AI Bots Wrote Three in Four Replies to UK Vape Consultation

According to a study published in Tobacco Control on 27 October 2026, bots generated most of the replies to the UK government's 2023 consultation on a proposed smoke-free generation and restrictions on disposable vapes. The authors, Dr Nason Maani of the University of Edinburgh and Professor Anna Gilmore of the University of Bath, worked from published consultation reports and Freedom of Information requests to the Department of Health and Social Care. The department's own bot-detection screening had already flagged 90,835 of the 118,756 responses as fraudulent. Every flagged reply but two answered one multiple-choice question, and that answer opposed restrictions on disposable vape sales.

The department removed the flagged responses before it assessed public opinion. Reporting on the study says the department's screening looked for duplicated wording, high submission speeds and a small cluster of internet addresses. The study's authors could not establish who ran the campaign or what it was meant to achieve. They also noted that they could not check the detection method itself, because the department has not published it and the metadata on respondents is exempt under Freedom of Information rules.

Why this matters for businesses that automate work

The story is about a public consultation, but the mechanics apply to any business that collects written input at volume. A customer feedback form, a supplier questionnaire or a claims portal can be flooded in the same way, and the flood can look like a real trend until someone checks where it came from. The authors of the study said that the scale and consistency of the replies pointed to coordination. Their concern was not only the bots but the fact that a narrow position appeared to have broad support.

The numbers also show how easily totals can mislead. Once the flagged replies were removed, the study reports that about 77% of valid respondents supported restrictions on disposable vape sales, which reverses the picture in the raw data. Other reports of the same study give the figure as 79.6%. Neither figure should be used without the original consultation document, and a business that cites it should name the source and the year.

What changes in practice for a business that automates

Automation makes this kind of flood cheaper to create and, for the receiving side, harder to read. A business that runs its own automated intake should treat the following as basic controls rather than extras:

• Count submissions per address, per device and per minute, and hold any spike for a person to review.
• Look for near-identical text across many entries, which the department cited as a sign of automation.
• Keep the raw submissions, the time stamps and the rules used to flag or exclude them, so a decision can be explained later.
• Do not let an automated tool publish or act on a total without a named person signing off the exclusions.

An automated system can apply these checks at a speed no staff team can match, but it will also flag genuine customers. Someone still has to decide what to exclude. Detection tools are also not a guarantee. The study's authors warned that future campaigns may become harder to catch, and the department's own method is not public, so a business cannot copy it directly.

What to watch next

Three things are worth following. The first is whether the Department of Health and Social Care publishes more detail on its bot-detection method. The second is whether other government bodies review how they accept online responses. The third is the research itself: the authors describe the case as what appears to be a first, which is a qualified claim and not proof that no earlier episode occurred. For now, the practical message for operations leaders is narrow. If your business accepts large volumes of written input, check whether your intake can tell a real response from an automated one before the totals reach a decision.