Four times this year Google has pushed a spam update into search, and each one has taken longer than the last. The September 2026 spam update went live at 09:15 Pacific on Wednesday, September 24, and the Search Status Dashboard entry carried an unusual warning: the rollout may take up to two weeks to complete. March's update finished in 19.5 hours. June's took 48. August's ran three days. This one could still be moving on October 8.

That stretched window matters more than it sounds, because a two-week rollout is a two-week period in which nobody can separate the update's effect from everything else happening in the results. And the industry's ability to measure any of it has narrowed sharply over the same year. The pattern repeated across four other announcements this week. Search Console gained a whole new category of search traffic and withheld the queries behind it. Google Ads gained two new ways to move budget and a warning that appears when budgets move down. Apple agreed with five competition authorities to redesign its tracking prompt, removing the word "track" from it. Meta appears to have dropped a cap that has governed how many ads a Page can run since February 2021, without saying so.

Each of those is a control or a report. None of them arrived with the number that would let anyone check the claim behind it.

Google gives its fourth spam update of 2026 a fourteen-day window

The announcement was terse. "Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete," the Search Status Dashboard read. Google Search Central's post added little: "Today we released the September 2026 spam update to Google Search. This is a normal spam update, and it will roll out for all languages and locations." There was no blog post, no new policy, no list of what the update targets, and no figure for the share of queries affected. Barry Schwartz reported the release on Search Engine Roundtable within minutes of the dashboard entry.

The escalating timeline is the most concrete detail available. The March 2026 update landed at 12:18 Pacific on March 24 and was done in 19.5 hours. The June 2026 update went out at 09:03 Pacific on June 24 and closed in two days. The August 2026 update began at 09:28 Pacific on August 18 and needed three days. September's opening estimate is roughly five times August's actual duration and seventeen times March's.

John Mueller has offered the standard explanation for long rollouts, telling practitioners on March 31 that core updates run for weeks because several ranking components are updated step by step rather than all at once. Applied to a spam update, that reading suggests the September release bundles more than one enforcement change. Google has not confirmed that, and the update is not described as targeting link spam.

What the update enforces is a set of policies already on the books: expired domain abuse, scaled content abuse, site reputation abuse, doorway abuse, back button hijacking, and fake or undisclosed incentivized reviews. Back button hijacking has been subject to enforcement since June 15. The mechanism is SpamBrain, Google's machine learning spam detection system, which acts algorithmically rather than through the manual actions that appear in Search Console.

The distinction between those two enforcement routes now has a geographic dimension. On August 30, Google stopped applying site reputation abuse manual actions to users in the European Economic Area, following pressure from Brussels over the policy's effect on publishers. Pandu Nayak, Google's chief scientist for search, has called the European Commission's inquiry into the policy misguided. The September update is the first confirmed ranking release since that carve-out took effect, which means a site running third-party content on a strong domain can now face different outcomes depending on where the searcher sits. Google's own expanded guidance on the policy does not address the split.

Volatility preceded the confirmation. Schwartz documented elevated movement starting around September 22 and running through September 24, following earlier unexplained swings on September 15 and across September 4 to 13. AccuRanker's Grump, CognitiveSEO, DataForSEO, Zutrix, Wincher, AWR, Serpstat, Mozcast, Semrush, Similarweb, Mangools, Algoroo and Sistrix all registered the movement. Site operators posting on WebmasterWorld described Discover traffic down 70 percent, overall drops between 48 and 80 percent, the loss of roughly a fifth of top-ranking terms, and ad revenue that had, in one operator's phrasing, literally been cut in half so far. Whether those reports reflect the spam update, the volatility that preceded it, or ordinary seasonal noise cannot be established from outside.

Establishing it from inside has become harder. The generative AI performance report that Google rolled out to every Search Console property on August 31 reports impressions but not clicks and not queries, so a site losing visibility inside AI surfaces during the rollout has no query-level record of where it happened. Third-party rank tracking has repriced too. Google's goto passthrough links and the removal of the num=100 parameter mean trackers now issue between 500 and 1,000 requests to build a five-page ranking for a single query, a figure supplied by Nozzle; Sistrix absorbed added cost to keep its SERP data intact. Confirmed Google updates have also become rarer, falling from about ten a year in 2021 and 2022 to four in 2025 on Gagan Ghotra's count, which makes each one a larger event with less surrounding data.

So the longest spam rollout of the year arrives at the moment when the tools for observing it cost the most and reveal the least.

Search Console starts counting camera searches, and hides what people searched for

Hours before the spam update, Google split the Performance report's Web category in two. Text-based searches now sit in one bucket and multimodal searches in another, a change Google posted at 8:40 Eastern on September 24 after screenshots had already circulated on X.

Four entry points feed the multimodal bucket: Google Lens, Circle to Search on Android, images uploaded directly into Google Search, and Chrome's right-click "Search this image" option. Harsh Kharbanda, product manager lead for Google Lens, and Moshe Samet, product manager lead for Search Console, announced the split. Barry Schwartz separately logged the new search type filter appearing in the Performance report interface.

