Google has now said it plainly: its invalid-traffic filters don't stop invalid leads. If your Google Ads account counts form submissions as conversions, every bot or junk fill is a success signal, and Smart Bidding will spend more to find the next one. The fix is to validate each lead on your server first and only then send a conversion back to Google. reCAPTCHA helps, but it's one check out of five. The real change is moving the conversion trigger from the browser, where anything can fire it, to your backend, where you decide what counts.
What did Google actually say about invalid leads?
A new Google Ads help page, "Prevent invalid leads", surfaced around 20 September 2026. It carries no publish date, but the message is blunt: automated protections filter invalid traffic, yet they can't prevent all invalid leads, because you capture leads on your own website and CRM. A bot can submit your form even if Google later decides the click that brought it was invalid. Most traffic checks happen after the ad serves.
Google calls lead quality a "shared responsibility" and recommends three things on the advertiser side: reCAPTCHA on the form, double opt-in email confirmation and server-side validation. The page also points you toward optimising for lead-specific goals rather than raw submissions. Google's broader invalid traffic documentation says the same thing in softer language.
What the page doesn't do is commit to anything. There's no figure for how many fake leads get through, no pre-submission protection and no refund path for clicks that produced only junk. Read it as Google handing the problem to you in writing.
Why do fake leads poison Smart Bidding?
Smart Bidding learns from whatever you label a conversion. It can't read the lead. It sees a conversion, looks at the query, device, location, time and audience signals around it, and bids harder on similar auctions.
Here's the arithmetic that makes this ugly. Say a campaign logs 100 form conversions a month and 30 of them are junk. You're not just paying for 30 useless clicks. Thirty percent of the training data is telling the model that whatever produced those fills is working. Junk also tends to cluster in cheap inventory, like Search Partners, broad match on loose queries and certain Performance Max placements, so the model sees an unusually low cost per conversion there and shifts budget toward it. Next month the junk share climbs, the reported CPA looks even better, and the sales team stops calling back.
This is why an account can report its best CPA ever in the same month the client says leads have dried up. We see that exact mismatch in audits more than any other tracking problem, and it's almost always a conversion definition issue, not a bidding issue. We covered the reporting side of that gap in our guide to Google Ads and GA4 attribution mismatches.
What counts as an invalid lead?
It helps to sort junk by type, because each type fails a different check:
- Bots. Automated scripts filling every field, often in under two seconds, often with keyword-stuffed messages or links. A honeypot and a time check catch most of them.
- Paid human form-fillers. Click farms that type real-looking names and plausible numbers. They pass CAPTCHA. Phone validation, duplicate detection and IP or device velocity catch more of them.
- Competitors and vendors. Real people, real details, zero intent. Keyword checks on the message field and a CRM-side "not a prospect" disposition handle these.
- Real people with the wrong intent. Job seekers, people outside your service area, people asking for a service you don't sell. Not fraud, but not a lead either. These belong in a qualification stage, not a spam filter.
The first three should never become conversions. The fourth should become a secondary conversion at most.
How do you validate leads before they count?
Take the conversion trigger away from the browser. Instead of firing the Google Ads tag on the thank-you page, post the form to a webhook and run the checks there. We build this in n8n for most clients because the same workflow can also write to the CRM, alert the sales team and send conversions to both Google and Meta.
The checks we run, cheapest first:
- Honeypot field. A hidden input real users never see. If it has a value, it's a bot. Free, and it catches a surprising share.
- Time to submit. Stamp the form when it renders and compare on submit. Under about three seconds for a multi-field form is almost never a human.
- reCAPTCHA v3 score. Google's reCAPTCHA v3 docs describe a score from 0.0 to 1.0 and suggest starting with a 0.5 threshold. We treat it as one input to a score, not a gate by itself.
- Email validation. Syntax, MX record, and a disposable-domain list. A lead from a throwaway inbox is not a lead.
- Phone validation. Parse it properly, check it's a real number for the country, and flag obvious patterns like 555 numbers or repeated digits. For service businesses this is the strongest single check we have.
