How to Audit Lead Quality: A 9-Step Framework for 2026

A lead quality audit traces every lead from ad click to closed record and checks nine control points along the way. It matters because Google's own help documentation now states that its invalid traffic filters "don't prevent invalid leads on their own" — most traffic checks happen after your ad serves, so bots reach your form regardless.

That sentence, surfaced by PPC News Feed on 17 September 2026, is the most useful thing Google has published about lead generation in years. Not because it reveals anything a working media buyer did not suspect, but because it puts the division of labour in writing. Google decides whether a click is billable. Whether the thing behind that click leaves a usable phone number is your engineering problem.

Most advertisers never run this audit because the reporting looks fine. The conversion column fills up. The cost per lead sits near the number you budgeted. Nothing in the interface tells you that a quarter of those rows are junk, or that your bidding algorithm has spent six weeks learning to find more of them.

Here is the nine-step version you can start today. Step 1 takes an afternoon and will tell you whether the other eight are urgent.

Step 1: Reconcile platform conversions against what you actually received

Before you change a setting, establish the gap. Pull the conversion count from the ad platform for a closed month. Then count the records that reached the place where a human acts on them — the CRM, the inbox, the phone log. Count them by hand if the volume is small enough.

Three numbers matter: what the platform reported, what arrived, and what a salesperson would call a real enquiry. If the first and second disagree, you have a routing or tracking fault. If the second and third disagree, you have a lead quality problem. They are different failures with different fixes, and conflating them wastes a month.

A tracking fault is the more common of the two and the more embarrassing to discover late. A conversion event that fires on page load rather than on submission, a thank-you page reachable by direct navigation, a form handler that stopped emailing after a DNS change — each produces a healthy-looking conversion column and an empty inbox. Compare against the average conversion rate for your industry to see whether your reported rate is implausibly good.

What to write down

• Platform-reported conversions for the month, by campaign.
• Records that reached the CRM or inbox, by source.
• Records a salesperson would contact, after a manual read.
• The two gaps, as percentages.

Carry those three numbers through the rest of the audit. Every later step is an attempt to explain a gap.

Step 2: Put Google's three named controls on the form

Google's "Prevent invalid leads" help page lists exactly three technical safeguards, and they map neatly onto three different attackers.

reCAPTCHA stops the unsophisticated script. It runs in the browser, which is also its limitation. Note that a 2025 Austrian court decision found reCAPTCHA required consent before it could lawfully run, which puts it inside the same consent flow as your advertising tags — relevant if you serve European visitors.

Double opt-in catches the real person who typed a fake address to get past a gate. The form triggers an email with a unique confirmation link, and the lead counts only once the link is clicked. This one has a measurement consequence most teams miss: you now have two moments that could be called the conversion, and Google's documentation does not say which to report. Pick one, write it down, and keep it consistent.

Server-side validation is the only control that addresses the attack the other two cannot. Sophisticated bots post data directly to your form endpoint and skip every check that runs in a browser. Google's instruction is that your server verifies email domains resolve and phone numbers match legitimate regional formats before the submission is accepted and pushed to the CRM.

None of this advice is new — the Google Ads Liaison account gave the same three measures to an advertiser in October 2022. What changed in September 2026 is that it became a standing help page instead of a social media reply, which means it is now the documented expectation.

Step 3: Check that you are optimising toward a lead worth money

This is the step that changes results fastest, and it is a settings change, not an engineering project.

Google names four lead-specific conversion goals — Qualified lead, Converted lead, Book appointment and Request quote — and states in its best practices documentation that these goals "automatically trigger invalid traffic protections" built specifically for lead generation campaigns. Neither document explains what those protections do, which is frustrating, but the setting costs nothing to select correctly.

If your bidding optimises toward a generic form submission, you are telling the algorithm that every form fill is equally valuable. It will then go and find the cheapest ones. Bots are very cheap.

Google also advises against selecting goals from multiple stages of the lead journey for optimisation at the same time. Choose the stage that correlates with revenue and let the rest report.

Step 4: Test your account against Google's three numeric thresholds

The best practices page sets three conditions for the conversion action used in bidding. They are among the few hard numbers Google publishes on this subject, and most lead generation accounts fail at least one.

Those three conditions pull against each other, and it is worth naming the tension rather than pretending it resolves. A qualified or converted lead is confirmed by a salesperson after review, which routinely takes longer than seven days and produces far fewer events than raw form fills. So the goal that best predicts revenue is often the goal that breaches both the volume floor and the delay window.

The practical compromise: optimise toward the latest stage that still clears 15 events in 30 days and lands inside seven days, and use the deeper stages for reporting and for value assignment. If nothing clears the floor, your account is too small for stage-based optimisation and you should be buying on a mid-funnel signal while you build volume.

Step 5: Verify the consent signal still reaches Google

This one has a date attached, and it is the most likely silent breakage of 2026.

