Myth: Deduplicate clicks by IP and you're clean

Myth: Deduplicate clicks by IP and you're clean

The advice: drop repeat clicks from the same IP to kill duplicates.

The correction: IP alone fails both ways. Carrier-grade NAT puts thousands of real users behind one IP (you reject good clicks); rotating proxies give one bot many IPs (you let bots through).

Framework — layered dedup key:

— Step 1: Build a composite key: IP + User-Agent + accept-language.
— Step 2: Add a short time window (e.g. 30 min) — same key inside the window = duplicate.
— Step 3: For logged-in or click-ID traffic, dedup on the stable ID, ignore IP.
— Step 4: Whitelist known CGNAT ranges from IP-only blocking.

Checklist:
☐ Dedup uses a composite key, not raw IP
☐ Time window defined and documented
☐ CGNAT ranges whitelisted

Review false-positive rate weekly.