Most bots claiming to be Googlebot or GPTBot are fake, and two countries want a law to unmask them

Most of the traffic hitting publisher sites under the banner of Googlebot or an AI crawler like GPTBot isn't actually Googlebot or GPTBot, according to bot-verification data reported this week, and lawmakers in the US and UK are now pushing bills that would force crawlers to say who they are before they can scrape a page.

What changed

On October 15, a coalition of UK publishers including The Times, the Financial Times and Condé Nast urged the UK government to back Conservative MP Damian Hinds' Automated Online Software (Access and Transparency) Bill, which would require bots to disclose who operates them and what they intend to do with the content they take. Hinds frames it as a disclosure rule rather than a ban on AI, aimed at letting site owners see who is pulling value from their pages, in comments to Press Gazette.

The bill mirrors a bipartisan US proposal, the Stealth Bot Prohibition Act, introduced by Reps. Laurel Lee and Valerie Foushee, which would let the Federal Trade Commission enforce disclosure requirements on deceptive crawlers. News/Media Alliance CEO Danielle Coffey called it a "sorely-needed, common-sense solution," as MediaPost reported when it was introduced.

The push has new teeth because verification firms are now measuring just how much crawler traffic is faked. Bot-management vendor Centinel found that one in seven requests claiming to be Googlebot failed verification, while 84% of requests claiming to be GPTBot and 99% claiming to be Perplexity-User were spoofed. A separate analysis of Cloudflare data by ad-tech firm Piano put total unverified bot traffic at 70%. Security vendor DataDome's September report found scraping made up 70.9% of malicious bot traffic, up 185.2% over the prior twelve months.

Who it affects

The coalition pushing these bills is made up of news publishers, but the underlying problem belongs to anyone whose growth plan depends on being crawled: software companies publishing docs, comparison pages, and blog posts in the hope of AI citation. If a meaningful share of the "AI crawler" hits in your server logs are spoofed, the activity your team is reading as GEO traction is partly noise, not model interest.

That matters most for the teams already running GEO or AI-visibility programs on the strength of server-log evidence: a spike in requests that look like an OpenAI or Perplexity crawler gets read as proof a blog post or docs page is "being used" by a model, when some unknown share of that spike is an unrelated scraper borrowing the name.

It also exposes a gap in the usual advice to block unwanted crawlers at the robots.txt level. Jon Roberts, chief innovation officer at People Inc, told Digiday that robots.txt "does nothing" against bots that lie about who they are, which is why his company moved to blocking by default at the CDN level after trying to manage crawlers one at a time. Reuters made a similar move earlier this year, though its team cautions the approach isn't foolproof either.

Hinds put the underlying demand in one line to Press Gazette:

"you have to say who you are and what you'll do with what you take"

That is the one-sentence case lawmakers are making for the bills, and it's also a reasonable standard to hold your own traffic data to. A dashboard that can't tell a real OpenAI crawl from a scraper wearing its name isn't measuring AI visibility. It's measuring whichever bot operator is best at spoofing a user-agent string that week.

What to do differently

Neither bill is close to law. The UK bill lacks government backing and Press Gazette's reporting treats its passage as unlikely without it; the US bill still needs committee review and votes in both chambers. Software marketers shouldn't wait on either one before fixing how they read their own logs.

• Stop trusting the user-agent string alone. Verify crawler IPs against the operator's published ranges, or use reverse DNS, before crediting a hit to Googlebot, GPTBot or any named AI crawler.
• Move bot management to the CDN or edge layer rather than robots.txt, which only works against crawlers that choose to obey it.
• Separate counted, verified referral traffic from inferred AI "mentions" in your GEO reporting, and label each differently when you report results internally.
• Track the two bills if your content strategy leans on being cited by AI tools: a disclosure requirement would make this an engineering problem instead of a guessing game.

The industry pushing hardest for these bills is news media, which has the clearest revenue case: traffic and licensing both depend on knowing who's actually on the other end of a request. Software marketers have a quieter version of the same stake. Every dollar spent chasing AI citations assumes the crawler reading your content is who it says it is, and right now, for a large share of that traffic, it isn't.