Google Spam Update (September 2026): AI Content & What to Fix

Google's September 2026 spam update was its longest spam update of the year so far, running from 24 September to 8 October, nearly two weeks.

The rollout improved Google's automated systems for detecting pages that violate its spam policies, across all languages and locations. Google did not name a specific tactic or content type it targeted, so it should not be read as an update aimed specifically at AI-generated content.

An analysis of Google Analytics data from over 30,000 websites suggests the rollout coincided with unusual disruption: 5.8% of websites saw unpaid Google search visits fall by at least half, compared with 1.3% in weeks without an update. That comparison shows the scale of the change, not that the update caused every loss.

For B2B SaaS and fintech companies, the practical question is whether any page sets might violate Google's spam policies: AI-generated pages made mainly to rank, near-identical template pages, third-party sections hosted to exploit a domain's reputation, or paid links.

Google's policies focus on why content was made, not whether a human or AI wrote it, and its AI guidance calls for manually fact-checking drafts.

This guide explains what the September update did, what Google has and has not said about it, how to assess risky page sets, how to use Search Console to diagnose a drop, and what to fix first.

Key takeaways

• Google named no target for its September 2026 spam update, the fourth of the year.
• In the traffic data analyzed, it was the one Google update of 2026 that stood out, with sharp search drops over four times as common as in a normal week.
• AI help breaks no Google rule, while page sets made mainly to manipulate rankings break its scaled content abuse policy. Since 1 October, Google's guidance also asks for a manual fact-check of every AI draft.
• Search Console, read one group of pages at a time, shows whether the update hit a website.
• A fix helps only once Google's systems learn, over months, that the website complies. A manual action instead needs a reconsideration request, and value from spam links never returns.

What is a Google spam update, and what happened in September 2026?

Google logs its notable ranking updates on its public Search Status Dashboard, and this entry gives only the dates and scope.

The rollout was long for 2026 but not unusual for a spam update, and its length alone says nothing about how hard it hit. Four earlier spam updates on Google's dashboard ran longer, among them the August 2025 spam update at 26 days, and the December 2022 link spam update ran 29 days.

Google's 2026 changes to its spam rules and AI guidance include these three:

• 15 May 2026: Google clarified that its spam policies apply to generative AI responses in Google Search, such as AI Overviews and AI Mode.
• 28 August 2026: Google revised its site reputation abuse policy after talks with the European Commission and renamed it the site reputation policy.
• 1 October 2026: Google added a manual fact-check to its guidance on AI drafts and did not connect the change to the update.

What did the September 2026 spam update target?

“This is a normal spam update, and it will roll out for all languages and locations,” Google Search Central wrote on LinkedIn at launch. Nothing Google has published since has named a target.

Industry reporting described a more disruptive rollout than Google's brief announcement suggested. Search Engine Roundtable documented ranking swings on 25 to 27 September, 30 September and 4 to 6 October, and reported that some in the SEO community compared the impact with a core update. The market was seeing repeated shifts in search rankings, but those observations do not establish which spam tactics or content types Google targeted.

How big was the September 2026 spam update?

In the traffic data analyzed, it was the one Google update of 2026 that stood out. During the rollout, 5.8% of the websites in the Google Analytics sample lost half or more of their unpaid Google search visits while their other traffic held, against 1.3% in weeks with no update.

In the same data, the typical website lost far less. In the rollout's first ten days, its Google search visits fell by about 6%, against about 1% in a stretch with no update.

Rank trackers saw the same spike. Their volatility indexes score how much Google's results for a fixed set of keywords change from one day to the next, and four of the six below peaked far above their normal readings during the rollout:

AccuRanker's index has the longest public history, and its September peak was about double the 10.3 to 13.4 of 2026's March, May, June and August updates and above the 19.6 of February's Discover core update. Semrush's Finance category, the closest to fintech, was in its “very high” band on 11 of the 14 days after the release.

Similarweb and SISTRIX stayed below their own update levels, though, and rank-tracking vendors such as Nozzle reported receiving distorted Google results from mid-September. Trackers show how much Google's results moved overall, while Search Console shows what happened to a given website.

