{"id":22647,"date":"2026-10-12T08:37:00","date_gmt":"2026-10-12T06:37:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=22647"},"modified":"2026-10-10T22:59:08","modified_gmt":"2026-10-10T20:59:08","slug":"ai-agents-web-analytics-agentic-traffic-ga4-server-side","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/","title":{"rendered":"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server"},"content":{"rendered":"<p><strong>In 2026, AI agents have moved from experiment to measurable traffic factor \u2013 and most analytics setups simply count them as humans.<\/strong> Agents open pages, scroll, fill in forms and add products to the basket. In the GA4 report this shows up as an ordinary session with a Chrome browser, often as \u201cDirect\u201d, sometimes even as organic traffic.<\/p>\n<p>The scale is no longer negligible. According to <a href=\"https:\/\/www.humansecurity.com\/2026-state-of-ai-traffic-cyberthreat-benchmark-report\/\" target=\"_blank\" rel=\"noopener noreferrer\">HUMAN Security<\/a>, traffic from AI agents and agentic browsers grew by 7,851% year on year in 2025. In the <a href=\"https:\/\/www.humansecurity.com\/learn\/blog\/state-of-agentic-traffic-august-2026-agentic-traffic-grows-27-reaches-new-high-as-codex-debuts-strongly\/\" target=\"_blank\" rel=\"noopener noreferrer\">August 2026 benchmark<\/a>, agentic traffic rose by another 27% and reached a new high.<\/p>\n<p>At the same time, Google introduced a dedicated \u201cAI Assistant\u201d channel in GA4 in May 2026. That sounds like a solution, but it measures only part of the picture. This article shows which kinds of AI visits exist, which of them GA4 actually recognises, and how agentic traffic can be classified on the server and carried cleanly into reporting \u2013 with concrete code examples.<\/p>\n<h2>Three classes of AI visits<\/h2>\n<p><strong>\u201cAI traffic\u201d is not a single phenomenon; technically it splits into three classes with completely different measurement behaviour.<\/strong> Lumping them together yields neither clean user figures nor a reliable statement about the value of AI as a channel.<\/p>\n<table>\n<tr>\n<th>Class<\/th>\n<th>Examples<\/th>\n<th>Executes JavaScript<\/th>\n<th>Appears in GA4<\/th>\n<th>Detectable via<\/th>\n<\/tr>\n<tr>\n<td>AI-referred humans<\/td>\n<td>Click on a source in ChatGPT, Gemini, Claude, Perplexity<\/td>\n<td>yes<\/td>\n<td>yes, often in the \u201cAI Assistant\u201d channel<\/td>\n<td>Referrer, UTM parameters<\/td>\n<\/tr>\n<tr>\n<td>Server-side fetches on behalf of a user<\/td>\n<td>ChatGPT-User, Claude-User, Perplexity-User<\/td>\n<td>mostly no<\/td>\n<td>no<\/td>\n<td>User-Agent, IP lists, server logs<\/td>\n<\/tr>\n<tr>\n<td>Agentic browsers<\/td>\n<td>Perplexity Comet, ChatGPT Agent, Chrome Auto Browse, Google-Agent<\/td>\n<td>yes<\/td>\n<td>yes, as a normal session<\/td>\n<td>difficult: partly User-Agent tokens, partly signatures, partly not at all<\/td>\n<\/tr>\n<\/table>\n<p>On top of that come classic training and search crawlers such as GPTBot or OAI-SearchBot. These crawlers usually do not execute JavaScript and therefore only appear in logs, not in tag-based tracking.<\/p>\n<p>The real problem is the third class. Agentic browsers run the tracking script, set cookies and trigger events \u2013 without behaving like a human. Precisely these sessions shift conversion rates, bounce behaviour and funnel analyses without being marked as agents.<\/p>\n<h2>The new AI Assistant channel in GA4: what it measures and what it does not<\/h2>\n<p><strong>The \u201cAI Assistant\u201d channel only captures clicks by humans with a recognisable referrer \u2013 in other words, only the first of the three classes.<\/strong> According to <a href=\"https:\/\/support.google.com\/analytics\/answer\/9164320?hl=en\" target=\"_blank\" rel=\"noopener noreferrer\">Google\u2019s release notes of 13 May 2026<\/a>, GA4 sets the medium to \u201cai-assistant\u201d as soon as the referrer matches a known AI assistant. These visits land in the Default Channel Group as \u201cAI Assistant\u201d, and the campaign is \u201c(ai-assistant)\u201d.<\/p>\n<p>In addition, the <strong>Source Group<\/strong> dimension has been available since 11 June 2026. It groups source values and, according to Google, already contains groupings for ChatGPT (OpenAI) and Perplexity \u2013 populated retroactively, so it can also be used for historical periods.<\/p>\n<p>Three gaps remain nonetheless:<\/p>\n<ul>\n<li><strong>Missing referrer.<\/strong> Transitions from native apps to the browser often carry no referrer. <a href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ga4-ai-assistant-channel-which-visits-it-counts-and-which-land-in-direct\/\">Such visits fall into \u201cDirect\u201d<\/a>, even though an AI assistant triggered them. Some are rescued by UTM parameters, such as <code>utm_source=chatgpt.com<\/code>, which ChatGPT appends to many links.