Bots Filed 76% of a UK Vape Consultation. The Rulebook Never Mentions Them

Three in four responses to the UK government’s 2023 consultation on a smoke-free generation and youth vaping came from bots, according to a study in Tobacco Control, the BMJ journal, published on 28 October. The Department of Health and Social Care (DHSC) received 118,756 responses and discarded 90,835 of them as automated. BMJ’s summary of the study says every one of the flagged responses went after a single multiple-choice question, opposing restrictions on the sale of disposable vapes. Once they were removed, the public backed restrictions. The researchers want stronger detection. The government’s own rulebook for consultations, last revised in 2018, does not mention bots.

The headline number is not new, and that is the part worth sitting with. DHSC published it itself, in the government response it put out on 29 January 2024: “In total, we received 118,756 responses to the consultation.” Of these, it said, 90,835 were “unambiguously identified as having been submitted by automated programmes, commonly known as bots”. It analysed the remaining 27,921, from 896 organisations and 27,025 individuals. The consultation had run for eight weeks, from 12 October to 6 December 2023, and its smoke-free generation proposal went on to become the Tobacco and Vapes Act 2026.

What the new study adds is scrutiny. The researchers combined DHSC’s published reports with Freedom of Information responses from the department. They could not check how DHSC spotted the bots, because, in the BMJ summary’s words, “this information isn’t publicly available”; respondent metadata was withheld under FOI exemptions. They read the scale and uniformity as a sign of a coordinated campaign, point to past tobacco industry efforts to manipulate consultations, and say they cannot tell who was behind it. The work was funded by UK Research and Innovation (UKRI).

What DHSC said about catching the bots in 2024

DHSC did describe its tells, briefly. The 2024 response says it flagged submissions “where the data submitted was incompatible with the survey flow”, and that responses “were often duplicated many times and sent at high frequency from a small number of IP addresses”, a pattern it called “consistent with a mass automated campaign”.

Among the responses it kept, the question the bots targeted (“Do you agree or disagree that there should be restrictions on the sale and supply of disposable vapes?”) was not close: 79.6% agreed and 18% disagreed. The BMJ summary puts support among valid respondents at 77%. We could not reach the full paper to reconcile the two figures, which may rest on different bases. Either way, the arithmetic of the raw count is stark. If all 90,835 bot responses opposed restrictions, as the study says they did, opposition would have made up at least 76% of everything submitted.

Our read: those bots did not need generative AI at all. The BMJ release calls them “AI bot-generated”, but DHSC’s own language is “automated programmes”, and ticking one box 90,835 times is a job for a script. That matters because every tell DHSC listed (duplicates, a handful of IP addresses, impossible paths through the form) is exactly what a 2026 AI agent avoids. An agent can fill in a form in order, at human speed, and write a fresh paragraph each time. Even the signs of machine writing that volunteers catalogue are hints, not proof.

The UK consultation rulebook has no bot clause

The Cabinet Office’s Consultation Principles run to 11 headings. The nearest one to this problem is principle 9, “Consultation should facilitate scrutiny”, which tells departments to “State how many responses have been received.” Nothing in the guidance covers fraudulent, automated or duplicate responses, or how to verify who is responding. When Lord Kempsell asked in 2024 what rules govern consultation design, Baroness Neville-Rolfe answered that the principles “were last updated in 2018” and that departments “design consultations on a case-by-case basis”.

So each department builds its own defences, and none has to publish them. That leaves open surveys exposed right now. The Information Commissioner’s Office, running one of several open AI policy exercises, is taking evidence on agentic AI through an online survey until the end of 20 November, as we explained in our guide to responding. Westminster’s one bot bill, from Damian Hinds, would make AI crawlers identify themselves to websites; it says nothing about consultations.

America ran this experiment at 22 million comments

The closest precedent is American. In a report released on 6 May 2021, New York Attorney General Letitia James found that “nearly 18 million of the more than 22 million comments” sent to the US Federal Communications Commission during its 2017 net neutrality repeal were fake. Both sides were faked. Her office said most of 9.3 million fake comments supporting net neutrality came from one “19-year old college student using automated software”. The rest, it found, came from a campaign the broadband industry funded.

The DHSC flood came six years later and was still crude enough to catch.

What it means if you answer a consultation

If you or your organisation respond to a UK consultation, a few habits help a department tell you from a bot. Answer the free-text questions in your own words; a lone tick-box answer looks like every automated one. Respond as a named organisation where you can, since DHSC reported its 896 organisational responses separately. And when a government response lands, look for the count of excluded responses, which the 2018 principles do not require departments to publish. DHSC published one. More departments should, along with how they reached it.

Principle 9 asks departments to “State how many responses have been received.” In January 2024, DHSC did exactly that. The number was 118,756, and 90,835 of them were nobody.