Google's Spam Updates in 2026: What Counts as Spam Now

The sub-20-hour rollout, and what it means

On March 24, 2026 at 3:20 p.m. ET, Google launched its March 2026 spam update. It completed at 10:40 a.m. ET the next morning - 19 hours and 30 minutes later. By the time most SEO professionals opened their laptops, it was already done.

Today we released the March 2026 spam update to Google Search. This is a normal spam update, and it will roll out for all languages and locations. The rollout may take a few days to complete. Google on LinkedIn - via Search Engine Land

The speed is the story. The December 2024 spam update took roughly seven days. The August 2025 update took nearly four weeks. A 19.5-hour rollout impacting all languages and locations globally points to a system that knew exactly what it was looking for and where to find it. Previous spam updates needed weeks because they were recalibrating broadly. This one had pre-identified targets.

Two facts make this update particularly clean to analyze. First, Google did not introduce any new spam policy categories - unlike the March 2024 spam update, which introduced scaled content abuse, expired domain abuse, and site reputation abuse. The absence of new policies suggests refined detection rather than expanded definitions. The rules have not changed, but enforcement has become more effective.

Second, Google was explicit about exclusions: this update does not target link spam, and it does not target the site reputation abuse policy. That changes the diagnostic calculus for anyone analyzing a traffic drop in that window - and it strongly implies a separate link-spam enforcement wave is on Google's runway for later in 2026.

SpamBrain's growing precision

SpamBrain, Google's AI-based spam prevention system, has been operating since 2018. Google's 2022 webspam report disclosed that SpamBrain was catching five times more spam sites than in 2021, and 200 times more than at launch. One critical advancement: Google now detects spam during the crawling process, instead of after it indexes and processes the pages. That shift from post-index detection to crawl-time detection explains why enforcement keeps accelerating - spam pages are increasingly caught before they ever appear in search results.

Timeline and follow-on updates

March 2026 delivered two distinct updates in the same week. Separating them is the first diagnostic step - they have different fingerprints and require different responses.

• Spam update launched: March 24, 2026, 3:20 p.m. ET (per Google Search Status Dashboard)
• Spam update completed: March 25, 2026, 10:40 a.m. ET (19h 30m total - shortest confirmed spam update in dashboard history)
• Core update launched: March 27, 2026, around 5:14 a.m. ET
• Core update completed: April 8, 2026 at 06:12 PDT (12 days 4 hours total)
• Enforcement ongoing: Google typically refreshes spam models on its own cadence; the link-spam focus area was deliberately skipped this round

The overlap matters for attribution. SE Ranking data on the March 2026 core update found nearly 80% of top-three results shifted positions - significantly more volatile than December 2025. Because the core update began a day after the spam update completed, much of that volatility likely overlaps, with the spam update amplifying disruption in the affected segment.

Who is actually catching penalties right now

The full Google spam policy list runs long - cloaking, doorway abuse, expired domain abuse, hacked content, hidden content, keyword stuffing, link spam, machine-generated traffic, malware, misleading functionality, scaled content abuse, scraping, site reputation abuse, sneaky redirects, thin affiliation, and user-generated spam. But the violations actually catching penalties in 2025-2026 cluster into a few high-risk categories.

The AI content nuance: what Quality Rater Guidelines say

In January 2025, Google added eleven new pages to its search quality rater guidelines, expanding the document from 170 to 181 pages with the changes focused specifically on spam identification. An April 2025 update introduced AI content evaluation criteria, directing human evaluators to identify pages with main content generated by automated or generative AI tools and potentially flag them as lowest quality - but only when the content "lacks human oversight and review." Content that has been edited, fact-checked, and improved by humans does not receive this rating regardless of its origin. Quality rater assessments feed back into SpamBrain's training data. What raters flag today becomes what algorithms catch tomorrow.

Diagnose whether you were hit (this week)

If you saw traffic movement around March 24-25 or March 27 onward, here is the diagnostic sequence. The first three steps are non-negotiable; steps four and five separate operators who recover from operators who guess.

1. Check the dates precisely. Short, sharp drops on March 24-25 are spam-update-related. Gradual movement starting March 27 onward is core-update-related. They require different responses. Pull your Google Search Console performance report at the hourly level if possible, and mark the exact hour the drop began. The 3:20 p.m. ET launch time is your spam-update anchor; the 5:14 a.m. ET launch time three days later is your core-update anchor.
2. Check manual actions in Search Console. Navigate to Search Console > Security & Manual Actions > Manual Actions. If Google issued a specific manual penalty, it will show up here with the violation named. Not every spam hit triggers a manual action - algorithmic penalties do not appear here - so a clean report does not mean you are unaffected. But a dirty report ends the diagnostic immediately.
3. Analyze which pages lost visibility. Use Search Console's performance report to identify the specific URLs or query clusters that dropped. If losses concentrate on pages with thin content, templated structure, or AI-generated copy that lacks editorial polish, that pattern points toward a spam issue. If losses are distributed across high-quality pages with no obvious common factor, that pattern points toward a core update relevance reset.
4. Cross-reference with community volatility trackers. Compare your patterns against Semrush, SISTRIX, or Moz volatility data. The August 2025 update was characterized by SISTRIX as penalty-only, with affected spammy domains losing visibility but no broad ranking changes. Community data lets you distinguish between a site-specific hit and broader SERP turbulence.
5. Be honest about content strategy. A surprising number of sites waste the first few days after an update changing titles, rewriting intros, tweaking internal links, or blaming AI Overviews when the deeper issue is a content footprint full of low-trust signals. Ask the harder question: did the site build rankings in a way Google now sees as manipulative, scaled, deceptive, or low-value? If yes, the answer is structural cleanup, not surface tweaks.