<\/li>\n<li><strong>AI features within Google.<\/strong> Clicks from AI Overviews or AI Mode come with the Google referrer and therefore remain part of \u201cOrganic Search\u201d. The new channel does not separate them.<\/li>\n<li><strong>Agents instead of humans.<\/strong> An agentic browser that opens a product page on a user\u2019s behalf often has no referrer at all, or an arbitrary one. The channel says nothing about these sessions \u2013 they sit undetected in every channel.<\/li>\n<\/ul>\n<p>For a first assessment the channel is still valuable: it shows which content is linked as a source in AI answers and how well this traffic converts compared with organic.<\/p>\n<h2>The blind spot: agentic browsers in the dataset<\/h2>\n<p><strong>Agentic browsers are based on Chromium, run tracking normally and present themselves as ordinary Chrome by default.<\/strong> The IAB bot list on which GA4 relies for bot filtering does not catch them, as <a href=\"https:\/\/snowplow.io\/blog\/agentic-browsing-is-here\" target=\"_blank\" rel=\"noopener noreferrer\">Snowplow<\/a> has analysed. In one test, Seer Interactive even observed OpenAI\u2019s agent showing up in GA4 as <a href=\"https:\/\/www.seerinteractive.com\/insights\/how-will-you-know-when-open-ais-operator-agent-hits-your-website\" target=\"_blank\" rel=\"noopener noreferrer\">Bing\/organic<\/a>.<\/p>\n<p>The market sorted itself noticeably in 2026:<\/p>\n<ul>\n<li><strong>Perplexity Comet<\/strong> was the largest single source of agentic traffic in August 2026 with 40.7%, according to <a href=\"https:\/\/www.humansecurity.com\/learn\/blog\/state-of-agentic-traffic-august-2026-agentic-traffic-grows-27-reaches-new-high-as-codex-debuts-strongly\/\" target=\"_blank\" rel=\"noopener noreferrer\">HUMAN<\/a>.<\/li>\n<li><strong>OpenAI<\/strong> <a href=\"https:\/\/en.wikipedia.org\/wiki\/ChatGPT_Atlas\" target=\"_blank\" rel=\"noopener noreferrer\">discontinued its standalone ChatGPT Atlas browser on 9 August 2026<\/a>. ChatGPT Agent, Codex and Atlas together accounted for around 31% of agentic traffic in August; Atlas can only have contributed until it was discontinued on 9 August.<\/li>\n<li><strong>Chrome Auto Browse<\/strong> has been running directly in the most widely used browser since 28 January 2026. According to an <a href=\"https:\/\/nohacks.co\/blog\/agentic-browser-landscape-2026\" target=\"_blank\" rel=\"noopener noreferrer\">overview by nohacks<\/a>, the feature is still limited to the US and to paying Google AI Pro and Ultra subscriptions. For sites in the German-speaking DACH region the effect is therefore still small, but the reach is already in place.<\/li>\n<\/ul>\n<p>In addition, according to <a href=\"https:\/\/taggrs.io\/ai-browsers-tracking-attribution\/\" target=\"_blank\" rel=\"noopener noreferrer\">TAGGRS<\/a>, Comet blocks ads and trackers by default. Part of the agentic sessions is then missing entirely while another part is counted in full \u2013 a double distortion that cannot be resolved without server-side data.<\/p>\n<p>Typical symptoms in the dataset:<\/p>\n<ul>\n<li>rising sessions while purchases or leads stagnate<\/li>\n<li>more \u201cDirect\u201d traffic on deep product and search pages without any recognisable campaign<\/li>\n<li>form starts and add-to-cart events without completion, concentrated on desktop Chrome<\/li>\n<li>conspicuously even intervals between events within a session<\/li>\n<\/ul>\n<p>Another HUMAN figure shows how small the direct revenue share still is: <a href=\"https:\/\/www.humansecurity.com\/learn\/blog\/ai-traffic-growth-2025-key-findings\/\" target=\"_blank\" rel=\"noopener noreferrer\">2.3% of agentic activity<\/a> took place on checkout pages in 2025. Most agents research, compare and abandon \u2013 and thereby depress exactly the metrics on which optimisation decisions are based.<\/p>\n<h2>Agent identity: from User-Agent to cryptographic signature<\/h2>\n<p><strong>An agent can only be identified reliably if it identifies itself \u2013 and in 2026 a robust standard for this is emerging for the first time.<\/strong> Detection currently works on three levels that differ markedly in trustworthiness.<\/p>\n<p><strong>1. User-Agent token.<\/strong> The simplest, but spoofable. On 20 March 2026 Google documented the <strong>Google-Agent<\/strong> fetcher. According to the <a href=\"https:\/\/developers.google.com\/crawling\/docs\/crawlers-fetchers\/google-agent\" target=\"_blank\" rel=\"noopener noreferrer\">Google documentation<\/a>, its User-Agent contains the token <code>compatible; Google-Agent<\/code> within an otherwise normal Chrome string. As a user-triggered fetch, Google-Agent ignores robots.txt.<\/p>\n<p><strong>2. IP ranges and reverse DNS.