How do Google spam updates work compared with core updates?

A drop since late September can come from three different Google actions, and each has its own fix. A spam update improves the automated systems Google's search engine uses to catch pages that break its spam policies. A core update reassesses page quality across the web and targets no specific website. A manual action comes from a reviewer at Google, and Search Console sends a notice.

Google's spam detection runs between updates too, and Google keeps updating it as spam changes. In its report on 2022, Google credited SpamBrain, its AI-based spam-prevention system, with better detection of spam at crawl time. A spam update is a notable improvement to that detection, and Google lists each one on its status dashboard.

The dates matter most when updates sit close together. In March 2026, Google's spam update ran from 24 to 25 March and its core update started on 27 March, so only a daily chart can show which one a drop followed.

After a link spam update, the ranking credit that spam links gave never comes back.

How to tell if the September 2026 spam update hit a website

Once the rollout is over, Search Console shows what changed for each set of pages and whether a reviewer acted. The example below is a diagnostic scenario for the invented Vendor A, with made-up readings: its rank tracker showed integration keywords falling off the first page on 27 September.

The checks start once Google marks the rollout complete, which it did on 8 October. Reading Search Console in the middle of a rollout catches a moving target.

Search Console data arrives two to three days late, so a team's own comparison can be read from about 24 October. Look at one group of pages at a time, such as one template or folder. Keep the search type on text-based Web in both windows, because Google added a multimodal type for searches made with images on the rollout's first day.

The six checks, in order:

1. Compare equal windows and check seasonality. A logging error affected Search Console's impression counts until 27 April 2026, so year-on-year comparisons involving that period need a caveat for impressions. Longer history can still help identify seasonality. In the equal windows, impressions are down by about a quarter and clicks by less, and the daily chart steps down on 30 September.
2. Split the drop by page group. Integration and alternatives pages carry most of the loss. The glossary falls by a third, the partners section has almost no Google traffic left and the blog is flat.
3. Read the dates. Each falling group steps down inside the rollout, which fits the update without proving it.
4. Rule out other causes. The tracker crash doesn't show in Search Console, which still has clicks for those keywords, because rank-tracking vendors reported distorted Google results in late September. Bing Webmaster Tools shows the same page groups steady on Bing, a second search engine with its own ranking systems, which makes lower demand unlikely and points to something specific to Google. The changelog shows no release, tracking or template change, so nothing on the website's side explains the step down.
5. Check for a manual action, then security and indexing. The Manual actions report is empty, which rules out a reported manual action but does not identify the cause of the drop. Security issues lists no hacked pages or malware. The Page indexing report shows integration pages as crawled but not indexed from early October, a pattern to watch, though not proof.
6. Match each group to a policy and log it. The plan merges the integration pages into 40, keeps the glossary's 30 best articles, takes down the partners section and keeps the blog. Each decision goes into the changelog with its date and onto the Performance chart as an annotation, such as Integrations: template pages merged into 40.

How to recover from a Google spam update: what to fix first

Each of those four decisions follows one order: stop the source, cut what carries risk and little value, and improve what stays. Value here means what a page set brings in, sign-ups and pipeline in analytics or the CRM, more than its traffic.

1. Stop the production line. Pause the template, AI pipeline or partner feed behind each at-risk set first, or new pages keep arriving while old ones are fixed.
2. Remove or noindex high-risk, low-value sets. Partner sections placed for the domain's signals come down first. Moving them to a subdomain or subfolder is no fix, because Google may treat that as an attempt to get around its spam policies, which bar new subdomains or folders used to keep breaking them.
3. Merge and improve the valuable pages. Merge near-duplicates with a redirect, which Google lists as legitimate, and fact-check what stays.
4. Handle a manual action on its own track. Fix every affected page, since a partial fix earns no partial return. Then file a reconsideration request that explains the issue, the fix and the result.
5. Leave pages that pass the purpose test alone. Rewriting them spends time the failing sets need. The test is set out in the AI-content section below.

Then comes the wait, and the annotations from check 6 show each month whether a merged group is coming back. “Resolving this tends to take time & significant effort to show the value,” Mueller wrote in a 7 September reply about page sets.

