Google released the August 2026 spam update today, August 18, at 9:27 a.m. Pacific. The whole announcement fits in two sentences on the Search Status Dashboard: “Released the August 2026 spam update, which applies globally and to all languages. The rollout may take a few days to complete.” On LinkedIn, Google added that this is “a normal spam update,” as Search Engine Roundtable reported.
That is the official record so far, and for most spam updates it’s about all Google ever says. What makes this one worth writing about is the calendar. The June 2026 spam update began on June 24 and was done by June 26. This one started 55 days after June’s did, and it’s the third spam update of 2026, which is more than Google shipped in all of 2025.
If your site publishes its own content, doesn’t host other people’s content to borrow your rankings, and hasn’t bought links or generated hundreds of pages to catch searches, this update is unlikely to be about you. Spam updates are improvements to SpamBrain, Google’s automated spam detection, and they act on practices Google has already defined as spam. If your Search Console numbers dip this week, check the rollout dates, the Manual Actions report, and a live Search Console logging bug before you change anything.
What Google said, and what it didn’t
Google says less about spam updates than about core updates, and its spam updates documentation is short. Its automated spam-detection systems run constantly, and “we occasionally make notable improvements to how they work. When we do, we refer to this as a spam update.” The system underneath is SpamBrain, which Google calls “our AI-based spam-prevention system,” improved “from time-to-time” to “make it better at spotting spam and to help ensure it catches new types of spam.” For scale, Google says its systems find 40 billion spammy pages every day.
What Google did not say: which policies this update targets, what share of queries it touches, or when it will finish. Barry Schwartz at Search Engine Land noted it’s the third spam update announced in 2026 and added the caveat that applies to every one of these: “There will always be cases of sites not spamming Google that get hit by a spam update.” Google would not tell him what percentage of searches were affected, per his Search Engine Roundtable write-up.
A spam update is not a core update
The distinction decides what you do next. A core update is a broad change to how Google evaluates content in general. It doesn’t target sites, a drop after one isn’t a policy violation, and recovery means making the affected pages genuinely more useful. We walked through that after Google’s May 2026 core update.
A spam update is narrower. It changes how well SpamBrain identifies practices Google has already defined in its spam policies: cloaking, doorway abuse, scaled content abuse, site reputation abuse, expired domain abuse, link spam, hacked content, user-generated spam, and the rest of that list. Google’s instruction to affected sites is one sentence: “Sites that see a change after a spam update should review our spam policies to ensure they are complying with those.” Sites that violate them “may rank lower in results or not appear in results at all.”
Two more differences matter for a small business. Spam updates are algorithmic, so nobody notifies you. That’s different from a manual action, which Google issues “when a human reviewer at Google has determined that pages on the site are not compliant with Google’s spam policies,” and which does appear in Search Console with a way to request reconsideration. And recovery from a spam update is slow. Google says changes “may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies.” Months, not days.
Three spam updates in five months
The 2026 record, from Google’s ranking release history, all times Pacific:
| Update | Started | Finished | Rollout time |
|---|---|---|---|
| March 2026 spam update | March 24 | March 25 | 19 hours, 30 minutes |
| June 2026 spam update | June 24 | June 26 | 2 days, 1 hour |
| August 2026 spam update | August 18 | In progress | Google says “a few days” |
For comparison, 2025 had one spam update, in late August, and its rollout took nearly four weeks. 2024 had three, spread across March, June, and December. Measured start to start, the 55 days between the June and August updates is the shortest gap between two spam updates on Google’s dashboard, which goes back to November 2021. It wins by a day: the previous closest was 56 days in late 2022, and the second of those was a link-spam update.
Google hasn’t explained the cadence, and I’d be careful about reading a story into it. Two things did happen around these updates that are worth holding in mind. On May 15, Google revised the opening of its spam policies so that spam now explicitly includes “attempting to manipulate generative AI responses in Google Search,” not only classic rankings. And the June update, in Schwartz’s account, “felt more widespread than a typical Google spam update,” with unconfirmed movement noticed in black-hat forums five days before Google announced it. Whether August follows that pattern won’t be knowable for a few days.
The spam policies small businesses actually run into
Most of Google’s spam policies describe things a legitimate local business or startup would never do. A handful describe things well-meaning owners do all the time, usually because a vendor recommended it.
Scaled content abuse. The policy is about volume without value “no matter how it’s created,” and the first example Google lists is “using generative AI tools or other similar tools to generate many pages without adding value for users.” Google has said since 2023 that “appropriate use of AI or automation is not against our guidelines”; the violation is generating content “with the primary purpose of manipulating ranking in search results.” If someone sold you 300 near-identical service or blog pages last year, this is the policy to reread. We wrote about building an AI content system that doesn’t read like one if you want the version that holds up.
Doorway pages. Google’s own example is “having multiple domain names or pages targeted at specific regions or cities that funnel users to one page.” That is the templated “[service] in [town]” build-out a lot of local businesses were sold. City pages are fine when each one says something true and specific about that market. They’re doorways when they’re the same page with the town name swapped.
Site reputation abuse. Defined as third-party content “published on a host site mainly because of that host’s already-established ranking signals.” If you’ve let a partner run a coupon section, a sponsored blog, or an unrelated sub-directory on your domain, that’s the exposure. Google is explicit that “having third-party content alone isn’t a violation” and that “coupons that are sourced directly from merchants” are fine. The problem is content that lives on your domain to borrow your rankings.
Link spam. The examples read like a list of common vendor offers: paying for articles that include “links that pass ranking credit,” dropping keyword-rich links into “guest posts, or press releases distributed on other sites,” and “sending someone a product in exchange for them writing about it and including a link.” Google’s guidance for its AI features makes a related point about mentions: “seeking inauthentic ‘mentions’ across the web isn’t as helpful as it might seem,” and Gary Illyes compared buying mentions to buying links in May.
