Questions, and what Telltale Bot misses

The basics · Privacy and consent · AI agents · What it misses · Verdicts and numbers

The basics

Does it block bots?

No. Telltale Bot detects and reports; it never stops or challenges/captchas a visitor. The verdict goes to your page's dataLayer and to your reports, and what you do with it is up to you.

Why use it instead of Cloudflare, DataDome or HUMAN?

Those services are built to block bots at the front door, and they are priced and set up for that. If you need enforcement, you need one of them. If you need to know who is visiting, Telltale Bot is simpler and cheaper: one tag, no change to your hosting or DNS, nothing a visitor ever sees. It names AI agents separately from bots, and it can run beside a blocker and show you what gets past it. How Telltale Bot compares covers these and others, with their prices.

Doesn't Google Analytics already filter out bots?

Only partly. GA automatically excludes traffic from known bots and spiders, identified primarily from IAB's list of bots. Those are mostly User-Agent driven, e.g. crawlers that say who they are, and you can't see or adjust what was removed. Automation that runs a real browser and passes as an ordinary visitor isn't on any list, so GA4 counts it as a user. Telltale Bot puts its verdict in your dataLayer, so you can send it to GA4 as a dimension and segment or exclude bots and agents yourself. Send the verdict to your analytics shows how.

Do I need Google Tag Manager?

No. The tag works directly in your pages, and that works better: blockers that block Google Tag Manager don't stop it. GTM is just the easier install for some sites. See Install Telltale Bot.

Will it slow my site down?

No. The script loads after your page, without holding it up, and most of the work happens on our server. Every tag adds a little; ours is about 13 KB compressed, a fraction of the size of Google Analytics' own script, and built to stay out of the page's way.

Can it break my site?

It's built not to. The script only watches: it doesn't change your page's content, layout or behavior. It has its own error handling, so a problem in our script stays in our script instead of reaching your page's code. If our script or server can't be reached, or a visitor blocks it, your page works exactly as it would without the tag; your dataLayer just gets no verdict for that visit.

Because any tag has some possibility of conflicting with something else on your site, we recommend testing Telltale Bot just as you'd test any other new tag.

If you ever think it's causing a problem, remove the tag (or pause it in GTM) and write to support@telltale.bot.

How do I know if Telltale Bot is down?

Our status page checks the server that receives your reports, the script and the viewer every few minutes and shows any outage. During one, your pages work as usual; visits just get no verdict until we're back.

What does it cost?

Plans start at $20 a month for 100,000 pageviews. The price is set by your pageviews a month across all your sites, and every plan has every feature. Every plan starts with a 14-day free trial. See Pricing.

Can I use it on more than one site?

Yes. Each site gets its own tag and its own reports, and your plan's pageviews cover all your sites together. You can add sites yourself in the viewer. An agency can give each client a login that sees only that client's site, from Team in the viewer.

What happens if I go over my plan?

Your plan is a number of pageviews a month across all your sites. We don't charge for going over: we email you at 80% and again at 100%, and passing your plan in one month changes nothing. If you're over two months running, we'll ask you to move up a plan. At one and a half times your plan, we stop recording your reports until you move up a plan or the month ends: your dataLayer still gets a verdict for every visit, but nothing new appears in your reports. At twice your plan, Telltale Bot stops judging visits to your sites too, so your dataLayer gets no verdict. Your pages keep working as before either way. You can move up a plan at any time in the viewer, under Account settings › Billing.

Privacy and consent

Does it require consent?

We recommend running it on every page before consent, as a security measure. As the site owner, you can rely on legitimate interest under the GDPR: preventing fraud and keeping networks and services secure — which are named in the regulation as legitimate interests (Recitals 47 and 49). In the EU, the EEA and the UK, reading from a visitor's device also needs consent unless it is strictly necessary (ePrivacy Article 5(3); PECR in the UK). Bot and fraud protection is commonly run under that exception, and we think Telltale Bot qualifies. Running it only after consent mostly defeats the purpose of bot detection: automation seldom accepts a consent banner (bots may never answer it, and AI agents tend to decline it). The decision is yours: see Consent in the install guide and Privacy.

Is this fingerprinting?

Telltale Bot looks very closely at how a browser is set up and how it behaves. Many of these techniques are shared with browser fingerprinting. The purpose of collecting this information is to recognize automated browsing to help prevent bot abuse and stop fraud. Telltale Bot sets no cookies, keeps nothing on the device after the tab closes, never records what anyone types, never follows a visitor from one website to another, and deletes reports after 30 days.