<\/strong> Considerably more robust. Google publishes the addresses of Google-Agent in a dedicated file, <code>user-triggered-agents.json<\/code>. According to <a href=\"https:\/\/ppc.land\/google-agent-joins-the-crawler-list-as-ai-browsing-gets-an-official-identity\/\" target=\"_blank\" rel=\"noopener noreferrer\">PPC Land<\/a>, fetches operated by Google resolve via reverse DNS to <code>google-proxy-***-***-***-***.google.com<\/code>. The check takes two steps: a reverse lookup of the IP, then a forward lookup of the hostname back to the same IP.<\/p>\n<p><strong>3. Web Bot Auth.<\/strong> The new approach <a href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/cloud-ai\/web-bot-auth-how-agent-requests-are-signed-and-what-the-signature-proves\/\">signs every request cryptographically<\/a> on the basis of RFC 9421 (HTTP Message Signatures). The IETF working group <code>webbotauth<\/code> has been chartered, but the protocol document is still an Internet-Draft. A signed request carries three additional headers, roughly like this according to <a href=\"https:\/\/contextbolt.com\/blog\/web-bot-auth\/\" target=\"_blank\" rel=\"noopener noreferrer\">Contextbolt<\/a>:<\/p>\n<pre><code class=\"language-http\">Signature-Agent: \"https:\/\/chatgpt.com\"\nSignature-Input: sig1=(\"@authority\" \"signature-agent\");\n  created=1786951400; expires=1786951700;\n  keyid=\"poqkLGiymh_W0uP6PZFw-dvez3QJT5SolqXBCW38r0U\";\n  alg=\"ed25519\"; tag=\"web-bot-auth\"\nSignature: sig1=:jP4kZG2h9xQvT1mN...:<\/code><\/pre>\n<p>The server fetches the public key from the origin given in <code>Signature-Agent<\/code> at <code>\/.well-known\/http-message-signatures-directory<\/code>, looks up the matching <code>keyid<\/code> and verifies the signature as well as the time window from <code>created<\/code> and <code>expires<\/code>. A spoofed User-Agent does not pass this check.<\/p>\n<table>\n<tr>\n<th>Operator<\/th>\n<th>Signature-Agent<\/th>\n<th>Status<\/th>\n<\/tr>\n<tr>\n<td>ChatGPT (cloud browser)<\/td>\n<td>https:\/\/chatgpt.com<\/td>\n<td>signed, key published at the standard path<\/td>\n<\/tr>\n<tr>\n<td>Google-Agent<\/td>\n<td>https:\/\/agent.bot.goog<\/td>\n<td>experimental, only some of the requests<\/td>\n<\/tr>\n<tr>\n<td>Cloudflare Verified Bots<\/td>\n<td>per operator<\/td>\n<td>Web Bot Auth as one of two accepted forms of proof<\/td>\n<\/tr>\n<tr>\n<td>AWS WAF Bot Control<\/td>\n<td>per operator<\/td>\n<td>supported since 21 November 2025<\/td>\n<\/tr>\n<\/table>\n<p>Status according to <a href=\"https:\/\/contextbolt.com\/blog\/web-bot-auth\/\" target=\"_blank\" rel=\"noopener noreferrer\">Contextbolt<\/a>, protocol draft at revision 02 of 18 August 2026.<\/p>\n<p>For most websites, implementing signature verification in-house is not worthwhile. It makes more sense to adopt the classification of a CDN or WAF and pass its result on to the application as a header. The following architecture builds on exactly that.<\/p>\n<h2>Architecture: classification before tracking<\/h2>\n<p><strong>Separation only works if the class of a visit is settled before the tracking script runs.<\/strong> Filters applied afterwards in GA4 come too late, because they lack the server-side signals: signatures, IP origin, reverse DNS.<\/p>\n<p>Three principles support the architecture:<\/p>\n<ul>\n<li><strong>Verification at the edge.<\/strong> The CDN or WAF checks Web Bot Auth, IP lists and reverse DNS and passes the result on as a header.<\/li>\n<li><strong>A single classification.<\/strong> The web server assigns exactly one class per request. Verified identity takes precedence over self-reporting via the User-Agent.<\/li>\n<li><strong>Marking rather than deleting.<\/strong> Agent sessions stay in the data but carry their own dimension. That way the agent channel itself remains open to analysis.<\/li>\n<\/ul>\n<figure class=\"lw-diagram\">\n<img src=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/diagrams\/ki-agenten-klassifikation-en.png\" width=\"1120\" height=\"580\" decoding=\"async\" loading=\"lazy\"\n     alt=\"Flow from top to bottom: an incoming request passes through the CDN\/WAF and the highlighted Nginx web server, which sets agent_class. One path then leads via the server log to a separate property, the other via HTML and dataLayer, plus WebMCP tools, to the main GA4 property; both end in BigQuery.\"><figcaption>The class of a visit is settled on the server before tracking starts; the server log and GA4 carry it separately all the way to BigQuery.<\/figcaption><\/figure>\n<p>The server log records every fetch, including those without JavaScript. GA4 only receives page views \u2013 but with a class and, optionally, with WebMCP events as an unambiguous agent signal.