Google Spam Update

What a spam update really is

Strip the label down and a Google spam update is an enforcement event, not a change in ranking philosophy. Google maintains automated spam-detection systems, SpamBrain being the one it names publicly, that classify pages and sites against its written spam policies. Those systems run continuously, but periodically Google retrains them and re-deploys the refreshed classifier across the whole index. That redeployment is what gets announced as a spam update. The distinction that matters operationally: a core update asks whether your content deserves its position, a spam update asks whether your site violates a written policy. The remediation paths are completely different, which makes diagnosing which one hit you the first practical question, not an academic one.

The lineage matters for netlinking specifically. For years, the Penguin filter was the named link-spam system; it was eventually folded into the core algorithm and shifted from demoting sites to devaluing the offending links. SpamBrain inherited and extended that logic: it neutralizes unnatural links continuously, in the background, without waiting for a named update. The consequence is uncomfortable for anyone selling link-removal panic: most purchased links Google identifies are simply ignored, silently, long before any spam update ships. An episodic spam update mostly bites at the site level, when the classifier concludes an entire domain exists primarily to spam.

The visibility data supports reading these as pure enforcement. Sistrix's assessment of the August 2025 spam update described relatively limited aggregate SERP movement but visibility losses concentrated on overtly spammy domains, a « losers rather than winners » pattern. Nobody wins a spam update directly; you inherit positions from domains that got removed. If your curves rose during one, the correct conclusion is that a competitor got caught, not that your links started working harder.

The 2025-2026 cadence: three updates, shrinking rollouts

Between August 2025 and June 2026, Google shipped three confirmed spam updates, and the operational story is in the rollout durations. The August 2025 spam update, announced on 26 August 2025 via Google Search Central, was the first since December 2024. It covered all languages and took just under 27 days to finish rolling out, per Search Engine Land's completion report. Volatility was visible within roughly 24 hours for affected sites, with a second wave of movement reported around 9 September. Google disclosed no affected-query percentage and no target category.

The March 2026 spam update inverted that profile: launched on 24 March 2026, completed on 25 March, less than 24 hours end to end. Google called it a standard spam update, and Search Engine Land's reporting noted that link spam and site-reputation abuse were outside its scope. That detail matters: if you saw movement on 24-25 March 2026 and blamed your link profile, you were arguing against the published record. The June 2026 spam update ran from 24 to 26 June per Google's Search Status Dashboard, again global, again all languages, again with no category disclosed.

Two readings of the shrinking timelines. The generous one: Google's spam infrastructure has matured to the point where redeploying a retrained classifier is a fast, routine operation rather than a multi-week sweep. The more cynical one, which we lean toward: sub-24-hour rollouts suggest these are increasingly refreshes of existing detection rather than new capability, and the announcement is as much a deterrence signal as a technical milestone. Either way, the practical cadence has settled at two to three spam updates a year after an eight-month announcement gap, which means every quarterly reporting window now plausibly contains one. Annotate accordingly.

What Google actually polices in 2026

The reference document is Google's spam policies page, last revised on 15 May 2026. Its link-spam section is blunt: any link created primarily to manipulate rankings qualifies, with explicit examples that read like a netlinking vendor catalogue. Buying or selling links that pass ranking credit. Excessive link exchanges. Automated link creation. Low-quality directories. Keyword-rich anchors stuffed into guest posts and press releases. Footer and template links distributed across sites. Forum comments with optimized anchors. None of this is new doctrine, but the May 2026 revision consolidates it with unusual precision.

The nuance most commentary skips: paid placement itself is not prohibited. The policy's requirement is that ranking credit be blocked, meaning paid links should be qualified with rel=sponsored or nofollow. That is the defensible compliance position for advertorials, affiliate placements and paid digital PR in 2026. Whether a followed paid link gets you penalized or merely devalued is a separate question, and from what we see in audits, devaluation is the overwhelmingly common outcome, but the written policy line is unambiguous.

The bigger doctrinal shift of 2025-2026 sits on the content side. The policy explicitly covers scaled content abuse, defined by volume and intent rather than production method: generative-AI pages become a violation when large volumes of unoriginal pages exist primarily to manipulate rankings while serving little user value. It covers site-reputation abuse, third-party content parked on an established domain to borrow its ranking signals, and circumvention through fresh subdomains, subdirectories or sites. It also states that the policies apply to attempts to manipulate generative-AI responses in Google Search, not just classic blue links. If your risk model for spam updates is still limited to your paid links, it is five years out of date: the enforcement energy has visibly moved to scaled low-value content and parasite hosting.

Reading a hit correctly: annotation before attribution

The most expensive mistake we see after a spam update is attribution without annotation. Before touching your link profile, establish three things: the exact update window from Google's Search Status Dashboard, whether a core update was running in an overlapping window, and whether your measurement itself broke.

That last check is not paranoia. In September 2025, Google disabled the num=100 results parameter that rank trackers relied on, and a September 2025 analysis of 319 websites, widely circulated in the SEO trade press, reported that 87.7% of them lost Search Console impressions and 77.6% lost unique ranking terms in that window. The mechanism was scraper-generated deep-result impressions disappearing, not user traffic vanishing. Any site that read its September 2025 impression drop as a spam-update penalty was chasing a ghost: the tail of the August 2025 spam update and the num=100 removal overlap almost perfectly, and one of the two is a measurement break, not a ranking event.

Then diagnose on clicks over symmetric before-and-after windows, never on impressions alone. A genuine spam-update hit is typically site-wide, fast (movement within about 24 hours of rollout start, per Search Engine Roundtable's August 2025 reporting), and does not recover when you refresh a few pages. Devaluation of specific links, by contrast, shows up as nothing at all in your analytics: the pages those links were supposed to support simply fail to move. If you cannot tie a loss date to a dashboard-confirmed spam window, the honest conclusion is usually that a core update reassessed your quality, and pruning links will not fix it.

Running a link operation through spam updates

For a netlinking operation, the doctrine is boring, and that is the point. What survived the three 2025-2026 rollouts is what looked defensible before them: links placed in real editorial media with their own audience and editorial line, moderate velocity, diversified anchors, and content on both ends that reads as journalism rather than filler. What died is industrial: link farms, expired-domain shells reanimated as link dispensers, scaled AI microsites, parasite subfolders on rented authority.

This is why the structure of your link sources matters more than any metric threshold. A marketplace aggregating thousands of anonymous third-party sites cannot guarantee what any of them will look like to a retrained classifier next quarter; the risk is opacity itself. Operating media in-house inverts that: at Nautilinks, the French editorial media we run in-house went through all three 2025-2026 windows without a site-level event, which we attribute less to cleverness than to the fact that each site is a functioning magazine first and a link host second. The catalogue view that shows exactly which media would host your link exists for the same reason: spam risk accumulates where you cannot see.

Tactically: qualify obviously commercial placements, keep the followed editorial ones defensible on their own merits, resist the reflex to disavow after every announcement, and annotate the dashboard the day Google's status page confirms a window. A spam update should be a non-event for you. If it is not, the problem predates the update.