Open standard

The Website
Visitor Taxonomy

An open standard for classifying every visit to your website. Twelve categories: ten kinds of human acquisition, plus the personal AI agents and crawlers that most analytics tools can't see.

Version 1.0, November 2026. Maintained by iCustomer. Free to use under CC BY 4.0.

1 2 5 6 7 8 9 10 11 12

3 4

10 human categories 2 machine

Why Categories Classify Machines FAQ Cite Sources

Why a visitor taxonomy

Most of the traffic hitting a website is no longer human, yet analytics tools still sort every visit into channels built for people. This taxonomy gives marketers one shared way to classify every visit: people, AI agents and bots.

Brands now pay to be cited in ChatGPT, Gemini and Perplexity answers. Getting cited is half the job. The other half is knowing who shows up after, and standard analytics can't see most of them.

Bots are the majority. Automated traffic reached 53% of all web traffic in 2025, up from 51% the year before (Imperva/Thales, Bad Bot Report 2026).
The newest agents don't announce themselves. Meta's Muse and Instinct don't identify themselves by name when they browse (Profound). Meta says Muse's browsing appears as the user's own activity.
AI influence leaks into "direct." Organic search's share of sessions fell 2.1 points from March to June 2026 in a fixed cohort of sites, which Wisepops reads as AI re-routing organic clicks into direct visits (Wisepops).
The AI visitors who do click are valuable. AI-referred visits to US retail sites converted 90% better than other traffic in September 2026 (Adobe).

The 12 categories

Each category has a permanent link. Machine categories are reported separately, per 1,000 human sessions, and never added to human session totals.

Human acquisition

Visits made by a person, grouped by how they arrived.

1
Organic search
Unpaid clicks from a search engine results page.
Google, Bing, Yahoo, DuckDuckGo, Brave
2
AI search and answer referrals
A person clicks a link inside an AI assistant's answer.
ChatGPT, Perplexity, Gemini, Claude, Copilot
5
Paid search and shopping
Clicks on paid search or shopping ads.
Google Ads, Microsoft Ads, Shopping, Performance Max
6
Paid social
Clicks on paid social ads.
Meta, LinkedIn, TikTok, Pinterest, Reddit
7
Organic social and communities
Unpaid links from social platforms and communities.
LinkedIn, Facebook, Instagram, Reddit, YouTube, TikTok
8
Email and newsletters
Clicks from email a brand or newsletter sent.
Lifecycle email, beehiiv, Substack, Mailchimp, Klaviyo
9
Referral, affiliate and partners
Links from other websites.
Publishers, review sites, partner sites, affiliate links
10
Display, video and other paid media
Clicks on non-search, non-social paid placements.
Programmatic display, YouTube ads, native ads, sponsorships
11
Direct and dark traffic
Visits with no referrer and no tags.
Bookmarks, typed URLs, messaging apps, untagged links
12
Unknown and unclassified
Visits where attribution was lost or blocked.
Blocked tracking, stripped parameters, unresolved sources

Machines

Not comparable with GA4 sessions or Shopify visitors. Report per 1,000 human sessions.

3
Personal AI agents
Software acting for one person: browsing, comparing or buying on their behalf.
Meta Muse, Instinct, Claude-based and other delegated agents
4
AI crawlers and discovery bots
Automated programs that fetch pages to index, train or retrieve, with no person in the session.
Search indexers, AI training crawlers, retrieval and fetch bots

How to classify a visit

Apply one rule order to every session. The first rule that matches wins.

Crawlers and bots out (4). Verified bot signatures, known crawler user agents and fetches that never run JavaScript.
Flag personal agents (3). Automated-browser patterns and session behavior. Agents can browse as the user, so treat this count as a floor.
Paid (5, 6, 10). Ad click IDs such as gclid, msclkid, fbclid, ttclid and li_fat_id, or a paid utm_medium.
Email (8). utm_medium=email, with the sender kept in utm_source.
AI referrals (2). Referrer domains such as chatgpt.com, perplexity.ai, gemini.google.com, claude.ai and copilot.microsoft.com.
Organic search, social and referral (1, 7, 9) by referring domain.
Direct (11) when there's no referrer and no tags. Unknown (12) when attribution was lost, for example blocked tracking or stripped parameters.

Most misclassification happens at the last step. The fastest way to shrink it is to tag every link you send.

What it takes to count machines

Categories 3 and 4 are the hard ones. A browser tag only sees visitors that run your JavaScript, so it counts the crawlers and agents that execute the page and misses the rest. Server logs or server-side collection see every request, including crawlers that never run a script.

What a browser tag and server-side collection can each see, by visitor type
Visitor type	Browser tag	Server logs or server-side collection
People in a normal browser	Sees them	Sees them
People with ad or tracker blockers	Often misses them	Sees the request
Crawlers that don't run JavaScript	Never sees them	Sees them
Agents in a cloud browser	May look human	Request signals help separate them
Agents in the user's own browser	May look human	May also look human; behavior signals needed

People in a normal browser
Browser tag
Sees them
Server logs or server-side collection
Sees them
People with ad or tracker blockers
Browser tag
Often misses them
Server logs or server-side collection
Sees the request
Crawlers that don't run JavaScript
Browser tag
Never sees them
Server logs or server-side collection
Sees them
Agents in a cloud browser
Browser tag
May look human
Server logs or server-side collection
Request signals help separate them
Agents in the user's own browser
Browser tag
May look human
Server logs or server-side collection
May also look human; behavior signals needed

No method catches every agent today. An agent working inside a person's own browser can look human in any data source. That's why agent counts under this taxonomy are reported as a floor, with the method stated. iCustomer's own benchmark figures currently come from the Signal tag, so our crawler and agent counts cover only visitors that run it.

FAQ

An AI search referral is a person clicking a link in an AI answer. A personal agent is software visiting your site on that person's behalf, sometimes without them ever seeing your page.

They don't behave like people and can't be compared with GA4 sessions or Shopify visitors. Mixing them in inflates traffic and deflates conversion rates.

Yes. It's free to use under CC BY 4.0 and tool-agnostic. GA4 custom channel groups can approximate categories 1, 2 and 5 to 12. Categories 3 and 4 need server-side data.

They measure whether your brand is mentioned in AI answers. This taxonomy measures who arrives after a mention, human or not. You need both.

Yes. It's versioned. v1.1 will incorporate public feedback, and every change is logged below. Send suggestions to taxonomy@icustomer.ai.