<\/p>\n<h2>Implementation: from the request to the BigQuery analysis<\/h2>\n<p><strong>The implementation consists of four building blocks: classification on the web server, logging, hand-over to tracking, and analysis.<\/strong> The examples use Nginx, PHP, GA4 and BigQuery; the principle carries over to any stack.<\/p>\n<h3>1. Classification in Nginx<\/h3>\n<p>Two sources come together: a header set by the CDN with the verified result (here <code>X-Verified-Agent<\/code>, for example via a Transform Rule) and a simple User-Agent detection as a fallback. The verified result takes precedence.<\/p>\n<pre><code class=\"language-nginx\"># Fallback: self-reported User-Agent (can be spoofed, so only second choice)\nmap $http_user_agent $ua_agent_class {\n    default                                          \"\";\n    ~*Google-Agent                                   \"agent:google\";\n    ~*ChatGPT-User                                   \"fetcher:openai\";\n    ~*Claude-User                                    \"fetcher:anthropic\";\n    ~*Perplexity-User                                \"fetcher:perplexity\";\n    ~*(GPTBot|OAI-SearchBot|ClaudeBot|PerplexityBot) \"crawler\";\n}\n\n# Verified CDN result takes precedence over the User-Agent, otherwise \"human\"\nmap \"$http_x_verified_agent|$ua_agent_class\" $agent_class {\n    default                \"human\";\n    \"~^(?&lt;v&gt;[^|]+)\\|\"       \"$v\";\n    \"~^\\|(?&lt;u&gt;.+)$\"         \"unverified:$u\";\n}\n\nlog_format analytics '$remote_addr [$time_local] \"$request\" $status '\n                     '\"$http_referer\" \"$http_user_agent\" agent=$agent_class';\n\nserver {\n    access_log \/var\/log\/nginx\/access.log analytics;\n\n    location ~ \\.php$ {\n        fastcgi_param AGENT_CLASS $agent_class;\n        # ... remaining FastCGI configuration\n    }\n}<\/code><\/pre>\n<p>Important: at the origin, the <code>X-Verified-Agent<\/code> header must be removed or ignored on requests that do not come through the CDN. Otherwise any client can declare itself verified.<\/p>\n<h3>2. Server logs as a second source of truth<\/h3>\n<p>Fetchers and crawlers do not execute JavaScript and are therefore missing from GA4 entirely. The log format above makes them visible:<\/p>\n<pre><code class=\"language-bash\">grep -o 'agent=[^ ]*' \/var\/log\/nginx\/access.log | sort | uniq -c | sort -rn<\/code><\/pre>\n<p>The result shows how often AI systems fetch content on behalf of users without a session ever being created. For content sites this is often the most revealing figure of all.<\/p>\n<h3>3. Hand-over to the dataLayer<\/h3>\n<p>The class is written into the page on the server and pushed to the dataLayer before the Tag Manager loads:<\/p>\n<pre><code class=\"language-php\">&lt;?php $trafficClass = $_SERVER['AGENT_CLASS'] ?? 'human'; ?&gt;\n&lt;script&gt;\n  window.dataLayer = window.dataLayer || [];\n  window.dataLayer.push({\n    traffic_class: &lt;?= json_encode($trafficClass) ?&gt;\n  });\n&lt;\/script&gt;<\/code><\/pre>\n<p>With full-page caching, the class of the first visitor would be served to everyone. Clean alternatives: inserting the class into the HTML stream via edge logic, varying the cache by <code>$agent_class<\/code>, or reading the class from the request header only in the server-side Tag Manager.<\/p>\n<h3>4. GA4 configuration<\/h3>\n<ul>\n<li>Sending <code>traffic_class<\/code> as an event parameter with the Google tag (in GTM as a dataLayer variable).<\/li>\n<li>Creating a dimension in GA4 under Admin \u2192 Custom definitions with the scope \u201cEvent\u201d and the parameter <code>traffic_class<\/code>.<\/li>\n<li>Custom dimensions do not apply retroactively. The earlier they are set up, the longer the baseline for comparison.<\/li>\n<\/ul>\n<h3>5. Analysis in BigQuery<\/h3>\n<p>The query calculates sessions and conversion rate per traffic class and channel. Project and dataset names need to be adjusted.<\/p>\n<pre><code class=\"language-sql\">WITH events AS (\n  SELECT\n    CONCAT(user_pseudo_id, '-', CAST(\n      (SELECT value.int_value FROM UNNEST(event_params) WHERE key = 'ga_session_id') AS STRING\n    )) AS session_key,\n    (SELECT value.string_value FROM UNNEST(event_params) WHERE key = 'traffic_class') AS traffic_class,\n    session_traffic_source_last_click.cross_channel_campaign.default_channel_group AS channel,\n    event_name\n  FROM `my-project.analytics_123456789.events_*`\n  WHERE _TABLE_SUFFIX BETWEEN '20260901' AND '20260930'\n),\nsessions AS (\n  SELECT\n    session_key,\n    COALESCE(MAX(traffic_class), 'not set') AS traffic_class,\n    MAX(channel) AS channel,\n    COUNTIF(event_name = 'purchase') &gt; 0 AS converted\n  FROM events\n  GROUP BY session_key\n)\nSELECT\n  traffic_class,\n  channel,\n  COUNT(*) AS sessions,\n  ROUND(100 * COUNTIF(converted) \/ COUNT(*), 2) AS conversion_rate_pct\nFROM sessions\nGROUP BY traffic_class, channel\nORDER BY sessions DESC;<\/code><\/pre>\n<p>The most revealing comparison is \u201chuman\u201d against \u201cnot set\u201d: a large share without a class points to caching problems or blocked scripts, while a clearly different conversion rate for \u201cagent:*\u201d confirms the distortion effect.