Where is Telltale Bot hosted? Is there an EU-only version?

Primarily on Vultr in the US, which runs our server and stores the data, and Bunny.net, an EU company, which delivers the script. If you're an EU customer wanting an EU-only version, we can arrange that on an enterprise-level plan. See Privacy.

AI agents

Can it detect AI fetching, such as ChatGPT or Claude reading a page to answer a question?

No. When an assistant fetches a page to answer a question (ChatGPT-User, Claude-User, Perplexity-User, etc.), it typically downloads the page without running its JavaScript, so our script never runs. We refer to this as a "web fetch". Some assistants (currently Mistral, Kimi, and others) do run JavaScript and so we would detect those. When doing a web fetch the AI assistants also rely on their own service's caches of the internet, so in many cases with popular sites the web fetch doesn't hit the website at all, even in a non-JS manner.

The same goes for AI training crawlers such as GPTBot and ClaudeBot. Your server logs see those visits, and they name themselves in their user agent. Telltale Bot sees AI agents that browse in a real browser: see which AI agents we recognize.

Does it see an agent that only reads a page but doesn't act?

Not always. An agent that only reads through a person's own browser, such as Copilot in Edge, Gemini in Chrome, ChatGPT in Chrome or Comet's assistant, changes nothing a website can see, so the visit counts as that person. If it then does something on the page we're likely to be able to detect it.

What happens with an agent you don't recognize?

It is called a bot. We call a visit agentic only when there is evidence of an assistant behind it. An agent's first page can also read as a bot if it loads the page before it acts; it is named once it acts. That is our definition of agentic: automation at the direct request of a real person. If we can't find the person behind it, we count it as a bot. We keep adding agents, and when we learn to recognize a new one we may re-judge recent reports, so visits in your reports can move from bot to agentic.

Why is a visitor marked "mixed"?

An agent in a person's own browser counts as the same visitor as that person, so one visitor can have both human and agentic visits. Plus, sometimes we aren't sure about a verdict, so the same visitor's tabs can come out differently: a bot that doesn't show bot-ish behavior right away can look human in one tab and bot in the next.

What it misses

Which visits does it never see?

• Anything that does not run JavaScript: most crawlers, scrapers and uptime checks, and AI fetchers (see above).
• Visitors who block the script, or who block the tag manager that loads it. We are not currently blocked by any major blocklists (such as EasyPrivacy, DuckDuckGo Tracker Radar, etc.), though we expect that will happen eventually. When it does our domain aliasing feature will become more important to do on install.
• Visitors who leave before the page finishes loading.
• Route changes in single-page apps, as pageviews of their own. The script reports once per full page load, so a route change inside the app is part of the same pageview. The visit is still judged as a whole: what the visitor does after a route change counts toward its verdict in your reports.

Can bots get past it?

Yes, some do. No detector catches everything. Tools built to pass as a person, and bots routed through real households' internet connections (residential proxies), are the hardest cases, and some get through. We don't flag residential proxy IP addresses: in our testing they change hands too often to be reliable.

We can't promise that any particular tool will be caught, though if you have a problem with a particular attack we would be happy to investigate. In the viewer, Wrong verdict? on any visitor sends it to us; we review each one and fix what we find.

Can a real person be called a bot?

Yes, though these false positives are less common than the false negatives of the previous question. It is usually something unusual about the browser or the connection:

• Tools that change how the browser identifies itself, such as user-agent switchers and some privacy tools.
• Developer tools, such as the browser's DevTools or device emulation.
• Corporate security software, antivirus, and proxies.
• Virtual machines, and devices with unusual settings.

If a verdict on a real person looks wrong, tell us.

Verdicts and numbers

When does the verdict arrive?

Usually within a second of the page loading. Our server answers in a fraction of a second; the rest depends on your page, on where the visitor is, and on how early the tag runs (directly in the page's <head> is sooner than through a tag manager).

Is each page judged on its own?

No, the verdict covers the visit so far, so what a visitor does on one page counts from their next page on. If it changes the verdict while they are still on the page, telltale.verdict-update arrives: see the install guide.

Can past verdicts change?

Yes. When we improve the rules, we may re-judge stored reports.

What do I do when a verdict looks wrong?

Mark the visitor with Wrong verdict? in the viewer. Those reports are how we find and fix mistakes.

Something else?

Write to support@telltale.bot.