Recovery and the next 90 days

Recovery from a spam update follows a different playbook than core update recovery. Penalties are applied algorithmically, so there is no reconsideration request process for most cases. Instead, recovery depends on fixing the underlying violation, waiting for Google's systems to recrawl and reassess, and demonstrating sustained compliance with spam policies over months - not weeks.

Realistic timelines

• Short-term (1-4 weeks): After you fix the violations, you may see small gains as Google recrawls updated pages. Do not expect full recovery yet. Most "recoveries" reported in this window are partial or coincidental.
• Medium-term (1-3 months): If your changes are broad enough and Google's automated systems accept the cleanup, rankings can improve gradually. The result depends on how deep the penalty ran and how many pages were affected.
• Long-term (3-6+ months): Full recovery from an algorithmic spam penalty often waits for the next spam update cycle, when Google does a fresh pass against newer models. Until then, partial recovery is usually the best-case outcome.

For comparison: many sites hit by the October 2023 spam update did not recover fully until the June 2024 spam update - about eight months later. Google's own documentation states that making changes may help a site improve "if our automated systems learn over a period of months that the site complies with our spam policies." That phrasing is deliberate. It means months, not weeks.

Prepare for the link-spam wave

The March 2026 update's explicit exclusion of link spam is the loudest signal in this whole rollout. If you have any of the following, the 90-day window is to clean them up before a dedicated link-spam update arrives: AI-generated PBN-style outbound or inbound networks, automated guest-post placement networks, link injection from acquired expired domains, and any link campaign that ran in 2023-2025 you have not audited since. Use Search Console's links report and a backlink tool (Ahrefs, Semrush, or Majestic) to map the inbound profile, then build a disavow list for anything that looks scaled, AI-rewritten, or thematically incoherent.

What we are seeing in real accounts

The patterns below are aggregated from content audits we have run for ecommerce and content-publisher clients in the spam-update window. The dominant finding is that the sites most exposed to scaled-content enforcement almost always had two characteristics in common: (1) an AI-assisted content program that was never paired with editorial oversight, and (2) a template-driven page architecture that produced near-duplicate pages with only minor variable substitutions.

Counterexample: a B2B SaaS account in the same audit cohort that uses AI heavily for first drafts but pairs every published piece with subject-matter-expert review, original screenshots, and customer-quote integration saw zero impact from the March 2026 update. Same tool, different intent. That is the distinction Google's policy language is trying to draw, and the data backs it up.

One pattern worth flagging: among sites that did not lose traffic in the spam update but did lose traffic in the core update three days later, the most common shared characteristic was over-reliance on listicle and aggregator formats. Marie Haynes flagged self-serving listicles as a current Google concern; the SE Ranking data showing aggregators getting hit while brands and official sites gained is consistent with that direction.

What we are still watching

Four open questions are shaping how we sequence spam-policy audit work through the rest of 2026.

• Link-spam update timing: The March 2026 update's explicit exclusion of link spam reads as a tell. We are watching for a dedicated link-spam enforcement wave in Q2 or Q3 2026, particularly targeting AI-generated PBN networks and the use of LLMs to rewrite anchor text at scale. Audit your link profile now if you have not in twelve months.
• EU site reputation abuse outcome: The European Commission's November 2025 investigation into whether Google's site reputation abuse policy unfairly targets news publishers is unresolved. There are early signals Google may adjust the policy for EU news sites. If you operate a parasite-SEO-adjacent setup in the EU, watch this closely - the carveout, if it comes, will be narrow.
• SpamBrain crawl-time detection expansion: Google's shift to detecting spam during crawling rather than after indexing has already dramatically shortened rollout times. The next milestone is whether SpamBrain pushes further upstream - declining to crawl at all on signals of low likely value. That would change the threat model for thin and templated sites entirely.
• Spam policies for AI-generated responses: Google updated its spam policies in May 2026 to indicate that attempting to manipulate generative AI responses in Google Search is considered spam, even without a formal spam update being announced. As AI Overviews and AI Mode become bigger surfaces, expect this category to expand and harden through the back half of 2026.