Google Analytics has confirmed that starting 15 June 2026, Consent Mode becomes the single control for data flowing to Google Ads. Before that change, collection of Google Ads cookies and IDs from the Analytics tag was governed by both the Google Signals setting in Analytics and your Consent Mode Ads settings. After it, users' privacy selections managed through Consent Mode Ads settings exclusively govern how that data is collected and used, and the Google Signals setting only controls whether Analytics data is associated with signed-in user information for behavioural reporting.

The failure mode is quiet. A consent banner that does not set ad_storage correctly no longer has a second setting compensating for it. Conversions thin out, audiences shrink, and Smart Bidding loses signal, with nothing in the interface announcing why. Google has also said that ads personalization controls and IP address handling will consolidate the same way later in 2026, so this is a recurring check rather than a one-off fix.

Test it the boring way: load your own site in a clean browser, decline the banner, accept the banner, and confirm in tag debugging that the consent state changes as expected in each case.

Step 6: Audit the upload path before it is deprecated under you

If you send offline conversions back to Google — and for lead generation you should — check which pipe you are using.

Google said in May 2026 that the Google Ads API would stop accepting new adopters of offline conversion imports from 15 June 2026, including enhanced conversions for leads, and directed new integrations to the Data Manager API. Google also merged its separate enhanced conversions products into a single toggle during 2026. Existing integrations were not switched off, but a pipeline closed to new adopters is a pipeline with a shelf life, and finding that out during a migration deadline is worse than finding it out now.

While you are in there, check the two diagnostic metrics Google exposes for enhanced conversions: coverage, the share of eligible conversion events carrying sufficient user-provided data, and match rate, how well that data matches Google's signed-in records. Conversion uplift is also shown, but only for the first 30 days after enhanced conversions starts working — after that the status reverts and the impact figure disappears. If you want that number, screenshot it inside the window.

Upload timing has its own trap: conversions uploaded more than seven days after the ad interaction are not attributed, which turns a slow CRM export into invisible performance.

If this audit is turning up more gaps than you have time to close, our free paid media audit covers the tracking, conversion configuration and traffic quality checks in this article against your own account, and you get the findings whether or not you work with us.

Step 7: Check your device, geography and placement mix against invalid traffic benchmarks

Invalid traffic is not evenly distributed, and the distribution is stable enough to plan around. Fraudlogix's State of Ad Fraud 2026, published 14 January 2026 from a dataset of 105.7 billion impressions collected across 2025, found a global invalid traffic rate of 20.64% — roughly one impression in five showing risk signals.

Two things stand out for a Canadian advertiser. Canadian traffic is measurably cleaner than American traffic at 12.28% against 23.69%, so a campaign running across both markets carries a different risk profile in each and should be segmented before it is judged. And desktop runs materially dirtier than mobile or tablet, at 27.03% against 19.30% and 16.34% — worth knowing before you read a device performance report as an audience insight.

Treat these as directional. Fraudlogix sells fraud detection, verification vendors classify invalid traffic differently, and there is no standardised industry taxonomy to reconcile them against. The value is in the relative gaps between segments, not the decimal places.

There is a channel dimension too. Lunio reported in August 2026 that retail search campaigns running AI Max carried 72% more invalid traffic than standard search in the same accounts — 5.28% against 3.07% in Q2 2026. That dataset covers retail rather than lead generation, and Lunio also sells detection tools, so the direction is more reliable than the magnitude. The general point holds: broader automated reach pulls from a wider pool, and wider pools carry different traffic. The same logic applies when you review Performance Max benchmarks against your own results.

Step 8: Read your invalid activity credits — and know what they do not fix

Google documented the Invalid Activity Credit Report on 1 June 2026, breaking credits down by campaign and network with adjusted performance metrics. Coverage is limited to Search and Performance Max. Google's invalid traffic documentation also clarifies that invalid traffic detected before month-end billing is excluded from charges outright, while activity identified after billing produces credits appearing as adjustments on future invoices. Advertisers can request an investigation into activity from the previous 60 days.

Read the report. Then be clear about its limits, because this is where most teams stop too early.

A credit reverses a charge. It does not delete a form submission from your CRM, it does not return the twenty minutes a salesperson spent chasing it, and Google's documentation does not state whether a conversion recorded from a click later classified as invalid is removed from the data Smart Bidding learns from. That last omission is the expensive one: if the training signal survives the refund, you are being repaid for the click while continuing to pay for the behaviour it taught.

Marketers appear to have priced this in already. In Lunio's survey of 131 senior marketing leaders released on 15 July 2026, 51.1% named automated bidding optimising toward non-human converters as a top agentic AI risk, 22.9% named sales time lost to bot-generated lead forms as the most damaging cost, and 22.1% named corrupted CRM data. In the same survey, 38.9% rated their trust in platform invalid click credits at 4 or below out of 10, while only 5.3% ran a dedicated invalid traffic tool. Low trust, low adoption — a gap worth deciding about deliberately rather than by default.

One native control has a documented weakness worth knowing: in April 2026 a Spanish agency demonstrated that Google Ads IP exclusion lists could be bypassed by separating the address that harvests a valid click identifier from the one that later uses it. IP exclusions are still worth maintaining. They are not a perimeter.

