Bots now outnumber people online, and your metrics still count them as readers

In September 2021, Apple shipped a privacy feature for its Mail app, and email open rates started looking better than anyone had thought they'd be. Mail Privacy Protection fetches each message in advance and loads its tracking pixel whether or not a person ever reads it. The "open rate", a number newsletter teams had reported upward every week for years, quietly began counting a piece of software as a reader. Plenty of dashboards didn't flag the change. The line went up, and people took the credit.

That was one metric, bent by one company. This year it happened to all of them.

Thales, which sells bot protection, puts bots at 53% of internet traffic in 2025 and people at 47%. Cloudflare said it in plainer words on 30 September: "This year, for the first time, more than half of Internet traffic wasn't human." In March, Cloudflare's chief executive, Matthew Prince, had told SXSW he expected the crossing in 2027. His own network reported it six months later, though a forecast and a blog post may not be measuring the same thing.

Reach now counts machines along with people

A reach number is now a weather reading. It tells you how much attention your site and your posts drew from anything with a network connection, and it says little about how many people were in that attention. Sessions, impressions, clicks and opens all add up visits the same way they did when nearly every visit had a person behind it. The crowd changed behind the math.

The machines in that crowd work hard to look like us. Thales finds that 41% of bot attacks run through Chrome to appear legitimate, and the agents now arriving copy human habits closely enough that the old tells stopped working. PYMNTS, citing CNBC in its report on Reddit's crackdown, describes software "mimicking conversational patterns, posting cadences and engagement habits that previously served as exclusive markers of human activity." The filters under a dashboard catch the clumsy ones. The rest still get counted.

Some of the machines are working for people, and that's harder to sort out. Cloudflare calls AI agents "a second audience," made of "software acting on behalf of people," and says they "sit somewhere between humans and traditional bots." Daily requests from agents on its network grew by more than 1,700% in a year. That agent traffic "follows human routines, with a weekly rhythm and a dip over the summer holidays," because a person sent it to compare insurance quotes or book a table. A visit on your dashboard can be a scraper, a fraud run or a customer's errand, and all three draw the same line.

It's in the numbers you pay for

It would be comforting if this stayed in raw web traffic, where platforms and analytics tools filter out a lot of it before anyone sees a report. Some of it does stay there. Meta's own annual filing estimates that less than 5% of its daily active people in late 2025 consisted only of accounts that broke its rules, and it adds that the real number "may vary significantly from our estimates." Inside a platform that filters hard, the problem looks much smaller than the raw web suggests.

It doesn't stay out of paid media, though. Lunio, which sells click-fraud protection, watched 2.7 billion paid clicks across six ad platforms between August 2024 and July 2025 with its blocking switched off, and counted 8.51% of them as invalid. On TikTok the rate was 24.20%; on LinkedIn, 19.88%. Invalid covers more than bots (the figure includes accidental clicks), and each was a click an advertiser could be billed for and no genuine user meant to make.

I don't know your number, and neither do these vendors. Thales, Cloudflare, Lunio and HUMAN Security each measure their own networks, and each sells their own cure, which is a reason to hold their figures loosely while taking seriously the direction they all agree on. HUMAN's data has automated traffic growing about eight times faster than human traffic in 2025: 23.51% against 3.10%.

What a business-as-usual metric hides

That direction does the damage, because a total can hold steady while the people inside it leave. Cloudflare reports that in some of the most heavily crawled categories, retail, software and financial services among them, human traffic fell by as much as 40% in less than a year. A dashboard that showed flat sessions over that year would be showing a site trade its human readers for software, and calling it stability.

This is where reporting reach as audience turns into a mistake with consequences. A media plan, a sponsorship rate or a head of marketing's bonus can rest on a number whose human share nobody in the room can state. When the share was 80% and holding, the error was small enough to ignore. At 47% and falling, the number has become a measure of how visible you are to machines, some of them working for your customers and most of them working for nobody you'd want to reach.

The open rate went first, and the people who noticed in 2021 had a head start. Beehiiv, for one, now filters out the opens Apple's proxy inflates, to give its customers more realistic reports. Every other reach metric now needs the same suspicion, and most of them don't have a fix yet, since each one counts the same mixed crowd.

The line on the dashboard still goes up. How many people are in it is now anyone's guess.