<\/p>\n<h2>WebMCP: measuring agent interactions as clean events<\/h2>\n<p><strong>WebMCP turns the measurement problem around: instead of guessing at agents after the fact, the website offers them defined functions \u2013 and every call is by definition an agent event.<\/strong> To do this, the website registers tools with a name, description and JSON schema that an agent in the browser can call directly.<\/p>\n<p>The status in October 2026 according to <a href=\"https:\/\/mcpplaygroundonline.com\/blog\/what-is-webmcp\" target=\"_blank\" rel=\"noopener noreferrer\">mcpplaygroundonline<\/a> and <a href=\"https:\/\/chudi.dev\/blog\/what-is-webmcp\" target=\"_blank\" rel=\"noopener noreferrer\">chudi.dev<\/a>:<\/p>\n<ul>\n<li>W3C Community Group draft, not yet on the standards track<\/li>\n<li>public origin trial in Chrome from version 149 to 156<\/li>\n<li>The API has moved from <code>navigator.modelContext<\/code> to <code>document.modelContext<\/code>. Chrome 150 marked the old form as deprecated; many tutorials still show the old one.<\/li>\n<li>local testing via <code>chrome:\/\/flags\/#enable-webmcp-testing<\/code><\/li>\n<\/ul>\n<p>WebMCP is interesting for analytics because the measurement can be anchored directly in the handler:<\/p>\n<pre><code class=\"language-javascript\">const mc = document.modelContext ?? navigator.modelContext;\n\nif (mc) {\n  await mc.registerTool({\n    name: 'search_products',\n    description: 'Searches the product catalogue by keyword and an optional maximum price.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        query: { type: 'string' },\n        max_price: { type: 'number' }\n      },\n      required: ['query']\n    },\n    async execute({ query, max_price }) {\n      window.dataLayer = window.dataLayer || [];\n      window.dataLayer.push({\n        event: 'agent_tool_call',\n        tool_name: 'search_products',\n        traffic_class: 'agent:webmcp'\n      });\n\n      const params = new URLSearchParams({ q: query });\n      if (max_price) params.set('max', String(max_price));\n      const data = await (await fetch('\/api\/search?' + params)).json();\n\n      return { content: [{ type: 'text', text: JSON.stringify(data.items) }] };\n    }\n  });\n}<\/code><\/pre>\n<p>The <code>agent_tool_call<\/code> event delivers a signal without heuristics: which functions agents use, how often, and with what outcome over the rest of the session. Input values should not flow into tracking unchecked, because agents may pass on their users\u2019 search terms or form data.<\/p>\n<p>As long as WebMCP only runs as an origin trial, it is an additional signal for early insights, not a replacement for server-side classification. Since the API has already changed once, wrapping it in a dedicated helper function is advisable.<\/p>\n<h2>Data hygiene: hostname allowlist and server-side events<\/h2>\n<p><strong>Two GA4 additions from 2026 belong in every setup that takes agentic traffic seriously: the include filter for hostnames and the Data Manager API.<\/strong> According to the <a href=\"https:\/\/support.google.com\/analytics\/answer\/9164320?hl=en\" target=\"_blank\" rel=\"noopener noreferrer\">Google release notes<\/a>, both are already available.<\/p>\n<p><strong>Hostname include filter (since 21 September 2026).<\/strong> Until now, hostnames could only be excluded, which required maintenance with every new spam source. Now an allowlist of the site\u2019s own domains can be defined. Two details are decisive:<\/p>\n<ul>\n<li>Events without a hostname are discarded automatically. Server-side setups that do not send page context thus lose data unnoticed. The filter should therefore first run in the \u201cTesting\u201d state and only be activated after reconciliation.<\/li>\n<li>Events sent via the Measurement Protocol are not covered by the filter. The <code>api_secret<\/code> therefore remains the only protection of this interface and belongs exclusively on the server.<\/li>\n<\/ul>\n<p><strong>Data Manager API (since 7 May 2026).<\/strong> The API is an <a href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ga4-measurement-protocol-in-maintenance-mode-what-changes-and-when-the-data\/\">alternative to the Measurement Protocol<\/a> for recommended and custom events sent directly to web and app data streams. For the topic of this article it offers a clean way to transfer fetcher requests from the server logs as separate events \u2013 ideally into a separate property, so that human metrics stay untouched.