Google spam update:what can your numbersreally tell you?

Google started a spam update on 24 September 2026. It applies globally and to all languages, and by Google's own account the rollout may take up to two weeks. For your website that means one thing first of all: numbers from these days are not a basis for decisions. Google itself advises waiting at least a full week after a rollout completes, then comparing the week after with the week before. Rewriting pages now because visibility is moving may well mean repairing something that was never broken. Other work is worth doing in the meantime: check the manual actions report, look at your figures over a long period, and hold machine-written page copy against the spam policies.

Nikolai Schöbel and Jeremias Burger

Co-founders of Scalableloops GmbH. Nikolai Schöbel leads online marketing and AI strategy, Jeremias Burger the AI architecture. Both build AI systems and train teams on them in their own agency work.

How does a spam update differ from a core update?

The distinction matters because it decides whether you can be affected at all. A core update, in Google's own words, is broad in nature and does not target specific sites. It changes how Google's systems assess content in general, and it can therefore move pages where nobody did anything wrong.

A spam update works differently. It targets practices Google names explicitly in its spam policies, such as mass produced pages without value, hacked content or bought links. If none of these practices exist on your website, a direct hit is unlikely. Movement in your numbers can still appear, namely when the field around you shifts and other pages rise or fall in the results.

That second effect is regularly overlooked. It explains why a website can gain positions without anyone having worked on it. Anyone measuring visibility should therefore separate their own performance from movement in the surrounding field. More on how visibility can be measured at all is in our article on measuring AI visibility.

What can you safely ignore right now?

First of all, small shifts in position. Google writes that minor fluctuations can happen at any time, and explicitly advises against making radical changes to a page that is already performing well. Moving from position two to position four is not a finding, it is normal operation.

The most recent days in the performance report carry little weight either. Google notes that the newest data can be preliminary, because it is still being collected and may change within the next few hours. Reading yesterday's figure in the morning and deriving a trend from it means measuring an incomplete set in part.

The third candidate is visibility indices from third party tools when read without a reference point. Such values rise and fall even when only the composition of the measured keyword set shifts. They are a hint that something is moving, not evidence that your website has got worse. Finally, reports of dramatic drops in trade forums say nothing about your domain. Google has named neither targets nor an affected share of queries for this update.

Which spam policies actually affect business websites?

Most of the policies Google lists describe practices that do not occur on an ordinary company site, such as sneaky redirects or malware. Three points are nonetheless relevant for business websites, and usually without any bad intent behind them.

The first is scaled content abuse. Google describes it as generating many pages whose primary purpose is manipulating rankings and which offer readers little or nothing. The examples name the use of generative AI tools to produce many pages without adding value for users. In practice this covers templated location pages, automatically generated combinations of service and town, or imported manufacturer copy across hundreds of product pages.

The second point concerns third party content on your own domain. Google's site reputation policy only applies where such content is published mainly because the host site already ranks well. Google names counter examples explicitly: wire services and press release sites, syndicated news, forums and comment sections, and columns and opinion pieces. A guest article on your own blog is therefore not a problem in itself. For searchers in the European Economic Area, Google also changed enforcement at the end of August 2026: a manual action under this policy does not take effect there, and the affected section may instead be separated in Google's systems so that it ranks independently from the rest of the site over time.

The third point is user generated spam. Google notes that site owners are often unaware of it. This means flooded comment sections, forums and open upload areas. Anyone running a blog with open comments and rarely looking at them has the most likely finding here.

1. 01

   Scaled content abuse

   Often unintentional

   Mass produced pages with no value of their own, such as templated location pages or imported manufacturer copy.

2. 02

   Site reputation abuse

   Rare and often misread

   Applies only where third party content sits there mainly for the host's ranking signals. Guest posts and comments are excluded.

3. 03

   User generated spam

   Most likely finding

   Flooded comments, forums and upload areas. Owners rarely notice it on their own.

How long does recovery take, and where does the picture end?

Google gives no fixed timeline. Its documentation says improvements to a site can take effect within a few days but may equally take several months, or land with a later update. Anyone tidying up after a drop should therefore not expect to see the result in the following week. Where a manual action was issued and you have fixed the cause, Google states that a reconsideration review takes several days or weeks, and longer for link related requests.

The bigger limit is what is actually known. Google has named no targets for this update, no affected industries and no share of queries. Any claim about what this update supposedly goes after is therefore a guess, however confidently trade media phrase it. The period is documented and the policies are documented. Nothing beyond that.

The third limit is more fundamental. Search has long ceased to be the only route by which people find suppliers. Anyone watching only Google positions misses what AI systems say about their company. How to measure that is covered under measuring AI visibility, and how AI systems reach your content at all under AI crawlers and robots.txt. If your team is to run these checks itself, our AI training covers how.