What Google Ads advertisers should know about duplicate GCLIDs and charges arising from invalid impressions

Is Google charging you twice for the same click?

If you manage Google Ads campaigns with significant budgets, you probably trust that Google only charges you for legitimate clicks. But there are two anomalous billing patterns that, once you become aware of them, are hard to ignore — and they raise serious questions about the integrity of the billing system.

At Fáktica, we have spent months documenting these patterns and formally reporting them to Google, with open claims totaling several million dollars.

GCLID: a promise of uniqueness that does not always hold

Every time someone clicks on one of your ads, Google generates a unique identifier called a GCLID (Google Click ID). The logic is simple: one click, one GCLID. That identifier is the basis on which billing is built.

The problem arises when the same GCLID is charged twice.

This should not be possible. A duplicate GCLID may indicate one of two things: either a flaw in Google’s billing system, or a replay attack, in which a bot captures an ad URL together with its GCLID and reuses it multiple times to generate additional clicks. In either case, the result for the advertiser is the same: they are paying more than once for what Google committed would be a unique event.

In our campaign analysis, we have identified documented cases of the same GCLID being charged on two separate occasions. In one case, each click cost $941 — meaning that the duplication alone resulted in an overcharge of nearly $1,000 for a single event.

The second issue: clicks charged from impressions that Google itself classifies as invalid

This second pattern is even more revealing, because it points to an internal contradiction within Google’s own systems.

When Google detects that an impression is invalid — that is, that it was not viewed by a real user — it invalidates it. That is exactly what should happen. The problem is that, in some documented cases, the click associated with that invalid impression is still charged.

One click, zero impressions

Put differently: Google acknowledges that the impression was not legitimate, yet still charges you for the click that supposedly resulted from it.

We have also observed a variation of this pattern: two consecutive clicks with different GCLIDs, originating from the same user within a matter of seconds, with only one valid supporting impression. Mathematically, it is not possible for both clicks to be legitimate.

Note: How do we know whether it is the same GCLID or different GCLIDs? By analyzing server logs and/or capturing the gclid from the UTM parameters and storing it in real time. Capturing it through GTM and sending it to a Google Sheet is the simplest approach, but it is more robust to capture it at the WP Engine or Cloudflare level.

Why does this matter beyond the individual amount?

These two patterns share a characteristic that makes them especially difficult to detect: they are only visible when the number of clicks exceeds the number of impressions for the same day, campaign, and keyword (or extended landing page). If, during that same period, there are also valid impressions from real users, the incorrect charges remain hidden and are practically impossible to identify without deep server-log-level analysis.

This means that the cases that can be documented with certainty are, almost certainly, only the tip of the iceberg.

What you can do as an advertiser

First of all, check whether you have a problem — and how serious it is.

If you manage campaigns with high CPCs — especially in legal, financial, or healthcare sectors, where a single click can cost several hundred dollars — it is worth reviewing:

Whether you have GCLID auto-tagging enabled and whether you are cross-checking that data against your server logs.
Whether, in any campaign or keyword, you observe a CTR above 100% (more clicks than impressions) on a specific day.
Whether you have access to your server session data and can identify multiple requests within seconds for the same user identifier.

If you do not have direct access to server logs or prefer a more accessible alternative, a simple and effective way to identify cases is to include the ValueTrack parameter {random} in the account tracking template or final URL suffix. This parameter assigns each click a random number generated by Google (an unsigned 64-bit integer).

What Google says… and what happens in reality

The ValueTrack parameter {random} mentioned above is especially useful in illustrating just how anomalous these cases are according to Google’s own standards.

We ran a simple test: we asked Google’s Help documentation whether it was possible for two clicks to share the same ValueTrack {random} parameter, and its answer was the following:

In other words, according to Google, the probability of this happening is “astronomically low” and, in practice, “negligible.”

Lucky us: in the last 10 days alone, it has happened to us 11 times.

At this rate, if we bought lottery tickets, we would win every draw.

These are all clear cases of undetected fraud. But the hardest ones for Google to explain are those showing 2 clicks and only 1 impression, because they suggest that its invalid-impression control system and its invalid-click control system do not communicate with each other.

If you are in a similar situation, file a claim. And make sure it is routed to Billing, not generic support.

Conclusion

Transparency in billing data at the GCLID level — including which clicks have already been credited by Google — is information every advertiser should have access to. Without it, reconciling what has been charged with what has been refunded is simply impossible.

What we have documented is not a one-off error or a statistical anomaly. It is a systematic pattern that, by its very nature, remains hidden from most advertisers. If you manage high-CPC campaigns, the question is not whether you should review this — it is how long you have been overpaying without knowing it.

If you want to find out whether your campaigns are affected, follow the steps outlined in this post or contact us.