Yes. Click fraud protection can exclude legitimate customers when its blocking rule applies more broadly than the evidence supports. A suspicious visit and everyone sharing that visit's IP address are different populations.
For a law firm, one missed prospective client can matter considerably. For a shop, a rule can quietly remove returning shoppers. A useful protection report should explain both the unwanted activity it identified and the legitimate activity its proposed response could affect.
Why one IP address can represent several customers
Apple explains that iCloud Private Relay addresses can be shared by several users. It specifically advises websites to account for that sharing when applying fraud controls.
Recognizing a privacy relay helps avoid treating its network as ordinary server infrastructure. It does not establish that every request is benign. The practical consequence is narrower: an address alone cannot tell you which person should be excluded.
Google Ads supports excluding individual addresses and address blocks. Even an individual-address exclusion can therefore have a wider reach than the visitor who triggered it.
What our existing research illustrates
In Button's residential-proxy study, 17 of 31 IPs in one store's hosting-labelled group belonged to iCloud Private Relay. Fourteen of those 17 reached a product page, and ten had an observed ad arrival.
Those are browsing observations, not verified purchases or proof of lost revenue. They show why a hosting label would have been an insufficient reason to exclude that entire group. The study also documents collection gaps and uses short observation windows; its proportions should not be treated as universal rates.
Review the evidence and the action separately
Consider this hypothetical case: one visit appears automated, while another visit from the same address looks consistent with an ordinary browser and reaches a contact page. The first finding may be valid. Excluding the shared address still needs a separate justification.
| Observation | What it supports | What remains unresolved |
|---|---|---|
| A proxy or hosting label | Investigating network context | Whether this visit is automated |
| Repeated identified ad clicks | Investigating repeat activity | Whether they belong to one person or involve abuse |
| Consistent automation evidence | Classifying the observed activity | Who else an IP exclusion would affect |
| A linked confirmed customer | A counterexample to examine | Whether the linkage is correct and the rule would have applied |
Retain those counterexamples. A system that only shows suspicious traffic makes its own mistakes harder to discover.
Test buyer exposure before changing delivery
First evaluate the proposed rule without applying it. Use a declared period and eligible paid-click cohort on one site. Record the rule version, collection coverage and proposed exclusion scope.
Then check how many independently confirmed customer journeys would match. Prefer a reliable same-site journey or click identifier; mark uncertain joins separately. Include mobile browsers, privacy tools and returning visitors in the review.
This measures exposure to a proposed rule. It cannot tell you how much revenue a live exclusion would have lost. That requires a bounded comparison with mature outcomes and an explicit way to stop or reverse the intervention.
Reject or revise a rule when its signal follows a browser feature, shared network or collection failure more closely than the activity you intended to stop.
Ask for a record you can inspect
A useful decision record contains the triggering evidence, affected population, proposed action, duration, counterexamples and unresolved questions. Temporary exclusions still need that record: an expiry reduces duration, not the number of legitimate people potentially affected while the rule is active.
For the wider investigation, start with what counts as evidence that bots are clicking ads. Then examine the limits of IP exclusions and how to evaluate a detector.
Button's published research gives examples of the evidence and counterexamples behind this approach. Explore Ad Protect to discuss an audit of your own paid traffic.
AI disclosure
ChatGPT (AI) drafted this article using the linked sources and existing Button research. Prepared for editorial review by Nathan Pankowsky. No new customer experiment was performed for this article.