> How do advertisers know the requests are coming from real users and not bots?
Leaving aside that this isn't the problem of end users:
Link to a site, use an ID for that campaign (analogous to an affiliate ID), and don't pay unless a purchase takes place. Bots can't fake that.