Check clicks and sign-ups before deleting a whole section. Google's core update advice calls deleting content a last resort, so pages that earn clicks and answer real questions belong in the merge or improve boxes.

Does Google penalize AI content, and what changed in October 2026?

Google doesn't penalize a page because AI helped write it. It acts on pages produced to manipulate rankings, however they were written, so an AI draft faces the same policies as any other page. “Appropriate use of AI or automation is not against our guidelines,” Danny Sullivan and Chris Nelson wrote for Google's Search Quality team in February 2023.

In a mid-2025 study of about 600,000 pages in Google's top 20, Ahrefs' AI detector, which Ahrefs notes can return false positives, found some AI-written text on 86.5% of them. How much of a page AI wrote had almost no link to where it ranked, so an audit of each page's AI share tells a team little.

Even so, Google's guidance on AI drafts changed on 1 October. It now warns that generative models predict likely words instead of retrieving facts. Then it says, “It is critical to manually factcheck and review all AI-generated content for accuracy and trustworthiness before publishing.”

The new fact-check covers metadata too, as the page's accuracy advice did before. A team that generates titles, meta descriptions, structured data or image alt text in bulk now needs to check those fields like the copy. We'd keep the proof with the page set: who checked it and when, so the review can be shown later.

Google's helpful content page changed on 1 October too. In a new section on what Google's quality raters check, AI text produced at volume without manual oversight counts as little to no effort. Another addition calls it deception to fake author profiles with AI-generated headshots, made-up names or false credentials. A blog run on invented author personas should put a real, named author on every post.

Google publishes no thresholds, so we turn its definitions into a purpose test of three questions.

The purpose test for any page set
1. Would each page be worth publishing if no keyword list had suggested it?
2. If its integration, competitor or city name were swapped for another, would the page still read true? (A yes points to a template with only the name changed.)
3. Has a named person fact-checked it, metadata included?

As we read Google's 2026 documents, the risk sits with page sets built from a keyword list and published unchecked. “The SEO's job is to refuse the version of this project that scales bad pages fast,” Srdjan Stojadinovic writes in his guide to programmatic SEO for Omnius.

His rule is to build 20 to 50 pages from a new template and read them as a skeptical visitor would. Only a template that can be defended one page at a time should scale.

Which Google spam policies put websites at risk?

Four of Google's spam policies match what B2B teams publish and buy: AI-written page sets, template pages, partner sections and paid links. The purpose test covers the first three, and paid links need an audit of their own. To show each one at work, we invented Vendor A, a spend-management company with made-up numbers.

1. Scaled content abuse: page sets drafted with AI from a keyword list

“Scaled content abuse is when many pages are generated for the primary purpose of manipulating search rankings and not helping users,” Google's policy reads. B2B glossaries and best X for Y articles that AI drafts by the hundred fit that description when they add nothing new.

Google's AI optimization guide applies the same purpose test to separate pages made for fan-out queries, the related searches AI Overviews and AI Mode run behind one question.

What to do: Run the purpose test on every page set written with AI, and merge near-duplicates into the strongest page with a redirect. Then stop publishing a separate page for each variation of a search, fan-out queries included.

• ❌ 150 AI-drafted glossary articles, one per phrasing of What is a corporate card?, with fee figures nobody checked
• ✔ One corporate card guide that answers those phrasings in sections, fact-checked by the finance lead

2. Doorway abuse: template pages that differ only by a swapped name

Using one template for integration, alternatives or city pages does not by itself break Google's doorway abuse policy. The policy covers pages created to rank for specific, similar searches that funnel visitors toward a shared destination or are less useful than that destination. Pages that differ only by a swapped name need review for that pattern, rather than being treated as violations because they share a template.

John Mueller described the pattern on Bluesky on 7 September, in a reply about pages generated from every combination of a list. “It's easy to spin something up with many pages, it's hard to provide real value to users,” he wrote.

What to do: Merge the template pages where swapping the name leaves the page true. Give each page that stays the detail only its integration or city has, such as setup steps and limits.

