Google today released the September 2026 spam update to its search rankings, the fourth enforcement cycle of the year and the first of the four to carry a rollout allowance of as long as 14 days. Each spam update that preceded it in 2026 was expected to take a few days, and each finished within about three.

In Short

Google today started a new round of its automatic clean-up of search results, aimed at websites that use tricks its anti-spam policies forbid, and it covers every country and language. If your site gets caught, it can slide down the results or drop out of them entirely, while sites that stay within the policies are not the target. What is different this time is the timetable: Google says the process could take up to 14 days to finish, much longer than the few days it gave for the three earlier rounds this year.

What Google published

According to the Google Search Status Dashboard, the incident, classified as an "Incident affecting Ranking", began at 09:15 US/Pacific time. The release note carries the same minute, 09:15 PDT, which is 16:15 UTC and 18:15 Central European Summer Time. It reads: "Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete."

Google Search Central posted the news to LinkedIn in parallel. "Today we released the September 2026 spam update to Google Search," the post begins. It goes on: "This is a normal spam update, and it will roll out for all languages and locations." The post repeats the dashboard's timing language, links to Google's documentation on spam updates, and ends with a commitment: "We'll update our ranking release history page when the rollout is complete." About an hour after it went up, it showed 492 reactions, 41 comments and 146 reposts.

That is the whole of the disclosure. Neither document names a category of spam, a share of affected queries, a market expected to move more than others, or a new policy. Neither describes what changed inside Google's detection systems.

Two smaller details distinguish the paperwork. The dashboard's incident start and release note now share a timestamp, where the gap was 18 minutes in March (12:00 and 12:18 PDT), three in June (09:00 and 09:03) and one in August (09:27 and 09:28). And the word "normal" has now been applied to all four spam cycles of 2026, a label that marks routine enforcement rather than a campaign against one tactic.

A spam cycle on a core-update clock

The change that matters sits in the last clause of the dashboard note. Every earlier spam update this year came with guidance that it might take a few days, and every one of them finished well inside a week.

The March cycle went live on March 24 at 12:18 PDT and completed in about 19.5 hours, the fastest spam rollout on record. The June cycle began on June 24 at 09:03 PDT and was declared complete roughly 48 hours later, on June 26. The August cycle started on August 18 at 09:28 PDT, and SISTRIX's monthly newsletter dated its end to August 21, about three days in.

Spam updateReleased (PDT)Stated rolloutCompleted
March 2026March 24, 12:18A few daysAbout 19.5 hours later
June 2026June 24, 09:03A few daysJune 26, about 48 hours later
August 2026August 18, 09:28A few daysAugust 21, per SISTRIX
September 2026Today, 09:15Up to 14 daysNot yet complete

Today's allowance mirrors the wording Google has used this year for broad core updates rather than for spam. The March 2026 core update, released on March 27 at 02:14 PDT, carried identical guidance and finished on April 8 after 12 days. The May 2026 core update followed on May 21 at 08:43 PDT with the same language and was finished by June 2, in under 12 days.

Why a fortnight now? Neither document gives a reason. John Mueller said on March 31 that core updates run for weeks because several ranking components are updated step by step rather than all at once; nothing published today says whether comparable staging applies to the spam systems. Used in full, the allowance would take the rollout to about October 8.

Duration has, in any case, been a weak guide to impact. The last spam update given an extended estimate, the August 2025 cycle, was expected to take a few weeks and ran for 27 days, from August 26 to September 22, 2025. SISTRIX measured ranking changes during that stretch below typical daily fluctuation, and could not compile a meaningful list of losing domains because most of those it examined had been hacked or were in the middle of migrations.

Four cycles, shrinking gaps

Each interval has been shorter than the last. Ninety-two days separated the March and June spam updates. Fifty-five separated June and August. Today's release lands 37 days after the August cycle began and 34 days after SISTRIX recorded it as finished.

The volume stands out against 2025. SEO consultant Gagan Ghotra's five-year analysis, published on December 29, 2025, found that confirmed Google updates had fallen from 10 in both 2021 and 2022 to four in 2025. Three of those four were core updates, which left the August 2025 cycle as the year's only spam update. So far in 2026, Google has confirmed seven ranking updates: a standalone Discover core update that ran from February 5 to February 27, core updates in March and May, and four spam updates.