- Duplicates and velocity. Same email, phone or IP within 24 hours gets merged, not counted twice. Ten submissions from one IP in an hour gets the whole batch held.
- Message content. Links, known spam phrases, or text that has nothing to do with the service. A small model can classify this cheaply, but plain rules handle most of it.
Each check adds or subtracts points. We route the result three ways: pass fires the conversion, review goes to a human queue in Slack or the CRM, and reject is logged but never sent to an ad platform. The review lane matters. Without it you'll tune the rules too tight, lose real leads, and nobody will notice for a month.
Build the workflow so it fails open for the CRM and closed for the ad platforms. If a validation API times out, the lead still lands with sales; it just doesn't count as a conversion until someone confirms it. We cover the alerting side of this in our post on n8n error handling and monitoring.
How do you send clean leads back to Google Ads and Meta?
Once a lead passes, send it back as its own conversion action. Capture the GCLID (plus GBRAID or WBRAID for iOS traffic) in hidden fields on the form, store it with the lead, and upload a "validated lead" conversion with that click ID. Add hashed email and phone through enhanced conversions for leads so the conversion still matches when a click ID is missing. Google is moving these uploads toward the Data Manager API, which we walked through in our Data Manager API migration guide.
Give every conversion a transaction ID. If a lead passes validation and later turns out to be junk, you can retract it through a conversion adjustment instead of leaving a bad signal in the account for good.
Do the same for Meta. Fire the Lead event from the server through the Conversions API only after validation, with the same event ID the browser pixel would have used so the two deduplicate. Our Meta Conversions API setup guide covers the matching parameters.
Then go one stage further. When sales marks a lead as qualified or booked in the CRM, upload a second conversion with a higher value. A validated lead tells Google the person is real. A qualified lead tells Google the person is worth money. Smart Bidding gets much sharper when it has the second signal. That's also where proper attribution tooling earns its keep; if you're running HYROS, the qualified and closed stages are already sitting there to pass back.
Won't changing the conversion reset the account?
It will shift it, so don't flip it overnight. Changing which action is primary changes what Smart Bidding optimises for, and you'll see volatility while it relearns. The approach we use:
- Keep the old form-submit action but set it to secondary once the new action has data. You keep the volume reporting without the bad signal.
- Run the validated-lead action as primary alongside the old one for two to three weeks before retiring the old one, so the model has overlapping history.
- Expect reported conversions to drop. That's the point. If 30 percent of your conversions were junk, reported volume falls by about that much and CPA rises on paper. Warn the client before it happens, not after.
- Adjust targets to the new definition. A target CPA set against junk-inflated volume will choke the campaign once the junk disappears.
We wrote more about how Smart Bidding behaves while it relearns in our post on Smart Bidding exploration.
Where does the junk come from, and should you cut it off?
Validation fixes the signal. It doesn't stop you paying for the click. Once the workflow is tagging leads, you can finally see which sources produce the rejects, because every rejected lead still has a GCLID. Join rejects to campaign, keyword and network data and look for:
- Search Partners. Often the biggest junk source in lead-gen accounts. If the reject rate there is double the Google Search rate, switch it off.
- Performance Max. Check placement and channel reporting. Lead-gen PMax without offline conversion data is where we see the worst junk rates.
- Broad match on thin queries. Look at the search terms behind rejected leads and add negatives.
- Geography. Leads from outside the service area that passed every other check are a location targeting problem, usually "presence or interest" left on.
The goal isn't zero spam. It's making sure spam never gets counted as success. Once it stops counting, Smart Bidding stops chasing it on its own, and the reject rate falls without you having to win every fight at the form.
Get a Free Automation Audit
If your Google Ads account reports great CPAs while sales complains about lead quality, the conversion definition is the first place we'd look. We'll review how your form conversions fire, what share of them are junk, and what a server-side validation and offline conversion setup would take for your stack. Get a Free Automation Audit and we'll show you exactly where the bad signal is coming from. If you'd rather have us build the validation workflow itself, see our n8n workflow automation service.