• ❌ 400 integration and alternatives pages from one template, Vendor A integrates with {Partner} to sync spend data, with nothing else changed
• ✔ 40 integration pages, each with its setup steps, the fields that sync, its known limits and a screenshot

Read more: Programmatic SEO automation explained

3. Site reputation policy: third-party sections placed for the domain's rankings

When a third party publishes pages on a company's website mainly to borrow the host's established ranking signals, Google's site reputation policy applies. In its rare human reviews, Google asks whether the host gave a section enough input, editorial oversight or contribution to count as part of the website.

We read the 28 August revision as reassuring for B2B blogs written by freelancers. Until then, one of Google's abuse examples was an established website moving into a new area mainly with freelance content because it would rank better there. The revised page drops it, and in its place describes an original freelance article with clear authorship, editorial responsibility and marked affiliate links. “It's unlikely that we'd take action in this case,” Google writes.

What to do: List every section third parties write or supply. Remove the ones placed mainly to rank, or noindex them to keep them out of Google's index, and put the rest under a named editor.

• ❌ A Best business credit cards review from a lead-generation partner, with no named author and the same text on other websites
• ✔ Freelance guides on the blog under each writer's name, edited and signed off in-house

4. Link spam: paid guest posts and link insertions

Paid guest posts fall under the first practice Google's link spam policy lists, exchanging money for links or for posts that contain links. The policy never names link insertions, where a publisher is paid to add a link to an old article, and we read them as money for links. Paid links are fine when marked as sponsored, because that tells Google not to pass ranking credit through them.

What to do: List every paid or exchanged placement, ask each publisher to mark the paid links that stay as sponsored, and stop buying links that pass ranking credit. After a manual action for unnatural links, Google's Manual actions help asks for each link to be removed or marked first, and only the links left after that go in a disavow file in Search Console. “Blindly adding all backlinks to the disavow file is not considered a good-faith effort,” the page warns.

• ❌ 30 paid guest posts a quarter, each linking to the pricing page with the words best spend management software
• ✔ An annual report on company card spending that trade publications cite and link to

Other spam policies take a B2B form too:

How we handle algorithm changes at Omnius

At Omnius, each algorithm change is read against the baseline set when the work began. That covers Google updates and shifts in how ChatGPT or AI Overviews choose sources. “Competitors move, content decays, technical conditions drift, search demand changes, and LLM retrieval, citation, and answer patterns vary over time,” our methodology notes, and “those changes are measured as deltas against the Day-0 baseline”. The comparison shows which page groups moved, how far they moved against the rest of the website and whether the dates match the rollout.

The same reading drives a recovery. When Global App Testing came to Omnius, its website had been losing traffic for over 18 months, with its articles copied on other websites, content decaying and spammy links pointing at it. The work dealt with each cause, starting with the copied content, which took four months. Organic traffic in Q4 2024 was 140% above Q4 2023, and high-quality marketing leads rose 163%.

Our technology does the watching across Google and AI answers, where “decay, gaps, anomalies, competitor movement, and machine-accessibility issues are surfaced”. The judgment stays with the team: what caused a drop, which fix each page group needs and in what order. When search itself changes, we change what we measure, as our memo puts it.

Frequently asked questions

How long does recovery from a Google spam update take?

Recovery can take months, and there is no guaranteed timeline. Google's spam-update guidance says its automated systems learn “over a period of months” that a website complies. Ranking credit from spam links does not return.

Do I need to wait for the next spam update to recover?

Google does not say recovery must wait for the next announced spam update. Its spam-update guidance describes detection systems that run continuously. Fix the violations and monitor the affected pages; a manual action instead needs a reconsideration request.

Do Google spam updates affect AI Overviews and AI Mode?

Google spam updates can affect AI Overviews and AI Mode, because both depend on Google's spam detection. A page must be indexed and eligible for a snippet to appear as a link there, so a page removed from Search loses that place too. Search Console counts their clicks in the Web search type. Its generative AI report, which started rolling out to some websites on 3 June 2026, shows their impressions by page.

Can a competitor's spam report lead to a manual action?

Since April 2026, a competitor's spam report can lead to a manual action when it points to a real violation. If Google acts, it must send the report's text to the website owner.

