Building audiences with ClickPatrol: best practices

ClickPatrol already blocks fake clicks and reports them to Google for potential refunds. But you can take your protection one step further: use our classification data to prevent wasted ad spend before it happens, and to sharpen the targeting of your campaigns. This article explains how to use ClickPatrol Audiences to keep your campaigns away from suspicious traffic and point them at the visitors you actually want to reach.

Why use ClickPatrol Audiences?#

ClickPatrol's core job is reactive: we detect fake clicks on your ads, block the sources for the future, and report them to Google for a potential refund. That protects your budget after the click has happened.

Audiences let you do more than that. Instead of only reacting to fake traffic, you use ClickPatrol's data to shape your campaigns before the click:

• Prevent fake clicks up front by excluding visitors we classify as suspicious from your targeting.
• Improve targeting by seeding lookalikes and remarketing on visitors we classify as legitimate, so you reach the people who are most likely to convert.

In short: blocking and refunds clean up after the fact. Audiences make sure your campaigns don't go after bad traffic in the first place.

Which segments can you build?#

Core layer: legitimate vs. suspicious

• Suspicious traffic: bots, crawlers, headless browsers, click farms, datacenter traffic, and known fraud patterns.
• Legitimate traffic: visitors that pass our validation.

For most advertisers, 80% of the value is in this layer.

Refinement layer: based on ClickPatrol classification data

You can segment further on signals that ClickPatrol records, such as:

• Fraud score bands, for example only visitors in the lowest risk tier, or the middle band that is "suspicious but not blocked".
• Device and environment, such as incognito, outdated browsers, emulators, or desktop vs. mobile.
• Origin classification, such as datacenter IPs, VPN and proxy traffic, or specific geographies outside your ICP.

What ClickPatrol does not segment for you: on-site behavior (scroll depth, session duration, mouse movement), campaign source (display vs. search vs. social), or repeat patterns at the IP level. Those signals need to come from your own analytics or CRM and be combined with our events.

Best practice 1: start with exclusion, not targeting#

The fastest value comes from what you stop paying for. Recommended order:

1. Build an audience based on the suspicious event (for example CP Suspicious 30d).
2. Add it as a negative audience at account level in Google Ads, not per campaign. Per-campaign exclusion means new campaigns are unprotected by default.
3. Monitor CPL and conversion rate for 2 to 4 weeks before moving to targeting.

Exclusion is near-zero risk. Targeting requires volume and algorithmic learning, and pushing both changes live at once makes it impossible to attribute the impact.

Best practice 2: use the legitimate event as a lookalike seed#

Google's Similar Audiences and Meta's Lookalikes are seeded from your conversion list by default. The problem is that this list almost always contains a percentage of polluted data: bot submits, competitor trial signups, lead form fraud.

A cleaner approach is to stack the legitimate event on your existing conversion. Instead of seeding on "all form submits", you seed on "form submits classified as legitimate". In Google Ads and Meta, you do this by combining events with an AND rule in the audience definition.

Guidelines:

• Aim for a minimum of 1,000 profiles in the seed, preferably 5,000 or more.
• Refresh the seed monthly by using a rolling membership window.
• Compare the CAC of lookalikes on a clean seed against a polluted seed. This is the easiest part of the ClickPatrol value to prove.

Best practice 3: stack with your own conversion events#

An audience of "legitimate + visited pricing page + no conversion" is more valuable than any ClickPatrol segment on its own. The combination is where the leverage sits:

• ClickPatrol tells you: is this visitor real?
• Your analytics tells you: what did this visitor do?
• Your CRM tells you: is this visitor already a customer?

Build remarketing audiences on the combination, not on ClickPatrol events in isolation. An audience of "all legitimate visitors" is too broad to target usefully.

Best practice 4: keep the number of audiences small#

The temptation is to build one audience per segment. The result is fragmentation, audiences below the platform's minimum membership threshold, and a management mess.

Rules of thumb:

• Maximum of 5 to 7 active audiences per ad account.
• Every segment needs a clear strategic role (exclusion, targeting, lookalike seed, or remarketing).
• If you won't activate a segment within a month, don't create it.

Best practice 5: measure lift, not volume#

An audience strategy either works or it doesn't. Ways to prove it:

• Campaign-level A/B: identical campaigns with and without the exclusion, equal budgets, running for at least two weeks.
• Pre/post analysis: CPL, conversion rate, and lead quality (if you have backend data) before and after implementation.
• Geo holdout: test in part of your markets and keep the rest as control.

Without measurement, you can't tell whether you're adding value or just complexity.

How it works#

ClickPatrol does not export ready-made lists to your ad accounts. Instead, the flow is:

1. ClickPatrol analyzes the visitor and fires an event on your site, for example when the visitor is classified as legitimate or suspicious.
2. Your advertising platform picks up that event through your existing tagging setup (Google Tag, Meta Pixel, GTM, GA4).
3. Inside the platform, you build an audience based on that event.

The advantage of this approach is that it works on any platform that accepts events, runs in real time, and requires no extra sync infrastructure. You stay in control of your audience logic inside the platform itself.

For the Meta-specific setup, see the Meta Audiences guide.

Common mistakes#

• Using the suspicious audience for remarketing instead of exclusion. Remarketing operates at cookie or ID level, where bots barely register anyway. Use suspicious audiences as a negative audience at account level, not as a remarketing list.
• Rolling out account-wide without a volume check first. In lower-volume accounts, especially B2B, a single exclusion can materially shift learning signals. Start on one campaign, confirm the direction, then expand.
• Building lookalikes on seeds that are too small. Below 1,000 members, lookalikes tend to underperform a well-targeted broad campaign.
• Building audiences and forgetting them. Audience membership expires (Google allows up to 540 days). Audit your active audiences every quarter.
• Using ClickPatrol events as standalone targeting. "All legitimate visitors" is not a target group, it's almost all of your site traffic. Always combine with intent or conversion signals.