DemandSphere's tracker, published in April, catalogued 173 confirmed Google updates from 2000 to 2026: 52 core updates averaging 17 days and 26 spam updates, some of which completed in under 24 hours. That count already included the March 2026 spam update. By the same method, today's release would be the 29th spam update on record.

What a spam update does, by Google's account

The LinkedIn post points readers to Google's documentation on spam updates, last revised on December 10, 2025. According to that documentation, Google's automated spam detection runs all the time, and the label spam update is kept for notable improvements to how those systems work. The system it names is SpamBrain, which Google describes as its AI-based spam-prevention system and says it refines from time to time so that it can catch new kinds of spam. Google first deployed SpamBrain publicly against link spam in December 2022. Beyond that, the public specification is thin: no architecture, no signal weights, no target list.

Consequences are spelled out more clearly than mechanics. According to Google's documentation, sites that violate its spam policies can be demoted or can disappear from results altogether. Recovery is measured in months, conditional on automated systems learning over time that a site now complies. Link spam carries a harsher rule. Once Google's systems neutralise manipulative links, whatever ranking benefit they produced is gone for good, so recovery restores a site to what it would have earned without those links rather than to its earlier position.

Nothing released today identifies this as a link spam update, and Google has in the past put the word link into the name when that is the scope. The mechanism also works in one direction only. It acts on sites in violation; gains recorded by other sites are a by-product of competitors falling rather than a reward.

The rulebook in force

No new policy came with today's release, so the update applies rules already published. That rulebook has grown considerably in two years.

In March 2024, Google named expired domain abuse, scaled content abuse and site reputation abuse as spam categories. The last of those, aimed at third-party pages placed on an established domain to borrow its ranking signals, gained a dedicated section in Google's web search spam policies on September 25, 2024. The same documentation refresh recast the older rule on doorway pages as doorway abuse, in line with the newer vocabulary.

Four further changes followed in 2026. On April 13, Google classified back button hijacking as an explicit violation under malicious practices, with enforcement from June 15. On April 24, it stopped processing spam reports that contain personally identifying information. On May 15, it confirmed that its spam policies govern generative responses in Search, covering AI Overviews and AI Mode, roughly two years after the feature reached users at scale. And on July 24, it added a guideline against fake and undisclosed incentivized reviews, enforceable through manual action.

Today's cycle is the third spam update since back button enforcement began and the third since the generative-search clarification. Older categories, including cloaking, link spam and inauthentic mentions, still run beneath the newer ones.

The first cycle since Europe split enforcement

Today's release is also the first confirmed ranking update since August 30, the date from which site reputation abuse manual actions stopped affecting searches made inside the EEA. Under the change, set out on the Google Search Central Blog on August 28, the affected section of a site may instead be separated within Google's systems so that it ranks independently of its host domain over time. Outside the EEA, a manual action still affects results for the part of the site concerned. Notifications in Search Console continue, reconsideration requests remain available, and eligible sites can now take disputes to mediation.

Google did not present the carve-out as its own preference. A company spokesperson said European users are no less troubled by parasite SEO and similar deceptive tactics, and framed the arrangement as agreed under a European Commission mandate. The Commission opened Digital Markets Act proceedings into the policy on November 13, 2025, and Pandu Nayak, Google's chief scientist for search, called the investigation misguided. On the morning of the carve-out post, John Mueller said Google's update notices exist for transparency, and that actionable changes are preceded by blog posts, policy updates and help documentation. Today's release points only to existing documentation.

The two mechanisms are separate. Manual actions are penalties applied after human review; spam updates are algorithmic, and nothing in the August 28 change alters what SpamBrain does. For any site with audiences both inside and outside the EEA, however, rankings read over the coming fortnight will blend a global algorithmic update with a manual enforcement layer that now depends on where the searcher sits. One URL can hold two positions at once. A second EEA-specific variable arrived this month, when free product listings and popular product carousels were removed from EEA results, with independent trackers recording near-total declines in five countries.

Watching the rollout now costs more

Most practitioners see the effects of a spam update first in third-party visibility trackers, long before Google confirms completion. Those trackers became more expensive to run in the weeks before today's release.