Step 9: Close the loop by writing lead outcomes back into bidding

Everything above is diagnosis. This step is the only one that compounds.

If your sales team marks a lead as junk, that judgement has to travel back to the platform or the audit repeats itself next quarter. Practically, that means a disqualification reason on every lead record, a scheduled export of outcomes, and a value assigned to each stage so that value-based bidding has something to optimise against. Google's lead journey mapping tool, announced at Marketing Live in May 2026, is the native way to attach conversion actions, untracked steps, conversion values and delays to each stage of the journey.

The economics decide the ambition. If your cost per lead by industry is low and volume is high, feeding back a simple qualified or not qualified flag is enough. If leads are expensive and scarce, assign real values by stage, because the difference between a $200 enquiry and a $20,000 one is invisible to a bidding algorithm that sees both as a single conversion.

This is also the point where lead quality stops being a tracking topic and becomes an attribution one. If you are assigning values across stages, read how the attribution model you have chosen treats those events before you trust the resulting report.

The nine-point lead quality audit scorecard

Score each line pass or fail. Anything you cannot answer from data counts as a fail, because an unverified control is not a control.

A first run that scores four or five is ordinary. Steps 1, 2 and 3 are where the fastest return sits: one afternoon of counting, one engineering ticket, one settings change.

If the audit surfaces waste further upstream — impressions you never chose, frequency you never set — the companion piece on finding wasted ad spend works the media side of the same problem, and the Google Ads account audit checklist covers account structure.

Methodology and sources

Google's position on invalid leads is drawn from its "Prevent invalid leads" and "Best practices for generating high-quality leads" Help Centre pages, reported by PPC News Feed on 17 September 2026 and covered by PPC Land on 20 September 2026; the pages carry no publication date. The consent control change is from Google Analytics Help, "Updates to Google Analytics Data Controls", which states the 15 June 2026 transition. Enhanced conversions diagnostics, coverage, match rate and the 30-day conversion uplift window are from Google Ads Help. Invalid traffic rates are from Fraudlogix, The State of Ad Fraud 2026, published 14 January 2026, covering 105.7 billion impressions from 1 January to 31 December 2025. Survey figures and the AI Max invalid traffic comparison are from Lunio, released 15 July 2026 and 12 August 2026 respectively. Both Fraudlogix and Lunio sell fraud detection products; their figures are reported here with that interest disclosed. Where Google publishes no number, none has been supplied.

Frequently asked questions

How do I know whether I have a lead quality problem or a tracking problem?

Count three numbers for a closed month: conversions the platform reported, records that reached your CRM or inbox, and records a salesperson would actually contact. A gap between the first two is a tracking or routing fault. A gap between the second and third is lead quality. They look identical in a performance report and need completely different fixes, so establish which one you have before changing any settings.

Does Google refund me for fake leads?

Not for the lead — only for the click, and only sometimes. Google excludes invalid traffic detected before month-end billing from charges, and issues credits as invoice adjustments where it is identified afterwards. The Invalid Activity Credit Report, documented in June 2026, shows this by campaign for Search and Performance Max. But a credit reverses a charge; it does not remove the submission from your CRM, and Google's documentation does not say whether the associated conversion is removed from the data Smart Bidding learns from.

Will reCAPTCHA stop bot form fills on its own?

No. It runs in the visitor's browser, and sophisticated bots post data directly to your form endpoint, skipping browser-based checks entirely. Google lists reCAPTCHA alongside double opt-in and server-side validation precisely because the three cover different attacks. Server-side validation of email domains and phone formats is the one that addresses direct endpoint posting, and it is the one most often missing.

Which conversion should I optimise toward if qualified leads take three weeks to confirm?

Optimise toward the latest stage that still clears Google's stated thresholds — at least 15 conversions in 30 days, with the conversion landing inside seven days of the ad interaction — and use the slower, deeper stages for reporting and value assignment. Conversions uploaded more than seven days after the interaction are not attributed, so a three-week qualification cycle cannot be your bidding signal no matter how well it predicts revenue.

What changed on 15 June 2026 and do I need to do anything?

Google Analytics moved to Consent Mode as the single control for data flowing to linked Google Ads accounts. Previously both the Google Signals setting in Analytics and your Consent Mode Ads settings governed collection of Google Ads cookies and IDs; now the Consent Mode settings do it alone, and Google Signals only controls association with signed-in user information for behavioural reporting. If your consent banner sets ad_storage correctly, nothing changes. If it does not, there is no longer a second setting compensating, so test accept and decline in a clean browser.

Audit your own leads, or have someone do it with you

Lead quality is one of the few areas in paid media where an afternoon of counting beats a quarter of optimisation. Start with Step 1 this week. If the gap between what the platform reported and what your salespeople received is larger than you expected, the remaining eight steps are worth scheduling properly.

If you would rather work through it with someone, book an intro call and we will walk your account together, or request a free paid media audit and we will run these checks and send you the findings. North American Media Experts plans and buys paid search and programmatic campaigns for Canadian advertisers, with no minimum spend and no minimum contract — see what we do or read more about Ryan.