Bot clicks in email. Which funnel decisions can click data still support?

KEY TAKEAWAYS

1. The 16%, 56% and 87% figures measure different audiences. Split your own clicks by recipient domain before quoting any of them.
2. A bot share of 75% means three machine clicks for every human one. A click alone should never alert sales.
3. Scanner clicks dilute A/B tests. Judge winners on filtered clicks or on conversions, with more sample.
4. Filter bot clicks from reports and triggers, but never suppress a person on a bot flag alone.

Three reports published between June and August 2026 put the share of email clicks made by machines at 16%, 56% and 87%. Each is defensible. None tells you what to do with a nurture sequence that branches on a click. This article reconciles the numbers, turns a bot share into arithmetic, and sorts funnel decisions into those a click can still support and those it cannot.

Why do the published bot shares range from 16% to 87%?

They measure different recipients.

Omnivery, an email infrastructure vendor, published its report on August 10, 2026. Its first-party consumer traffic covers 126 mailbox provider families. There, about 2% of clicks were bots through 2023 and about 16% by 2026. A second dataset, traffic that other email platforms route through its detection service, crossed 50% in June 2026. Corporate domains ran at 80% to 95%.

GlueLetter, a newsletter analytics firm, examined 105,432,741 link clicks from January 1 to May 31, 2026 and classed 56% as artificial. Omeda, whose platform serves media and publishing companies, reported that 87.3% of click activity in the first quarter of 2026 was non-human across 1.77 billion emails.

The domain tables explain the spread. GlueLetter found 7.0% for gmail.com and 5.8% for yahoo.com, but 28.3% for outlook.com, 77.1% for other .com addresses, 84.8% for .gov and 92.7% for .org. Omnivery puts consumer Outlook and Hotmail near 30%. The pattern is older than the data. A 2020 paper from the industry body M3AAWG put B2C senders under 10% and B2B senders between 20% and 80%.

Most of this is security software. Microsoft's documentation for Safe Links describes scanning links before delivery and again at the moment of the click. Your tracking server sees a visit either way.

One caution applies to all three reports. Each uses a proprietary classifier, and none publishes an error rate. Emailexpert pressed Omnivery on this in August 2026. Its president, Jack Wrigley, said the firm does not quote accuracy or false positive rates, and its founder said some email platforms had asked for looser classification so that customers would be less alarmed.

Is Gmail still clean? The sources disagree

Omnivery reports that Gmail's bot share sat near 6% through 2025, then stepped to about 22% in late February 2026 and held for more than 20 weeks. It suspects a change in how Gmail scans or prefetches links. Google has not confirmed one.

GlueLetter's 7.0% for gmail.com covers January to May 2026, which overlaps that period. If Gmail had run at 6% for two months and 22% for three, the average would be near 16% on even monthly volume. That is our calculation, and it does not match. Omeda describes Gmail clicks as roughly 90% human, but its domain breakdown appears to predate the step.

We cannot settle this from outside. The datasets come from different senders and different classifiers. Wrigley himself told Emailexpert that Microsoft's scanning has swung between heavy and light periods, and that he would not be surprised to see the same at Google because the scans are expensive. The practical reading is that Gmail can no longer be assumed clean, and that nobody should rebuild a benchmark on one vendor's number. Check your own Gmail segment, then check it again next quarter.

Opens are no refuge. Litmus attributed 62.26% of tracked opens in July 2026 to Apple, a figure that includes opens generated by Mail Privacy Protection. Validity reported in May 2026 that Gmail image loading fell by about a third in late November 2025 while senders saw no matching fall in clicks or revenue.

What does a bot share do to a decision?

A share of clicks is hard to reason with. Convert it to machine clicks per 100 human clicks, which is the share divided by one minus the share. These are our calculations.

At 16%, a click is still probably a person. At 75%, a rule that alerts sales on a click is wrong three times out of four.

Domain mix compounds quickly. Take a hypothetical list where half the human clicks come from Gmail, 20% from Outlook.com, 10% from Yahoo and 20% from corporate .com addresses. Apply GlueLetter's domain rates. The blended bot share comes to about 44%, and the corporate fifth of the list produces about 85% of the machine clicks. Again, our arithmetic on an invented mix.

