On September 24, 2026, Google began rolling out its September 2026 spam update. Spam updates usually finish in a couple of days, so most site owners are used to a short burst of volatility followed by a clear before and after. This one is different. Google says the rollout may take up to two weeks, which means that for a full fortnight, every ranking change you see is a reading from a moving target.
That changes how you should respond. This piece covers what Google has confirmed, what it has not said, what early volatility data does and does not show, and a practical plan for the days between now and the end of the rollout. It is written for anyone responsible for search engine optimization at their company, whether you run a small site or manage a large content library.
What is confirmed
The core facts come from Google’s Search Status Dashboard and are consistent across Search Engine Land, Search Engine Journal and Search Engine Roundtable.
The update began on September 24, 2026, at 9:15 a.m. Pacific time. It applies globally and to all languages. Google’s dashboard says the rollout may take “up to two weeks to complete”, which puts the latest possible finish around October 8. It is the fourth spam update of 2026, following releases in March, June and August.
The rollout window is what stands out. The dashboard lists the earlier 2026 spam updates at 19 hours and 30 minutes for March, 2 days and 1 hour for June, and 2 days and 16 hours for August. Two weeks is several times longer than any of them. One point of precision matters here: two weeks is the announced maximum, not a measured duration. The update could finish sooner, and until Google marks it complete, nobody outside Google knows how long it will really take.
What Google has not said
Google has not said what this update targets. According to PPC Land, Search Central described it only as a normal spam update, with no new policy, no named category and no figures on how many queries are affected. That gap matters, because much of the commentary this week has filled it with confident claims about which sites are being hit and why. Treat those claims as hypotheses. The only firm statement from Google is that sites which see a change should review its spam policies. Anything more specific is inference from other people’s data.
What early data shows, and what it does not
Search Engine Roundtable reported that a long list of volatility trackers showed significant movement across the first weekend, September 25 to 27. The tools it named include Semrush Sensor, AccuRanker, Mozcast, Sistrix, Algoroo and several others. When that many independent trackers move at once, it is a reasonable signal that something real is happening in the results.
Glenn Gabe, a well-known analyst of Google updates, reported big drops across a number of sites in multiple verticals and countries. He described AI-generated content sites and programmatic content farms as among those losing rankings. That is one experienced observer’s read of the sites he tracks, and it fits how Google’s spam policies treat scaled content, but it is not confirmed by Google and it is not a full picture of who is affected.
There are three reasons to be careful with early data.
First, volatility is not damaging. Trackers measure how much results moved, not who won or lost. A large reading can come from a few sites moving a long way.
Second, the update is not finished, so the pattern on day five may look different by day ten.
Third, you are reading a mix of signals. Seasonal demand, your own recent changes, other Google systems and ordinary news cycles all move traffic at the same time. Attributing a dip to the spam update before it ends is a guess.
What to do while it rolls out
The most useful thing to do during a long rollout is resist the urge to react. Here is a working plan.
Record a baseline. Before anything else, capture your current position. Export Search Console performance data for the last 90 days by page and by query, along with clicks, impressions, average position and the countries you care about. Note recent changes such as redesigns, migrations, new content batches and link campaigns.
Annotate the timeline. Mark September 24 in your analytics and reporting tools, and add a note when Google marks the rollout complete.
Compare like with like. Weekday traffic and weekend traffic behave differently for many sites. Compare the days since September 24 with the same weekdays in earlier weeks.
Segment before you conclude. A sitewide traffic drop is rarely uniform. Split the data by page type, by folder, by template and by query group. If the loss is concentrated in one section, such as a batch of AI-assisted pages or a subdirectory of third-party content, that tells you far more than a total.
Do not make sweeping changes. Deleting hundreds of pages, rewriting templates or disavowing links mid-rollout makes it impossible to tell what caused what. If you suspect a policy problem, plan the fix and stage it.
Fix what is clearly broken. If you find hacked content, injected links, broken redirects or a security issue, fix it immediately.
Hold your publishing rhythm. Search Engine Land’s coverage advises sites that are not affected to keep doing what they were doing.
Audit against Google’s spam policies now
Whether or not you see a drop, this is a good week to check yourself against the policies Google points to. Google’s documentation names categories including cloaking, doorway abuse, expired domain abuse, hacked content, hidden text and links, keyword stuffing, link spam, scaled content abuse, scraping, site reputation abuse, sneaky redirects, thin affiliation and user-generated spam.
Three of these tend to matter most for modern content teams.