<\/p>\n<p>The result is a clear separation: the main property measures humans and marked agent sessions, while a second property or a BigQuery dataset collects pure machine fetches.<\/p>\n<h2>Checklist for the next 30 days<\/h2>\n<p><strong>The following steps build on one another and can be implemented within a month.<\/strong><\/p>\n<ul>\n<li>Reviewing the \u201cAI Assistant\u201d channel and the \u201cSource Group\u201d dimension in GA4 and saving them as a comparison segment<\/li>\n<li>Extending the server logs with an agent class and collecting one week of baseline data<\/li>\n<li>Checking whether the CDN or WAF evaluates verified bots and Web Bot Auth signatures, and passing the result on as a header<\/li>\n<li>Adding <code>traffic_class<\/code> to the dataLayer and the Google tag, testing caching behaviour<\/li>\n<li>Registering the custom dimension <code>traffic_class<\/code> in GA4<\/li>\n<li>Creating the hostname include filter in the \u201cTesting\u201d state, activating it after reconciliation<\/li>\n<li>Setting up the BigQuery query and comparing conversion rates per class<\/li>\n<li>Testing a WebMCP tool in the origin trial for one central function (search, availability, contact request)<\/li>\n<\/ul>\n<h2>Conclusion<\/h2>\n<p><strong>The key metric in 2026 is no longer \u201cHow much AI traffic is there?\u201d but \u201cWhat share of sessions comes from humans at all?\u201d.<\/strong> The new AI Assistant channel only answers the first question, and even that only for clicks with a referrer.<\/p>\n<p>Agentic browsers run tracking without identifying themselves as agents. The separation only becomes reliable through server-side classification, ideally based on verified identities from Web Bot Auth, IP lists and CDN evaluation. This class belongs in tracking as a dimension of its own, not as a filter applied afterwards.<\/p>\n<p>WebMCP shows where things are heading: websites that deliberately offer functions to agents get clean measurement points in return. Until that becomes standard, a site\u2019s own infrastructure decides whether analytics data still reflects human behaviour.<\/p>\n<div class=\"lw-faq\">\n<h2>Questions and answers<\/h2>\n<h3>Why can agentic sessions not be filtered out of GA4 after the fact?<\/h3>\n<p>Because GA4 only sees what the tag sends. An agentic browser delivers the same data as ordinary Chrome: the same browser, often no referrer or an arbitrary one, and events triggered as usual. The IAB bot list on which GA4\u2019s bot filtering relies does not recognise such browsers.<\/p>\n<p>The features that actually give an agent away belong to the individual HTTP request: the Web Bot Auth signature, the origin in a published IP list and the two-step reverse DNS check. These checks run at the CDN or on the web server. Only when their result is delivered with the page as <code>traffic_class<\/code> does GA4 have a feature to separate by. And since custom dimensions do not apply retroactively, the separation only takes effect from the day it is set up.<\/p>\n<h3>Why does a class derived from the User-Agent carry the prefix \u201cunverified:\u201d in Nginx?<\/h3>\n<p>Because the User-Agent is self-reported and can be spoofed at will. The prefix keeps classes checked by a CDN apart from classes that are merely claimed, in logs and reports alike. Even a genuine Google-Agent can appear as <code>unverified:agent:google<\/code> if the CDN or WAF has not verified its request, especially since Google-Agent so far signs only some of its requests.<\/p>\n<h3>What happens to the class when a page cache or a CDN serves the page?<\/h3>\n<p>Without precautions, every visitor receives the class of whoever requested the page first. The PHP part writes <code>traffic_class<\/code> into the HTML. Once that version sits in the cache, every later request gets the same value, human or agent.<\/p>\n<p>Three approaches keep the class correct:<\/p>\n<ul>\n<li><strong>Varying the cache by class.<\/strong> <code>$agent_class<\/code> becomes part of the cache key. Since the class takes only a few values, each page ends up with only a few versions.<\/li>\n<li><strong>Inserting the class at the edge.<\/strong> Edge logic writes the value into the cached HTML only on delivery, so the cache itself stays uniform.<\/li>\n<li><strong>Reading the class in the server-side Tag Manager.<\/strong> The HTML then carries no class; the server container reads it from the header of the incoming measurement request. This requires that request to pass through the classifying CDN as well.<\/li>\n<\/ul>\n<p>Independently of this, the server log is only complete if requests reach the web server. When an upstream CDN serves a page from its own cache, Nginx never sees that fetch. In that case the CDN logs belong in the analysis too.