A/B tests suffer in a quieter way. A scanner clicks whichever variant it receives, so it adds the same layer to both and shrinks the visible gap. Suppose variant A earns clicks from 2.0% of recipients and variant B from 2.5%, a 25% lift. If scanners also click for 6% of all recipients, the reported rates are 7.88% and 8.35%, a 6% lift. Detecting the clean difference at the usual 5% significance and 80% power takes about 13,800 recipients per variant. With the scanner layer it takes about 52,900. Klaviyo's flow tests can show a significant result from 500 recipients per variation, given a 90% win probability and clearly separated ranges, and click rate is the default metric. A small test on raw clicks can crown a winner on noise. This is the same sample problem we worked through for ad creative tests.

Which funnel decisions can a click still support?

Three rows need a note.

Lead scoring is exposed by design. HubSpot's scoring tool, for one, lists marketing email link clicks as a scorable engagement event. That is fine when the click is human and costly when it is not. The gap between an activity and a buyer is the same one behind the sum in our piece on gating a guide.

Sunset rules can fail in both directions. Hustler Marketing described a Klaviyo account in 2025 where most of the profiles excluded by a bot click rule turned out to be customers with purchase history. Yahoo's sender guidance suggests a periodic reconfirmation email to inactive subscribers, which asks the person instead of guessing.

Opt-in and unsubscribe links are the oldest case. A Marketo community answer from 2018 already advised confirming consent with a button on a landing page. ActiveCampaign added a human verification step to suspicious unsubscribe clicks in June 2024.

Your platform's default changes the number you see

The same send reads differently in different tools.

• HubSpot filters bot activity by default, using blocklisted IP addresses and interaction speed.
• Mailchimp filters by default in reports. Its help page says email click filtering began on August 10, 2025.
• Klaviyo marks each click with a Bot Click property. Reports exclude flagged clicks when the setting is on, and segments need the filter added by hand.
• ActiveCampaign ships BotSense switched off. Once on, it covers reports, segments and automation triggers.
• Marketo offers two optional methods and lets you either log or filter what they catch.
• Dynamics 365 checks each click on an intermediate page and warns that journey branches on email clicks may be affected.
• SendGrid states that it does not distinguish human from automated clicks.

Two consequences follow. A benchmark from one platform is not comparable with yours. And switching a filter on mid-quarter looks like a collapse in click rate. Klaviyo's documentation says not to change the setting during a live experiment.

A seven-step audit

1. Find your setting. Note whether filtering is on, and whether it reaches reports only or also segments and triggers.
2. Export click events for four recent sends with recipient domain, timestamp and link.
3. Split by domain group. Gmail, Microsoft consumer, Yahoo and AOL, Apple, corporate, and institutional.
4. Mark suspect clicks. Validity names three signs: instant clicks, clicks on every link including the footer, and click spikes with no conversions. Suped places the most obvious scanner clicks in the first seconds to two minutes after delivery, measured from each recipient's delivery time. Do not use time alone. Omeda notes that some fast clicks are real.
5. Check against your site. Compare unique clickers with engaged sessions from email. Google Analytics counts a session as engaged when it lasts longer than 10 seconds, records a key event or has two or more page views. Treat a large gap as a prompt, since consent settings also hide sessions.
6. Rewire triggers. Any branch, alert or score that fires on a click should need a second signal. Suppress no one on a bot flag alone.
7. Repeat each quarter. Recipients change security tools without telling you.

A worked example with invented numbers

This company is hypothetical. It sells B2B software and sends a nurture email to 8,000 contacts, with a sales alert on any click.

Real people click for 2% of contacts, which is 160. Scanners click for 6%, which is 480, and about 10 of those contacts also clicked themselves. The platform reports 630 unique clickers and a 7.9% click rate. About 470 of them, or 75%, never saw the email.

Sales receives 630 alerts and finds 160 readers. The company changes the rule to require a click and an engaged session. Alerts fall to something near the 160, less any readers whose sessions were not recorded. The reported click rate, once filtering is on, drops toward 2%. Nothing about the email got worse.

Where this stops

Filtering is an estimate, and vendors do not publish how often they are wrong. Act-On makes a fair point that scanner activity shows a message was delivered and inspected. Keep it as a delivery signal. Do not count it as interest.