The limitation is stated plainly in Google's documentation: specific text query data isn't available for this traffic. Mueller put the same point on Bluesky, noting that Search Console now reports on multimodal queries such as when someone takes a photo with Lens, and that while the photo itself remains hidden, a site owner can see which pages showed up and how often. Pages and impressions, in other words, but no intent.

There is a second wrinkle that will complicate year-on-year reporting. Google confirmed this multimodal traffic was never previously included in Search Console totals at all. The numbers are not being reclassified out of an existing figure; they are being added. Any site with meaningful camera-search visibility will show a step change in total impressions dated to late September 2026 that reflects a reporting change rather than a traffic change, and there is no backfill.

The commercial significance depends on how much of Google's query volume now arrives through a lens rather than a keyboard, and Google has not published that. What is on the record is a steady expansion of the surfaces. Circle to Search gained the ability to identify entire outfits at once on Pixel 10 devices. AI Mode was wired into Circle to Search earlier in the year. Search Live opened voice and camera queries into a conversational loop. Each of those surfaces routes traffic that, until this week, simply did not appear in the reporting that publishers and retailers use to plan content.

The pattern is consistent with the generative AI visibility reports Google shipped earlier: a new dimension of visibility arrives, and the dimension that would make it actionable stays behind the glass. A retailer can now learn that a product page was served to people pointing cameras at shelves. What they pointed at, and what they asked, remains Google's.

The Recommendations page gained a pair of new options this week. Google's Recommended Investment Strategy now offers a Holistic mode and a Growth mode, spotted by Hana Kobzová on PPC News Feed and reported by Schwartz on September 24.

The two modes differ in where the money comes from. Holistic reallocates existing budget out of underperforming or underutilized campaigns and into top performers, and adds incremental weekly spend on top. Growth leaves existing budgets alone and adds fresh funds only to campaigns flagged as constrained. Eligibility requires either a budget constraint actively limiting at least one performance campaign, or an identified opportunity for materially more conversions at a favourable cost per acquisition or return on ad spend. Forecasts in the interface rest on seven-day projections. Target CPA and target ROAS values are adjusted alongside the budget change so that bid targets match the new spend level, and campaigns excluded from the recommendation are left untouched.

Both modes therefore end in the same place, which is more total spend. Holistic funds part of that from cuts elsewhere; Growth does not fund it at all. Neither presents a variant in which the recommended action is to spend less, and that gap is sharpened by the second change spotted the same day.

Thomas Eccel described a new alert on LinkedIn on September 24, calling it an annoying new budget feature that threatens advertisers with conversion value decreases and limited-by-budget alerts when they reduce a campaign's daily budget. He noted that the system understands lowering budget will reduce conversion value, but that budgets sometimes have to come down regardless, and called the treatment quite intrusive, with an alert sign appearing in campaign settings and a projected weekly conversion value displayed alongside a prompt to spend more.

Read together, the two changes describe an interface in which upward budget movement is packaged as a strategy with named modes and downward movement is packaged as a warning. That framing sits on top of a planning surface that has been narrowing in other respects. Google removed Display and Video support from Performance Planner without an announcement. It introduced the investment planning tool for performance campaigns earlier in the year, restored fixed budgets for Search and Shopping after removing them, and in August changed how budget-capped campaigns behave, pushing them back toward target CPA. The same recommendation logic has been exposed through the Ads API so that it reaches accounts managed by third-party tools as well.

None of the forecasts carry a stated confidence interval, and the seven-day horizon is short enough that seasonal effects and the forecast itself are hard to distinguish. An advertiser who accepts a Growth recommendation and sees conversions rise has no counterfactual, and one who declines it gets an alert icon.

Apple rewrites its tracking prompt for five EU countries, and drops the word track

Apple confirmed on September 16 that Germany, France, Italy, Poland and Romania will get a redesigned App Tracking Transparency prompt beginning with iOS 27.2, which entered developer beta that same week. The new format is mandatory in those five markets and optional elsewhere in the European Union, which creates two different consent experiences inside a single regulatory bloc.

The redesign is substantive rather than cosmetic. The standard alert is replaced by a full-page sheet that supports Markdown formatting. The buttons change from "Allow" and "Ask App Not to Track" to "Allow" and "Reject". An optional "Additional Information" button lets developers surface a longer explanation. The word "track" disappears from the interface vocabulary; the Settings toggle is renamed to "Allow Apps to Request to Link Your Activity Across Companies". Developers reach the new sheet through a new API method, requestTrackingAuthorization(usingExpandedInterface:additionalInformationAction:completionHandler:), and supply their Markdown copy through an NSUserTrackingMarkdownUsageDescription key.

One behavioural change carries more weight than the wording. Apps may ask again one year after any previous response, whether the user allowed or refused, unless the user disables re-asking in Settings. Under the framework as originally shipped in iOS 14.5, a refusal was effectively terminal for that app. An annual reset turns a single decision into a recurring one, and the direction of travel for aggregate opt-in rates under repeated asking is not established by anything Apple has published.

