What is click validation?

What gets checked

• Origin. Whether the click came from a plausible consumer network or from a data centre.
• Device integrity. Whether the reported device is real, and whether it is an emulator.
• Duplication. The same click reported more than once, or the same device clicking implausibly often.
• Parameter integrity. Malformed, missing or tampered campaign parameters.
• Timing. Rates and intervals no human population produces.

When validation happens

At click time, which is fast and works on limited information — origin, device, malformed requests.

At attribution time, when the click can be assessed against the install it is claiming, including CTIT.

Retrospectively, in batch analysis that identifies patterns invisible at the level of any individual click.

The three catch different things, and a system relying only on the first will pass most of what matters.

What it cannot catch

Validation confirms a click was technically legitimate. It cannot confirm the click was meaningful.

A real human, on a real device, on a real network, who tapped a misleading placement or was paid to tap it, produces a click that passes every validation check and is worth nothing. That is a quality problem rather than a fraud one, and it is measured downstream — retention, conversion, and cohort behaviour by source.

The instrument that covers both cases at once is a holdout. Incrementality does not care whether a click was fraudulent or merely worthless; it measures whether the source caused anything.