At the end of a campaign, your DSP hands you a conversion number. It might say 4,200 site visits. Or 312 form submissions. Your agency presents it as a result, you accept it as a result, and everyone moves on.

But what if a meaningful percentage of those conversions were never real? Not fraud in the traditional sense — no bots, no click farms, no spoofed domains. Just a structural flaw in how IP-based attribution works that almost no programmatic buyer thinks to check for.

We found it in our own data. This is what we discovered.

How attribution actually works

When someone sees your ad and later visits your website, your measurement system tries to connect those two events. The ideal method is a cookie — a persistent identifier that says, definitively, "this is the same browser that saw the ad." Cookie matching is deterministic: one user ID in, one user ID out.

But cookies fail constantly. Safari blocks them by default. Connected TV devices don't carry them at all. Mobile apps don't share them across applications. In these environments — which now represent a majority of programmatic impressions — measurement systems fall back to the next available signal: the IP address.

The assumption behind IP-based attribution is simple: if the same IP address that received an ad impression also generated a conversion event within a certain time window, they're probably the same household. The advertiser gets the credit, the conversion counts.

That assumption works well for residential broadband. One IP address, one household, one router. A Spectrum customer in San Antonio has an IP that belongs to her household and her household alone.

T-Mobile customers are different.

What CGNAT is, and why it breaks everything

CGNAT stands for Carrier-Grade Network Address Translation. It's a technique that telecommunications carriers use to share a small pool of public IP addresses across a very large number of subscribers. Rather than assigning each customer a dedicated public IP, the carrier routes all their traffic through a shared gateway — and hundreds of customers may exit to the internet from the same IP address simultaneously.

The result is that any conversion from any T-Mobile subscriber in that gateway's coverage area gets credited to any ad impression served to any other T-Mobile subscriber in the same area — as long as the IPs match. Which they always will, because they share one.

What we found in our own data

We identified this pattern while auditing our conversion data for a CTV campaign. A set of IP addresses was generating an unusually high volume of attributed conversions. When we dug into the data, the signature was unmistakable.

Here is a sample of what we found when we queried the top T-Mobile IPs by unique user count:

A real household shows 1 to 3 unique users. These IPs show 160 to 200. The geographic spread tells the same story — a single IP appearing across 6 to 18 different ZIP codes is physically impossible for one router. This is a shared carrier gateway, not a home.

We then confirmed the pattern at scale. Filtering to only T-Mobile-labeled traffic and looking for IPs with 5 or fewer users — the best possible case for individual household attribution — we found that even these "clean" IPs failed the test:

After examining hundreds of T-Mobile IPs across three separate IP ranges — 172.56.x, 172.58.x, and 172.59.x — we found no instances of reliable household-level attribution. The ranges are uniformly shared infrastructure.

Why this matters for your conversion numbers

T-Mobile is not a fringe carrier. As of 2024 it is the second-largest wireless carrier in the United States, with over 100 million subscribers. T-Mobile Home Internet — its fixed broadband product, which routes traffic through the same CGNAT infrastructure as its mobile network — has grown rapidly as a cable alternative, particularly in suburban and rural markets.

In a typical programmatic CTV or display campaign, T-Mobile-routed impressions can represent 6 to 10 percent of total delivery. That is a meaningful share of traffic generating conversion credits that cannot be reliably tied to any specific household.

Without explicit filtering, this is what happens in standard IP-based attribution:

1. An ad is served to subscriber A, a T-Mobile customer.
2. Subscriber B, sharing the same gateway IP, visits your website independently.
3. The attribution system sees the same IP address on both events, within the lookback window.
4. A conversion is credited. No one checks whether subscriber B ever saw the ad.

This is not a T-Mobile-specific problem. Any carrier deploying CGNAT — which includes many smaller regional ISPs and mobile providers — creates the same condition. T-Mobile's scale simply makes it the most visible example.

What most programmatic buyers are missing

The programmatic industry has gotten sophisticated about obvious fraud — bot traffic, datacenter IPs, click farms. These are well-understood threats with established defenses. CGNAT attribution inflation is different. It does not look like fraud. The impressions are real. The conversions are real. The IPs are legitimate. The problem is purely structural: the attribution assumption breaks down when one IP represents hundreds of households rather than one.

Most DSPs and measurement vendors do not filter for CGNAT ranges because doing so reduces reported conversions — and the incentive structure of the industry does not reward lower numbers. A vendor whose platform attributes 20 percent more conversions than a competitor's will appear to perform better, even if the difference is entirely an artifact of this filtering gap.

Buyers rarely ask whether their attributed conversions have been cleaned for CGNAT. The methodology is not disclosed in standard campaign reporting. The inflated numbers become the baseline, expectations are set accordingly, and the underlying problem goes unexamined.

How we handle it

Our attribution pipeline explicitly identifies T-Mobile CGNAT ranges and marks them as ineligible for IP-based attribution. This means impressions in these ranges still count — T-Mobile subscribers are real people who see real ads — but they cannot receive individual conversion credit through IP matching. Only cookie-based attribution, which ties directly to an individual browser or device identity, can credit these households.

The result is that our reported conversion numbers may be lower than what a standard DSP would show for the same campaign. That is not underperformance. It is the number after removing events that could not be reliably attributed to an individual household's exposure to an ad.

A smaller number you can trust is worth more than a larger one you cannot explain.

The incrementality implication

There is an important nuance worth stating clearly: removing T-Mobile IPs from attribution does not mean T-Mobile subscribers don't convert. It means we cannot tell, at the individual household level, whether a specific conversion came from someone who saw your ad or someone who simply happened to share a gateway.

This is precisely why incrementality measurement — comparing conversion rates between exposed and unexposed groups at the population level — is a more reliable measurement framework for campaigns with significant CTV delivery. Incrementality does not depend on individual-level attribution at all. A T-Mobile subscriber who converts shows up in the treatment group's aggregate rate whether we can individually credit them or not. The lift is real even when the household-level attribution is not.

The campaigns where we have measured 4x to 10x conversion lift were not measuring individual-attributed conversions. They were measuring the difference in behavior between people who saw the ads and people who did not. That methodology is immune to CGNAT inflation because it never tries to connect individual impressions to individual conversions in the first place.

What you should ask your media partners

The next time a campaign report lands with a conversion number, these are the questions worth asking:

If your current partner cannot answer these questions — or is not asking them — your conversion data may be meaningfully inflated in ways that neither of you has visibility into.

The honest answer to "how do we know this ad worked?" is not a raw conversion count. It is a methodology that holds up when someone looks closely at how the number was built. That standard is worth demanding.