The story. U.S. and U.K. publishers are now lobbying for near-identical laws that would force AI crawlers to say who they are. The data behind the push shows scraping growing fast and impersonation common. (Digiday, 22 October 2026)
The numbers in this piece
01What happened
- The U.S. push. In September the News/Media Alliance brought more than 300 publishing executives to lobby Congress for the Stealth Bot Prohibition Act. It would require stealth crawlers to identify themselves and their purpose.
- The U.K. copy. On 15 October a coalition including The Times, the Financial Times and Condé Nast urged the U.K. government to back a similar bill, led by the News Media Association.
- A shared text. Danielle Coffey, CEO of the News/Media Alliance, said the U.K. bill is modelled on the U.S. act. A 14 October joint statement from U.K. and U.S. media executives backed Damian Hinds MP’s bill.
- Scraping is the biggest bot problem. DataDome’s September report found scraping up 185.2% over its 12 months, and now 70.9% of malicious bot traffic.
- Most of it is unverified. A Piano analysis of Cloudflare data found 70% of bot traffic is unverified.
- Impersonation is routine. Centinel’s report, covering late June to 21 September, found 84% of GPTBot requests and 99% of Perplexity-User requests were fake. One in seven requests claiming to be Googlebot failed verification.
- Fakes copy the real thing. Centinel found 94% of fake Googlebot requests copied Google’s genuine crawler version string.
- What publishers see. People Inc. lets through 38 bots a day among tens of millions of blocked AI crawler requests. The Financial Times saw one account try for about a million articles in eight hours from roughly 700,000 IP addresses.
- The cost of success. Reach CEO Piers North said Reach has seen over 100 million successful scrapes of its content in six months.
02What it means inside a GAM network
We covered the bill at introduction and again when Politico put a hosting cost on it. The new part is the mechanics of evasion, because they decide what a disclosure law can and cannot do for your ad stack.
Start with the user-agent string. Centinel’s finding that most fake Googlebot requests copy the genuine version string means a rule that trusts the label lets the impostor in. Verification has to rest on something the impostor cannot copy, such as the crawler operator’s published IP ranges or a reverse DNS check.
Then there is the ad-server angle. Bots that render pages and run scripts can fire ad requests. In Ad Manager that shows up as requests with no human behind them, which dilute fill and viewability rates and give buyers a reason to discount your inventory. The publisher pays for the load on both sides: the hosting bill and the quality score.
Finally, People Inc. and Reuters both moved to block by default after blocking one crawler at a time proved unworkable. Reuters’ own general manager for digital, Phil Andraos, said those efforts “aren’t ironclad”. A law that obliges crawlers to identify themselves helps most the publisher who has already built the enforcement layer, and does little for one who has not.
One fair caution: the Centinel, DataDome and Piano figures come from vendors that sell bot defence, and Digiday reports them without independent audit. Treat the direction as solid and the exact percentages as indicative.
Both countries' publishers are asking for the same law, and neither law exists yet.
03What publishers should do about it
04The bottom line
Both countries’ publishers are asking for the same law, and neither law exists yet. The evidence says identification is the missing step, but blocking by default is the part you can do on your own this quarter.