On August 26, Google confirmed it was routing search result links through google.com/goto addresses. Rank tracking firm Nozzle found that resolving every link in a single five-page ranking takes 500 to 1,000 requests, since the encoded links cannot be decoded locally and HEAD requests are refused; rate limits, not bandwidth, become the binding constraint. The same SISTRIX newsletter that dated the August spam update described resolving each disguised link individually, at the price of an extra server request per link. All of this came on top of the September 2025 removal of the num=100 parameter, which raised the requests needed to track the top 100 positions tenfold.

Google's own reporting fills only part of the gap. On August 31, the generative AI performance report reached every site, counting impressions in AI Overviews and AI Mode but showing neither clicks nor queries. An update that may run for 14 days will therefore be observed through instruments that cost more per reading than they did in March, and that see less of the surface where answers increasingly appear.

Documented gaps from earlier cycles

Earlier 2026 cycles left specific, documented cases in place. On July 13, fabricated earnings stories attributed to a domain registered to Ethiopia's federal notarization office were live on Google Finance for Criteo and Zeta Global, with the headlines redirecting to a WhatsApp invitation for a purported stock club; a same-day search suggested the template sat on at least 14 more tickers. Two days later, a fabricated IDACORP page from the same domain was observed 19 days after the June spam update had completed.

The most recent case surfaced two days before today's release. Public Gemini Notebook pages, the shareable output of Google's notebook tool, are indexable, and on September 22 Glenn Gabe reported that up to 12,000 such URLs were indexed and heavily spammed, across peptides, discount codes, pornography and app promotion. Gagan Ghotra had earlier flagged the pattern as a new parasite tactic. Neither of today's documents says whether this cycle reaches either case.

Why this matters for the marketing community

Duration is the immediate issue for performance teams. A cycle expected to last a few days leaves a short stretch in which organic movement cannot be cleanly attributed. One that may last 14 days stretches that period across the end of the third quarter on September 30 and into October. Quarter-end reporting built on organic sessions, affiliate revenue or content-driven lead volume will therefore capture a rollout in progress rather than a finished one, and remarketing audiences seeded from organic visits move with the same rankings.

Paid and organic enforcement connect at one specific point. Since December 2024, Google Ads has disapproved ads pointing to destinations removed from Search by manual action. That rule is tied to manual actions. A demotion delivered by a spam update is algorithmic, and on the documented terms of the Ads policy it does not by itself carry the advertising consequence, a distinction that tends to blur in the first days of commentary on any update.

Disclosure is the structural issue. Four spam updates have now shipped in 2026 without a published target. In its absence, the industry reconstructs impact from third-party data that has become costlier to gather and from a Search Console report that omits clicks on AI surfaces. That reconstruction took weeks to settle after previous cycles, and it will now run over a longer rollout.

Scope has shifted as well. Since May 15, the policies this update enforces extend explicitly to generative answers, so tactics aimed at AI Overviews and AI Mode, such as mass-produced pages or inauthentic mentions, sit inside the same rulebook as manipulation of conventional results. The enforcement map is no longer uniform either: for site reputation cases, Europe and the rest of the world now operate on different terms.

Until Google updates its ranking release history page, the confirmed facts about this cycle amount to two short documents published today, a timestamp of 09:15 Pacific and an outer limit of 14 days.

Timeline

Summary

Who: Google, through the Google Search Status Dashboard and Google Search Central's LinkedIn account, released the update. It affects website owners, publishers, affiliates and search marketing teams in every market where Google Search operates, and indirectly the performance teams whose reporting depends on organic traffic.

What: The September 2026 spam update, a routine enforcement cycle against violations of Google's existing search spam policies, run through the SpamBrain detection system. It is the fourth spam update of 2026 and the first this year to carry guidance that the rollout may take up to 14 days, where the March, June and August cycles were each expected to take a few days. No targets, new policies or affected-query figures were disclosed.

When: Today, September 24, 2026, with the incident opening and the release note both logged at 09:15 PDT (16:15 UTC). Used in full, the stated allowance would end around October 8, 2026. Google has said it will update its ranking release history page when the rollout completes.

Where: Globally, across all languages and locations in Google Search. The rollout is the first confirmed ranking update since August 30, when site reputation abuse manual actions stopped affecting results for users in the EEA.

Why: According to Google's documentation, spam updates mark notable improvements to automated systems that detect spam continuously, and sites found in violation can be demoted or removed from results, with recovery measured in months. Google gave no reason for the longer rollout guidance in either published document.