Google's September 2026 spam update: what we know

Since September 24, 2026, Google has been rolling out its fourth spam update of the year. It applies to every country and every language, and the rollout may take up to two weeks. Google has not said what it targets, so a traffic drop seen in the next few days is not enough to draw a conclusion.

What Google announced

The announcement is two sentences long, posted on September 24 at 9:15 a.m. Pacific time on the Google Search Status Dashboard. The update applies globally and to all languages. The rollout may take up to two weeks.

The Google Search Central team added on LinkedIn that this is a "normal" spam update. No new policy came with it, and Google named no target and no type of content. John Mueller, Google's search advocate, only confirmed on Bluesky that it is likely to take longer than the previous ones.

Two weeks, against under three days this year

The length is the only clue Google has left. The three earlier spam updates of 2026 were quick:

• March: 19 hours and 30 minutes;
• June: 2 days and 1 hour;
• August: 2 days and 16 hours.

For those three, Google announced "a few days." September is the first update this year to get a two-week window. The announced length is a maximum: the rollout may finish sooner.

A longer rollout suggests Google is changing its detection system more deeply. That is a hypothesis: Google has not confirmed it.

How Google spots spam

Google does not publish its signals, so that nobody can work around them. It does explain its method. Most of the work falls to SpamBrain, an artificial intelligence system in use since 2018: it learns from known examples of spam, then recognizes sites no human has flagged yet. In Google's vocabulary, a spam update is an improvement to that system.

Scale explains the choice. Google says it finds 40 billion spammy pages every day. In its report on 2022, it wrote that SpamBrain detected five times more spam sites than in 2021 and 200 times more than at launch.

People are involved too. When a Google reviewer decides a site breaks the rules, they issue a manual action. That is the only case where the owner is told, in the Manual Actions report in Search Console. A drop caused by SpamBrain sends no message.

What Google's policies target in 2026

Google's spam policies range from hidden text to sneaky redirects. Four of them matter most to businesses that publish a lot or hand their content and links to vendors:

• Scaled content abuse: many pages made mainly to manipulate rankings without helping the reader. The tool does not matter: a person, an AI or both.
• Site reputation: third-party content published on an established site, mainly to ride on its rankings.
• Expired domains: an old domain bought to host low-value content on the strength of its past.
• Back button hijacking: added to malicious practices in April 2026 and enforced since June 15. A third-party script or ad code can cause it without the site owner knowing.

After the August update, American consultant Glenn Gabe published an analysis of four affected sites: AI content at scale on health and money topics, a nearly empty Amazon affiliate site, a site with more than 1.5 million programmatic pages, and mass-produced pages with malicious redirects. These are his observations, not a confirmation from Google. They still show what recent spam updates have hit: volume without value.

Why the writing tool is not the issue is explained in Does Google penalize AI-generated content?

The full method for diagnosing a drop is in Google updates: diagnose before you fix. Paid links are covered in buying backlinks.

Frequently asked questions about the spam update