<\/p>\n<\/div>\n<div class=\"lw-quellen\">\n<h2>Sources<\/h2>\n<ul>\n<li><a href=\"https:\/\/support.google.com\/analytics\/answer\/9164320?hl=en\" target=\"_blank\" rel=\"noopener noreferrer\">Google Analytics: What&#8217;s new (Release Notes 2026)<\/a><\/li>\n<li><a href=\"https:\/\/developers.google.com\/crawling\/docs\/crawlers-fetchers\/google-agent\" target=\"_blank\" rel=\"noopener noreferrer\">Google: List of user-triggered fetchers (Google-Agent)<\/a><\/li>\n<li><a href=\"https:\/\/www.humansecurity.com\/2026-state-of-ai-traffic-cyberthreat-benchmark-report\/\" target=\"_blank\" rel=\"noopener noreferrer\">HUMAN: 2026 State of AI Traffic &amp; Cyberthreat Benchmark Report<\/a><\/li>\n<li><a href=\"https:\/\/www.humansecurity.com\/learn\/blog\/state-of-agentic-traffic-august-2026-agentic-traffic-grows-27-reaches-new-high-as-codex-debuts-strongly\/\" target=\"_blank\" rel=\"noopener noreferrer\">HUMAN: State of Agentic Traffic, August 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.humansecurity.com\/learn\/blog\/ai-traffic-growth-2025-key-findings\/\" target=\"_blank\" rel=\"noopener noreferrer\">HUMAN: Key Findings 2025<\/a><\/li>\n<li><a href=\"https:\/\/snowplow.io\/blog\/agentic-browsing-is-here\" target=\"_blank\" rel=\"noopener noreferrer\">Snowplow: Agentic Browsing Is Here<\/a><\/li>\n<li><a href=\"https:\/\/www.seerinteractive.com\/insights\/how-will-you-know-when-open-ais-operator-agent-hits-your-website\" target=\"_blank\" rel=\"noopener noreferrer\">Seer Interactive: The New Analytics Blind Spot<\/a><\/li>\n<li><a href=\"https:\/\/taggrs.io\/ai-browsers-tracking-attribution\/\" target=\"_blank\" rel=\"noopener noreferrer\">TAGGRS: The impact of AI Browsers on user tracking<\/a><\/li>\n<li><a href=\"https:\/\/en.wikipedia.org\/wiki\/ChatGPT_Atlas\" target=\"_blank\" rel=\"noopener noreferrer\">Wikipedia: ChatGPT Atlas<\/a><\/li>\n<li><a href=\"https:\/\/nohacks.co\/blog\/agentic-browser-landscape-2026\" target=\"_blank\" rel=\"noopener noreferrer\">nohacks: The Agentic Browser Landscape in 2026<\/a><\/li>\n<li><a href=\"https:\/\/ppc.land\/google-agent-joins-the-crawler-list-as-ai-browsing-gets-an-official-identity\/\" target=\"_blank\" rel=\"noopener noreferrer\">PPC Land: Google-Agent joins the crawler list<\/a><\/li>\n<li><a href=\"https:\/\/contextbolt.com\/blog\/web-bot-auth\/\" target=\"_blank\" rel=\"noopener noreferrer\">Contextbolt: Web Bot Auth<\/a><\/li>\n<li><a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/draft-meunier-webbotauth-httpsig-protocol-02\" target=\"_blank\" rel=\"noopener noreferrer\">IETF Draft: HTTP Message Signatures for automated traffic<\/a><\/li>\n<li><a href=\"https:\/\/mcpplaygroundonline.com\/blog\/what-is-webmcp\" target=\"_blank\" rel=\"noopener noreferrer\">mcpplaygroundonline: WebMCP in 2026<\/a><\/li>\n<li><a href=\"https:\/\/chudi.dev\/blog\/what-is-webmcp\" target=\"_blank\" rel=\"noopener noreferrer\">chudi.dev: What Is WebMCP?<\/a><\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>GA4 counts agentic browsers as ordinary sessions, and the new \u201cAI Assistant\u201d channel only captures clicks with a referrer. The article sorts AI visits into three classes and shows server-side classification with Nginx, the dataLayer, a GA4 dimension, BigQuery and WebMCP.<\/p>\n","protected":false},"author":1,"featured_media":22674,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[91380,91333,91297,91258],"class_list":["post-22647","post","type-post","status-publish","format-standard","hentry","category-digital-analytics","tag-artificial-intelligence","tag-bigquery","tag-data-quality","tag-google-analytics-4"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server | Lukas Wojcik<\/title>\n<meta name=\"description\" content=\"GA4 counts AI agents as humans. How agentic traffic can be separated in 2026 via Web Bot Auth, server-side classification and BigQuery \u2013 with code.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server | Lukas Wojcik\" \/>\n<meta property=\"og:description\" content=\"GA4 counts AI agents as humans. How agentic traffic can be separated in 2026 via Web Bot Auth, server-side classification and BigQuery \u2013 with code.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-12T06:37:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/10\/fi-22647-ai-agents-web-analytics-agentic-traffic-ga4--b.