Paid placements are moving first. beehiiv's ad network pays publishers on payable clicks, which exclude anything flagged as automated. Expect sponsors to ask for the same definition elsewhere.

The broader habit is the one we apply to AI visibility measurement: know how noisy a signal is before acting on it. If that is a problem you are working on, the waitlist is open.

Questions

What share of email clicks are bots in 2026?

It depends on who receives the email. Omnivery's August 2026 report puts consumer campaigns at about 16%. GlueLetter found 56% across 105 million newsletter clicks in early 2026. Omeda reported 87.3% on its B2B media platform in the first quarter. Corporate and institutional domains account for most of the difference.

Are Gmail clicks still reliable?

The sources disagree. Omnivery says Gmail's bot share rose from about 6% to about 22% in late February 2026. GlueLetter measured 7.0% for gmail.com from January to May 2026. Omnivery's own president says he would not be surprised if the higher figure eased. Measure your own Gmail segment before changing anything.

Should I suppress subscribers whose clicks are flagged as bots?

No. A bot flag describes a click, not a person. A scanner and a real employee can sit behind the same address, and ActiveCampaign's own documentation admits a small chance of false positives. Filter flagged clicks out of reports and triggers, and base suppression on purchases, site sessions, replies or a reconfirmation email.

Do bot clicks ruin email A/B tests?

They mostly weaken them. Scanner clicks land on both variants, so they shrink the visible difference and add noise. By our calculation a true 25% lift can read as 6% when scanners click for 6% of recipients, and the test needs almost four times the sample. Test on filtered clicks or on conversions.

Sources

1. Omnivery, The State of Email Bots 2026 omnivery.com
2. Omnivery, The State of Email Bots 2026 report PDF omnivery.com
3. Emailexpert, The click is going the way of the open. Omnivery has the receipts emailexpert.com
4. GlueLetter, Newsletter bot clicks data, how many and which email providers glueletter.com
5. Omeda, Bot Clicks in Email omeda.com
6. M3AAWG, Exploring the Impact of Nonhuman Interactions on Email Send Metrics m3aawg.org
7. Klaviyo Help Center, Understanding bot clicks help.klaviyo.com
8. Klaviyo Help Center, Understanding statistical significance in flows help.klaviyo.com
9. HubSpot Knowledge Base, Understand bot filtering in marketing email analytics knowledge.hubspot.com
10. HubSpot Knowledge Base, Overview of the lead scoring tool knowledge.hubspot.com
11. Mailchimp Help, About Bot Activity and Bot Filtering mailchimp.com
12. ActiveCampaign Help Center, Filter out bot clicks with ActiveCampaign's BotSense help.activecampaign.com
13. ActiveCampaign Help Center, Bot click unsubscribe protection help.activecampaign.com
14. Adobe Experience League, Filtering Email Bot Activity experienceleague.adobe.com
15. Microsoft Learn, Bot protection in Dynamics 365 Customer Insights Journeys learn.microsoft.com
16. Microsoft Learn, Safe Links in Microsoft Defender for Office 365 learn.microsoft.com
17. Twilio SendGrid Support, Spam Filters, Non-Human Clicks and Open Engagement Recorded support.sendgrid.com
18. beehiiv Support, Ad Network FAQ beehiiv.com
19. Google Analytics Help, Engagement rate and bounce rate support.google.com
20. Yahoo Sender Hub, Sender Best Practices senders.yahooinc.com
21. Litmus, Email Client Market Share litmus.com
22. Validity, What's Really Behind Gmail's Open Rate Drop validity.com
23. Validity, Are These Clicks for Real? The Rise of Bot Clicks validity.com
24. Hustler Marketing, Bot Clicks Or Buyers? How to Tidy Your Klaviyo Without Losing Revenue hustlermarketing.com
25. Suped, How long does it typically take for anti-spam bots to click links in emails suped.com
26. Adobe Experience League Communities, Bots clicking links and double opt-in consent experienceleaguecommunities.adobe.com
27. Act-On, The Benefits of Bot Clicks and Proxy Opens in Email Marketing act-on.com

NEXT STEP

See where your brand stands.

Your Digital Authority Score, who AI recommends for your target questions, and the placements that close each gap. Your first report is free.

Get your free report →