Google September 2026 Spam Update: Two Weeks of Rollout and What Recovery Takes

September 26, 2026. At 09:15 Pacific on Thursday, September 24, Google posted a new entry to its Search Status Dashboard: "Released the September 2026 spam update, which applies globally and to all languages. The rollout may take up to two weeks to complete." The same dashboard logs the year's three earlier spam updates at 19 hours 30 minutes (March), 2 days 1 hour (June) and 2 days 16 hours (August), so this one is budgeted at more than five times the longest of them. For a small business or agency site the meaning is narrow and uncomfortable. If any part of your traffic rests on pages that exist to rank rather than to help, such as AI-written city pages, templated service pages, thin affiliate roundups or a repurposed expired domain, the next two weeks decide whether those pages keep ranking, and Google's own guidance says the way back is measured in months, not days.

What Google has said so far

1. The announcement. The dashboard entry is filed under "Incident affecting Ranking" with a start time of 2026-09-24 09:15 US/Pacific. Google's post on LinkedIn, quoted by Search Engine Roundtable, called it "a normal spam update" and said the ranking release history page will be updated when the rollout is complete.
2. The duration is the news. Google's dashboard history shows the March 2026 spam update completing in 19 hours 30 minutes, the June update in 2 days 1 hour and the August update in 2 days 16 hours. The two core updates of the year took 12 days 4 hours (March) and 11 days 21 hours (May). A two-week window puts this spam update in core-update territory. Barry Schwartz asked John Mueller of Google whether the figure was a typo and was told: "Yes, it's likely to take longer than some of the previous ones."
3. The volatility before the announcement was something else. Rank trackers showed heavy movement on September 23 and the morning of September 24. Search Engine Roundtable's quick facts record Google's position that "the volatility you saw prior to the announcement was not it."
4. Not a link spam update. Per the same report, this update does not target link spam and does not target every spam policy, and Google would not say what share of queries it affects. Google also said it will run periodic refreshes of the update.
5. The only recovery advice is the policy page. Google's instruction to affected sites is to review its spam policies and make sure the site complies.

What a spam update does to a site

Google's spam updates documentation is short. Automated spam detection runs all the time; a spam update is a "notable improvement" to those systems, and Google names SpamBrain, its AI-based spam-prevention system, as the usual example. The consequences are stated plainly: sites that violate the policies "may rank lower in results or not appear in results at all." The recovery clause is the one that matters for planning. Making changes "may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies." There is no reconsideration request for an automated update; that process exists for manual actions, which are a different thing. And for link spam updates specifically, Google says the ranking benefit the links produced is lost and "cannot be regained," so cleaning up does not restore what the links were worth.

The practical translation: a spam update is not a quality rethink of the whole web the way a core update is. If your pages are not inside one of the named policies, annotate the date and do nothing. If they are, the cost is not a two-week dip but a months-long rebuild that starts only after the offending pages are gone.

The five policies a small business site trips

Google lists eighteen spam policies. Five describe things small business and agency sites do on purpose, usually because someone sold them as an SEO tactic.

1. Scaled content abuse. Google's definition: "when many pages are generated for the primary purpose of manipulating search rankings and not helping users," creating "large amounts of unoriginal content that provides little to no value to users, no matter how it's created." The first example on the list is "using generative AI tools or other similar tools to generate many pages without adding value for users." The others are scraping feeds or search results into pages, stitching content from other sites, spreading the pages across multiple sites to hide the scale, and pages that contain keywords but make little sense to a reader. Google's remedy is blunt: "If you're hosting such content on your site, exclude it from Search."
2. Doorway abuse. The example that describes most local SEO packages word for word: "having multiple domain names or pages targeted at specific regions or cities that funnel users to one page." Home services companies, the trade our AI calling service for home services answers phones for, are the classic builders of this pattern, sixty "plumber in" pages that differ only by the town name and all lead to one booking form.
3. Thin affiliation. Product pages "where the product descriptions and reviews are copied directly from the original merchant without any original content or added value," and cookie-cutter sites that replicate the same content across domains or languages.
4. Expired domain abuse. Buying a lapsed domain and repurposing it "primarily to manipulate search rankings." Google's own illustration is affiliate content on a site previously used by a government agency.
5. Site reputation abuse. Third-party content published on a host site "mainly because of that host's already-established ranking signals," with the goal of ranking better than it could on its own. Google notes it has changed how the policy applies in the European Economic Area.

One line in the policy introduction deserves a separate mention. Google now defines search spam to include "attempting to manipulate generative AI responses in Google Search." Stuffing pages with prompt-shaped text to get quoted in an AI Overview is spam under the same rules as keyword stuffing was, which is why our AI search optimization work is built on being the source worth citing rather than on tricking the citation.

What to check in the next two weeks

Annotate September 24 at 09:15 Pacific in your analytics and Search Console notes now, and treat anything that moved on September 23 as a separate event. Then compare the fourteen days from September 24 with the fourteen days before it in the Search Console pages report, but group the pages by template rather than reading them one by one. A template that loses together, every city page or every comparison page moving in step, is the signature of a policy hit; a scattering of individual pages moving both ways is ordinary noise.

For each template, ask Google's question rather than yours: what does this page add that the reader could not get from the page it was modelled on? Original data, a first-hand test, a real price, a local detail that is true only in that town. A template that cannot answer is a candidate for consolidation. Sixty city pages become one service page with an honest service-area section and the towns you actually drive to; the rest are removed or excluded from Search, which is the remedy Google itself names. Do not rewrite everything mid-rollout on a hunch. If you cannot point at the policy you are inside, wait for the dashboard to mark the update complete, which could be as late as October 8. If you can point at it, start now, because the months-long clock only begins when the pages are gone.

What it means for operators

The tool is not the offence; the absence of value is. Google's wording, "no matter how it's created," cuts both ways: an AI-assisted page that carries real information is not the target, and a hand-written page built to catch a search variation is. The page-count race that many agencies sold, three hundred pages a month for a flat fee, now carries its risk on the client's domain, and the client is the one who reads the dashboard. Fewer pages with a measurable reason to exist is no longer just the honest position, it is the cheaper one. Our own numbers say the same thing from the other direction: over the last ninety days on imisofts.com, country-by-country cold email law guides earned roughly fourteen times the clicks per page of dated news posts, so the pages that carry the weight are the ones a reader would miss.

For agencies, three moves are worth making before the rollout ends. Inventory every client site for the five patterns above and put the findings in writing, because a spam demotion the client discovers first is a lost account. Replace volume commitments in proposals with value commitments. And when the update completes, read the results by template, not by page, so the client conversation is about which pattern to retire rather than which keyword slipped.