Is there a Google 20% rule for AI content?

No, Google sets no percentage or threshold for AI-written pages. Instead, Google lists heavy use of automation to produce content on many topics among its warning signs.

Does Google require AI content to be labelled?

No, Google Search has no general rule that AI-written pages must be labelled. Google suggests adding background on how automation was used where readers would expect it.

When is the next Google spam update?

The next Google spam update has no public date. Google posts each one on its status dashboard when the rollout starts, and the dashboard has an alert feed.

Methodology

We read Google's own pages on 15 October 2026, and the guide rests on them and on a few outside measurements:

• Google's record. Google's spam policies, spam updates, core updates and AI guidance pages, the Search Central changelog and blog, and the status dashboard, whose record of updates starts in November 2021.
• Page changes. The 1 October edits are dated by comparing the live pages with Internet Archive copies, and the helpful content edit, which also added a section on main content and four rater attributes, appears in no changelog; that page had a further small edit on 5 October. The site reputation policy's dropped freelance example comes from its 26 August copy. The changelog's reason for the AI guidance edit is “To get our documentation in sync with our presentations we use at our developer events”, and it landed during Google's developer event in Barcelona, which ran from 30 September to 2 October. The site reputation policy was named site reputation abuse until its 28 August 2026 revision.
• Named people. Mueller's posts were read on Bluesky itself.
• Screenshots. Three screenshots were captured on 15 October 2026 and the Semrush Sensor chart on 16 October, each framed with its page's address.
• Volatility indexes. Each index was read on its public page on 16 October 2026 and compared only with its own earlier readings, because the six use different keywords, locations and scales. MozCast repeated an identical reading every day from 1 October, so its peak covers the rollout's first week. AccuRanker's index had already reached its top band on 18 to 20 September, before the update began, and its 25.1 fell on 26 September, when vendors reported distorted results, before dropping to 13.3 two days later. Mangools' index is left out because its three spikes all fell on Sundays.
• Vendor A. The company and every reading in its scenario are invented. Its two windows keep the same weekdays, start once Google marked the rollout complete and follow Google's advice for reading core updates.
• Limits. Google published no impact data for the update. The traffic-analysis sample is mostly small businesses. September was measured during the rollout, while the other update comparisons used post-completion windows, so the chart is not a like-for-like comparison of severity. Ahrefs sampled pages that still rank, so pages removed for spam are not in its data. Volatility indexes measure how much Google's results moved for each vendor's keywords, never any website's traffic, and rank-tracking vendors reported distorted Google results from mid-September.
• Interests. The traffic analysis comes from an analytics-app vendor. Nozzle sells rank tracking and Ahrefs sells SEO software with an AI detector. Semrush, Moz, AccuRanker, DataForSEO, Similarweb and SISTRIX sell SEO software or data, and their volatility pages promote it. Search Engine Roundtable and Search Engine Journal are trade publications, cited for reported dates and statements only.

Sources

The documents, posts and studies behind this guide:

• Google Search Central documentation: spam policies, spam updates, core updates, AI guidance, its 27 September copy, helpful content, AI features guide, AI features and websites, ranking systems guide, debugging traffic drops, status dashboard help, spam reports and the changelog
• Google announcements: the September 2026 incident, the ranking history, the LinkedIn launch post, the X completion post, the site reputation update, back button hijacking, the AI features guide launch, the 2023 AI content guidance, the March 2024 spam policies, the 2022 webspam report, multimodal reporting and generative AI reports
• Search Console Help: Manual actions, Security issues, Page indexing, Performance report, filtering and comparison, data discrepancies, annotations and data anomalies
• Named people: Mueller on page sets
• Studies and vendor reports: Nozzle, Diib, Ahrefs and Bing Webmaster Tools, plus Diib's typical-website figures
• Volatility indexes: Semrush Sensor, AccuRanker Grump, MozCast, DataForSEO, Similarweb SERP Seismometer and SISTRIX Update Radar
• Omnius: Programmatic SEO automation explained
• Trade press: Search Engine Roundtable and Search Engine Journal