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Lukas Wojcik\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lukas Wojcik\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"17 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/\"},\"author\":{\"name\":\"Lukas Wojcik\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"headline\":\"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server\",\"datePublished\":\"2026-10-12T06:37:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/\"},\"wordCount\":2939,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/fi-22647-ai-agents-web-analytics-agentic-traffic-ga4--b.png\",\"keywords\":[\"Artificial Intelligence\",\"BigQuery\",\"Data Quality\",\"Google Analytics 4\"],\"articleSection\":[\"Digital Analytics\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/\",\"name\":\"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server | Lukas Wojcik\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/fi-22647-ai-agents-web-analytics-agentic-traffic-ga4--b.png\",\"datePublished\":\"2026-10-12T06:37:00+00:00\",\"description\":\"GA4 counts AI agents as humans. How agentic traffic can be separated in 2026 via Web Bot Auth, server-side classification and BigQuery \u2013 with code.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/fi-22647-ai-agents-web-analytics-agentic-traffic-ga4--b.png\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/fi-22647-ai-agents-web-analytics-agentic-traffic-ga4--b.png\",\"width\":1200,\"height\":630,\"caption\":\"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/en\\\/digital-analytics\\\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"Lukas Wojcik\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"Lukas Wojcik\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server | Lukas Wojcik","description":"GA4 counts AI agents as humans. How agentic traffic can be separated in 2026 via Web Bot Auth, server-side classification and BigQuery \u2013 with code.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/","og_locale":"en_US","og_type":"article","og_title":"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server | Lukas Wojcik","og_description":"GA4 counts AI agents as humans. How agentic traffic can be separated in 2026 via Web Bot Auth, server-side classification and BigQuery \u2013 with code.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/","og_site_name":"Lukas Wojcik - Blog","article_published_time":"2026-10-12T06:37:00+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/10\/fi-22647-ai-agents-web-analytics-agentic-traffic-ga4--b.png","type":"image\/png"}],"author":"Lukas Wojcik","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Lukas Wojcik","Est. reading time":"17 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/#article","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/"},"author":{"name":"Lukas Wojcik","@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"headline":"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server","datePublished":"2026-10-12T06:37:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/"},"wordCount":2939,"commentCount":0,"publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/10\/fi-22647-ai-agents-web-analytics-agentic-traffic-ga4--b.png","keywords":["Artificial Intelligence","BigQuery","Data Quality","Google Analytics 4"],"articleSection":["Digital Analytics"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/","url":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/","name":"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server | Lukas Wojcik","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/#primaryimage"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/10\/fi-22647-ai-agents-web-analytics-agentic-traffic-ga4--b.png","datePublished":"2026-10-12T06:37:00+00:00","description":"GA4 counts AI agents as humans. How agentic traffic can be separated in 2026 via Web Bot Auth, server-side classification and BigQuery \u2013 with code.","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/#primaryimage","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/10\/fi-22647-ai-agents-web-analytics-agentic-traffic-ga4--b.png","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/10\/fi-22647-ai-agents-web-analytics-agentic-traffic-ga4--b.png","width":1200,"height":630,"caption":"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/en\/digital-analytics\/ai-agents-web-analytics-agentic-traffic-ga4-server-side\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"AI Agents in Web Analytics: How Agentic Traffic Skews GA4 and How It Can Be Separated on the Server"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"Lukas Wojcik","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"Lukas Wojcik"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/22647","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=22647"}],"version-history":[{"count":1,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/22647\/revisions"}],"predecessor-version":[{"id":22694,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/22647\/revisions\/22694"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media\/22674"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=22647"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/categories?post=22647"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=22647"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}