User-generated spam and hacked content. These are the ones you didn’t do. Google’s definition of user-generated spam is “spammy content added to a site by users through a channel intended for user content,” and it adds, pointedly, “often site owners are unaware.” An open comment form, a forum, or an unpatched plugin can put your domain on the wrong side of a spam update without anyone at your company touching a thing.
Expired domain abuse. “An expired domain name is purchased and repurposed primarily to manipulate search rankings by hosting content that provides little to no value to users.” If you bought an aged domain for the authority and pointed thin content at it, that’s the policy.
How to tell if the update hit you
Do these in order. The first two save you from fixing the wrong thing.
Check the rollout status before you diagnose. The dashboard says “a few days.” Google’s guidance for core updates is to wait “at least a full week” after a rollout completes before analyzing Search Console, and the logic transfers: rankings move during a rollout, and a Tuesday drop can be a Friday recovery.
Rule out the Search Console logging bug. This one is going to fool people. Google’s data anomalies page confirms that “a logging error caused a decrease in impressions on the Generative AI performance report in Search for data starting on August 13, 2026,” and says it “affects data logging only and is ongoing.” John Mueller called it “just a logging issue and not representative of visibility changes in Search,” per Search Engine Roundtable. If impressions in your Generative AI performance report fell last week, that’s the likely cause, and it predates the update by five days.
Compare like periods in the Performance report. Google’s traffic-drop debugging guide is the checklist: compare the drop period to a similar period, extend the range to 16 months to see seasonality, and look for “patterns in the pages affected.” If it’s a spam-update hit, the pattern to look for is concentration: the city pages, the third-party section, or the batch of generated pages falling while the rest of the site holds.
Open Manual Actions and Security Issues. The same guide says it directly: “If you suspect a drop due to a spam violation, review our spam policies … Also, check the Manual Actions report on Search Console.” A spam update doesn’t come with a manual action; a clean report rules that out, and a flag in Security Issues can mean someone else put content on your site.
Note what else was moving. Search Engine Roundtable logged unconfirmed ranking volatility on July 24, August 1 to 3, August 5 to 6, and August 12 to 13. A drop that started before August 18 is more likely tied to one of those than to this update.
If you were hit, and if you weren’t
If the pattern points at a policy, whether that’s a section of the site, a page template, or a vendor’s link package, fix the practice rather than the symptom. Consolidate scaled pages into fewer pages that say something. Take third-party content off your domain or restructure it the way Google’s policy allows. Stop the link buying. Then wait, because SpamBrain relearns “over a period of months.”
Don’t disavow links in a panic. Disavowing tells Google to ignore certain links pointing at your site, and Google’s own disavow guidance calls it an advanced feature to use only if you have “a considerable number of spammy, artificial, or low-quality links” and “the links have caused a manual action, or likely will cause a manual action,” adding that “in most cases, Google can assess which links to trust without additional guidance.” And don’t gut pages that are performing. Google’s core-update advice — avoid “quick fix” changes, treat deleting content as “a last resort” — is written for a different kind of update, but it’s the right instinct here as well.
One caveat that stings if it applies to you. Google’s documentation carries a warning written for link spam updates: making changes “might not generate an improvement,” because once its systems remove the effect of spammy links, “any ranking benefit the links may have previously generated for your site is lost.” Google hasn’t said August is a link spam update, but if bought links were holding up your rankings, that is the mechanism to expect. Recovery means earning what the links were faking, not restoring it.
If you weren’t hit, Schwartz’s line applies: “you are good to go – at least for now.” Use the week for the audit you’ve been putting off. Walk your city pages and ask whether each says something specific. List every third party publishing on your domain. Pull the last two years of link vendors. Look at your comment and form channels. Write down how AI is used in your content process, because “no matter how it’s created” means using AI is neither the violation nor an excuse for one; what gets judged is whether the pages add value for users.
Questions site owners keep asking
Is a spam update a penalty? Not in Google’s terminology. What people call a penalty is a manual action, applied by a human reviewer and shown in Search Console with a way to request reconsideration. A spam update is an algorithmic improvement to SpamBrain. You won’t be notified and there’s no form to file. You fix the practice and wait for the systems to relearn.
Does the August 2026 spam update target AI-generated content? Google hasn’t said what this update targets. Its standing policy is that appropriate use of AI is allowed and that using AI “with the primary purpose of manipulating ranking in search results” is spam. Scaled content abuse applies “no matter how it’s created.”
How long will the August 2026 spam update take to roll out? Google says “a few days.” March’s took under 20 hours and June’s took two days, so this could be finished by the end of the week, but the dashboard is the only source that will confirm it.
How long does recovery from a spam update take? Google’s documentation says months: changes “may help a site improve if our automated systems learn over a period of months.” For link spam updates, Google says making changes “might not generate an improvement,” because the benefit those links gave can’t be regained.
Should I disavow links after a spam update? Only if you have a considerable number of spammy or low-quality links and they’ve caused, or are likely to cause, a manual action. Google says it can usually assess which links to trust without help.
My Search Console AI report is down. Is that the update? Probably not. Google confirmed a logging error affecting the Generative AI performance report from August 13 onward and says it’s a data issue, not a change in visibility.
What to do this week
Nothing, if your site is clean, beyond noting the date and checking Search Console once the dashboard shows the rollout complete. If your business has been sold any of the practices above, this is the week to find out how much of your visibility depends on them.
The audit that survives every one of these updates hasn’t changed: pages that exist to help a specific person do a specific thing, links you’d have earned without paying for them, and a domain that only carries content you’d put your name on. Our SEO service starts with that audit, and the AI search work sits on the same foundation.
