Google’s fourth spam update of 2026 went live at 09:15 Pacific on September 24, and it could keep rankings moving until October 8. The Search Status Dashboard says the rollout may take up to two weeks to complete, making it the longest spam update this year by a wide margin.
That timeline is the story. The March update finished in 19.5 hours, June in 48, and August in roughly three days. A fourteen-day window means SEO teams cannot cleanly separate update effects from all the other noise in the results.
What the update enforces
Google described it as a “normal spam update” rolling out globally and in all languages, but did not publish a specific target list or the share of queries affected. Enforcement runs through SpamBrain, which works algorithmically rather than through the manual actions visible in Search Console.
The policies already on the books include:
- Expired domain abuse
- Scaled content abuse
- Site reputation abuse
- Doorway abuse
- Back button hijacking
- Fake or undisclosed incentivized reviews
A geographic wrinkle
Since August 30, Google has not applied site reputation abuse manual actions to users in the European Economic Area. This September update is the first confirmed ranking release since that change, so the same site running third-party content on a strong domain can now face different outcomes depending on where the searcher is located. Google’s expanded guidance does not explain the split.
Why measurement is harder
Volatility was already visible around September 22, after unexplained swings on September 15 and across September 4 to 13. At the same time, the tools for reading those swings have narrowed. Search Console’s generative AI report shows impressions but not clicks or queries, and third-party trackers now have to issue between 500 and 1,000 requests to build a five-page ranking for a single query after Google changed passthrough links and removed the num=100 parameter.
Confirmed Google updates have also become rarer—from around ten a year in 2021 and 2022 to four in 2025. Fewer, larger events with less surrounding data make each rollout harder to diagnose.
The playbook
For the next two weeks, the practical move is to freeze major changes. Set a clean traffic and ranking baseline now. Watch daily movement, but treat any swing as update noise until the rollout is confirmed complete. Then compare two weeks before and after to find the real losers.
If you manage EEA traffic, segment those pages before drawing conclusions. And if your site touches any of the six policy areas above, use the window to audit rather than react.
Source: PPC Land