Scaled content abuse is about producing large volumes of low-value pages in order to manipulate rankings, whether the pages are written by people, generated by AI tools or scrapped. The test is value per page, not the tool used. A large batch of near-duplicate location pages or templated question pages with thin answers is the pattern to look for.
Site reputation abuse covers publishing third-party content on an established site mainly to borrow its ranking strength. Sponsored sections or partner content hubs on an established site are examples.
Link spam covers buying, exchanging or generating links mainly to manipulate rankings. If you have inherited a backlink profile from a past agency, this is the moment to review it critically, not defensively.
If you find something that fits, note what it is, how many pages it affects and what you would do about it. You need not act during the rollout, but be ready to.
What recovery looks like
If you are affected, it helps to set expectations early. Google’s spam update documentation says that fixing problems may help a site improve if its automated systems learn “over a period of months” that the site complies with its policies. It also warns that for link spam, changes may not bring an improvement, because ranking benefits from those links cannot be regained.
So recovery is not a matter of days, and it is not guaranteed. The right frame is a remediation plan measured in months, not a quick reaction to a bad week.
Spam updates also occasionally catch sites that were not breaking the rules. Search Engine Land notes that this should not typically happen but sometimes does. If you believe you were caught unfairly, audit yourself carefully, document your evidence and keep monitoring.
Why this matters beyond classic rankings
Most teams now think about visibility in more places than the ten blue links. Generative engine optimization and answer engine optimization are about being cited and recommended in AI answers, which draw on the wider web and on search results. No one has published data showing how this specific spam update affects citations in AI Overviews, ChatGPT or Perplexity, and it would be a mistake to claim otherwise.
What can be said is narrower and more practical. Pages that lose organic visibility in Google lose a route to being seen and cited, and the qualities that spam policies punish, such as thin, repetitive, mass-produced content, are also poor candidates for being quoted in an AI answer. Strong search engine optimization, generative engine optimization and answer engine optimization all tend to rest on the same base: original, useful pages that answer a real question well. If you are building visibility for AI search, the spam policies are a sensible floor.
If you track AI citations, set that baseline now too, and compare again after Google says the update is complete.
Where this leaves you
The confirmed facts are these. Google started the September 2026 spam update on September 24, it is global, and it may take up to two weeks. It is the fourth spam update this year and the longest announced window. Google has not said what it targets. Early volatility is real, and some analysts report losses among AI-generated and programmatic sites, but that is observation, not confirmation.
The practical response for any search engine optimization team is patience with discipline. Take a baseline, mark the dates, segment your data, audit your own site against the spam policies, fix genuine defects and hold back on big changes until the rollout ends. A two-week update rewards teams that measure carefully, not teams that react fastest.
Frequently Asked Questions
1. When did Google’s September 2026 spam update start, and when will it finish?
Answer: It began on September 24, 2026, at 9:15 a.m. Pacific time. Google says the rollout may take up to two weeks, so the latest expected finish is around October 8. It could end sooner.
2. Why is this spam update considered the longest of 2026?
Answer: Because the announced window of up to two weeks is far longer than the earlier 2026 spam updates, which the dashboard lists at 19 hours and 30 minutes, 2 days and 1 hour, and 2 days and 16 hours. Two weeks is a maximum, not a confirmed actual duration.
3. What does the September 2026 spam update target?
Answer: Google has not said. It applies worldwide to all languages. Some analysts report ranking losses among AI-generated content sites and programmatic content farms, but that is their observation, not a statement from Google.
4. Should I change my site while the update is rolling out?
Answer: Not in a sweeping way. Record a baseline, annotate the dates, and segment your data. Fix clear defects such as hacked content or broken redirects immediately, but avoid large deletions, rewrites or disavows until the rollout is complete.
5. How long does it take to recover from a spam update?
Answer: Google says recovery can take months, because its automated systems must learn over time that a site follows its spam policies. For link spam, ranking benefits from those links may not return at all, even after cleanup.
6. Does the spam update affect visibility in AI answers?
Answer: No data has been published on that yet. Pages that lose Google visibility lose one route to being cited, and low-value mass-produced content is a poor candidate for citation anyway. Measure AI citations before and after the rollout and compare, and do not draw conclusions from one week.
7. How can I check whether my site is at risk?
Answer: Audit against Google’s spam policies, especially scaled content abuse, site reputation abuse and link spam. Then compare your Search Console data by page type and query group against a 90-day baseline.
If you want to know where your brand appears, and where it is missing, across Google and AI answer engines, that is exactly what we look at in a free AI Visibility Audit.
