How we count & filter traffic

Counting

A billable impression is the render-confirmed served beacon — never the ad request. Clicks deduplicate per impression: only the first can bill; repeats redirect but carry the original click id. Every billable event becomes exactly one double-entry ledger transaction, and this CSV, your dashboard totals, and your balance all derive from that one event log — they cannot disagree with each other.

First-price auction: win_price_micros equals your bid. To join clicks in your own tracker, add {PUFF_CLICK_ID} / {PUFF_IMP_ID} macros to your landing URL — or read the pclid parameter we append when no macro is present.

Filtering

We record every event, then mark the ones that fail an invalid-traffic check. Filtered events are never billed and never hidden — on the advertiser raw export each appears with its exact reason:

filter_reason	Meaning
bot_ua	Known bot / automated user-agent.
rate_ip_hour	Per-network (/24) hourly rate cap exceeded.
rate_ip_day	Per-network (/24) daily rate cap exceeded.
rate_uid_hour	Per-user hourly rate cap exceeded.
rate_uid_day	Per-user daily rate cap exceeded.
dup_window	Same user re-rendered the same ad in the same zone inside the dedup window.
rate_zone_min	The zone's automatic rate brake is active — serving is paused for a cooldown after its per-minute rate spiked.
rate_campaign_min	The campaign's per-minute served-event ceiling was crossed.

The publisher view — coarse categories

Publishers see the same filtered impressions on their reporting, but grouped into a few plain categories rather than the exact reason. We show the category, not the precise cap or threshold, so a bad actor can't read the rules and pace under them — the fact is disclosed, the parameter is not. The mapping:

Category	filter_reason(s)
Automated	bot_ua
Rate-limited	rate_ip_hour, rate_ip_day, rate_uid_hour, rate_uid_day
Duplicate	dup_window
Rate protection	rate_zone_min, rate_campaign_min
Other	any newer reason not yet categorised

See Filtered traffic on your zones for the publisher-facing explanation. Country/network blocklist drops are counted separately — a blocked request never renders an ad, so it never becomes a filtered impression here.

Identity

We identify a viewer by a first-party cookie, or — when none is set — a keyed hash of coarse request signals. Your full IP address is never stored: we keep only its /24 network prefix.