads can be assigned different values, and target cost-per-acquisition bidding on qualified or converted leads where they cannot. It recommends broad match with Smart Bidding in Search. It recommends Performance Max to collect leads across Search, YouTube, Display, Discover, Gmail and Maps from one campaign, and Demand Gen on YouTube, Discover and Gmail with what it calls "social-like CPA or ROAS targets". Lead form assets and call assets, which let people submit details or call from inside an ad, appear as a tip.

Those are the settings that widen the pool of queries and placements a campaign can reach, and wider pools carry different traffic. The October 2022 exchange began with an advertiser describing junk leads from Performance Max. Independent measurement has since pointed the same way in one vertical: invalid traffic detection company Lunio found in August 2026 that retail search campaigns running AI Max carried 72% more invalid traffic than standard search in the same accounts, at 5.28% against 3.07% in the second quarter of 2026. That dataset covers retail rather than lead generation, and Lunio sells detection tools.

The budget guidance reads in one direction. According to Google, CPA or ROAS targets act as spend levers, and campaigns constrained by budget leave conversions uncaptured. The page ends with a footnote - "Source: Google Data, Ads, May - June 2024" - that is not attached to any visible figure in the text, so the statistic it once supported is no longer identifiable.

There is also a tension with Google's own recent claims. At Marketing Live 2026, Google said it had significantly upgraded its invalid activity filtering, describing a more proactive model that blocks invalid interactions faster. Four months later, the prevention page states that most traffic checks happen after the ad serves. The two statements are not necessarily incompatible, since faster post-serve detection is still post-serve, but the help page is the more specific of the two.

Why this matters for the marketing community

For lead generation advertisers, the cost of an invalid lead extends beyond the click. A bogus submission consumes sales time, sits in the CRM, and, if uploaded as a conversion, becomes a training signal for automated bidding. That feedback loop is the concern marketers themselves rank highest. In Lunio's survey of 131 senior marketing leaders, released on July 15, 2026, 51.1% selected automated bidding optimising toward non-human converters as a top agentic AI risk, 22.9% named sales time lost to bot-generated lead forms as the most damaging cost, and 22.1% named corrupted CRM data. The same survey found 38.9% rated their trust in platform invalid click credits at 4 or below out of 10, while only 5.3% ran a dedicated invalid traffic tool.

Google has spent 2026 moving lead quality work into its own interface. In April, AI-qualified call conversions replaced call duration as the primary phone lead signal, analysing recordings to filter spam calls before they reach Smart Bidding. On June 1, Google added a dedicated Leads screen inside the Conversions section for Google-hosted form leads. Those tools cover calls and forms Google hosts. The prevention page covers the remainder: forms on the advertiser's own website, where Google's reach ends at the click.

Fraud around lead forms also runs in other directions. In April 2026, PPC Land documented scammers targeting Google Ads agencies with fabricated client enquiries submitted through agency contact forms to gain manager account access. At platform scale, Google reported in August 2025 that Gemini-based detection had delivered a 40% reduction in mobile invalid traffic from deceptive or disruptive ads during a pilot run between December 2023 and October 2024.

Read together, the two help pages draw a line that was previously implicit. Google accepts responsibility for whether a click is billable. Whether the person, or program, behind that click leaves usable contact details is now documented as the advertiser's engineering problem, with three named controls and no Google-supplied measure of how often they are needed.

Timeline

Summary

Who: Google, through its Google Ads Help Centre, addressing advertisers running lead generation campaigns. The page was first reported by PPC News Feed, which credited Hana Kobzová with spotting it.

What: A help page titled "Prevent invalid leads" stating that Google's invalid traffic filters do not prevent invalid leads on their own because most traffic checks happen after an ad serves. It describes lead quality as a shared responsibility and lists reCAPTCHA, double opt-in email confirmation and server-side validation of email domains and phone formats, alongside lead-specific goals, enhanced conversions and content suitability controls. A related change to the About invalid traffic page clarifies that invalid traffic caught before month-end billing is never charged, while later detections produce credits on future invoices.

When: PPC News Feed reported the page on September 17, 2026. The page itself carries no publication date.

Where: The Google Ads Help Centre, under Fix issues and Reporting issues, with a linked best practices page covering Search, Performance Max, Demand Gen and App campaigns.

Why: Invalid traffic credits reverse charges but do not remove junk submissions from CRM systems, and neither document says whether such submissions are removed from conversion data. Google's documentation now places form-level validation with the advertiser, at a time when marketers rank bidding systems learning from non-human converters among their main concerns.