Current rates give the baseline. Adjust put ATT opt-in at 38 percent on average in the first quarter of 2026, up from 35 percent across the prior year. Gaming ran at 39 percent. Publications climbed from 18 to 26 percent. E-commerce slipped from 35 to 34 percent. A four-year academic study found ATT shifted 0.07 percent of apps into paid downloads, a reminder that the framework's measurable effects have often been smaller than the rhetoric around it.

The regulatory trail behind the redesign is specific. Germany's Bundeskartellamt accepted commitments from Apple on August 13, 2026 in case B7-54/25, after finding that the company's app tracking rules may breach competition law, and set a four-month implementation deadline that cannot fall earlier than December 13, 2026. France's Autorité de la concurrence fined Apple 150 million euros on March 30, 2025, in a decision whose reasoning PPC Land examined at length. Italy's competition authority imposed a fine of 98,635,416.67 euros on December 22, 2025, over the double consent request that ATT forced on developers. Proceedings in Poland and Romania remain open. Apple's own framing is that the changes come as part of agreements with select European competition authorities.

The common thread in the three concluded cases was asymmetry: Apple asked users about third-party tracking in stark terms while holding its own data collection to a gentler standard. The remedy that emerged softens the language for everyone, including Apple, and adds an annual re-ask. Whether measurement improves as a result depends on a number nobody has yet: how often users say yes the second time. The SKAdNetwork attribution path that absorbed the original rejection rates stays in place regardless. No public release date for iOS 27.2 has been given.

Meta's 250-ad Page cap appears to be going, with no announcement

A limit that has shaped Meta account structure for more than five years may be quietly lifting. Bram Van der Hallen, a digital marketer at Edge.be, posted evidence on LinkedIn around September 22 that an account spending under 100,000 dollars a month was running 286 active ads against a documented ceiling of 250. The interface displayed "36 ads over limit." The new ads kept delivering. A new message had appeared in the account stating that there is no longer a cap on ads per Page.

Meta introduced the tiered limits in February 2021 with four brackets tied to monthly spend: 250 ads for Pages under 100,000 dollars, 1,000 under a million, 5,000 under ten million, and 20,000 above that. The rationale offered at the time was mechanical. Facebook's own 2020 analysis found that four in ten running ads never exited the learning phase, because conversion volume was spread too thinly across too many ads for the delivery system to optimise any of them. Capping ad counts was presented as protecting advertisers from themselves.

What has changed since is the volume of creative entering the system. Meta removed its six-creatives-per-ad-set recommendation in July 2025. By November 2025 more than 15 million ads were being created in a single month using its generative tools. Advantage+ campaigns, which decide placement and creative combinations automatically, passed 75 billion dollars in annualised revenue by 2026. A ceiling designed for an era of hand-built ads sits awkwardly against a system that generates variants at that rate, and an automated delivery layer arguably solves the learning phase problem the cap was built to address.

The gaps in the picture are large. Meta has made no announcement. Whether the change reaches all four spend tiers is unknown, as is whether the Marketing API enforces the old limits, and whether this is a full rollout or a test visible in some accounts. Nothing has been published about how delivery behaves when thousands of ads compete for the same conversions. For agencies whose naming conventions, reporting structures and cleanup routines were built around the tiers, a silent removal is a structural change discovered by accident rather than by notice, arriving in the same season as Meta's confirmed requirement to disclose spend detail to advertisers from February 2027.

Five platform changes in three days, then, and a consistent shape to them. An enforcement action with no stated magnitude. A report with no queries. A forecast with no downside case and no confidence interval. A consent prompt with the operative verb removed. A limit that vanished without a sentence attached. The instruments multiply; the readings do not.

Also noted

  • September 24: Digital audio ad revenue reached 8.4 billion dollars in 2025 on 10.2 percent growth, and agency programmatic adoption climbed from 41 percent in 2022 to 82 percent in 2026, prompting warnings from Podscribe that a listener in an impression-based buy can hear more than 15 ads across one campaign (AdExchanger).
  • September 25: Brand-side marketers at the inaugural AI Marketing Strategies event on September 24 described a growing acceptance of "good enough - go," with one premium beauty marketer saying quality control is so bad that establishing brand standards inside AI ad platforms is a shared problem, and another reporting agency creative arriving with the logo wrong (Digiday).
  • September 23: Vistar Media research among 7,200 consumers aged 18 to 59, fielded in the Netherlands between February and April 2026, found a store locator placed mid-creative in a digital out-of-home ad cut visit intent by 10 percent while the same element at the bottom raised it by 9 percent, though the study measured stated intent under forced exposure rather than matched visits (PPC Land).
  • September 24: IAB Europe research among 50 advertising executives across 44 markets found 58 percent expect agentic ad buying to reach operational use or scale within a year, while 36 of the 47 respondents already using AI internally report either no autonomous systems or mandatory human oversight (Digiday).
  • September 24: Google updated its video structured data documentation to support the creator and author properties in VideoObject and to clarify which interaction types interactionStatistic accepts (Search Engine Roundtable).