Most small businesses learn about a Google update weeks after it happened, from a line on a traffic report that dipped in a month nobody can explain. By then the useful part of the story is gone. The update Google released in August is worth catching while it's still fresh, because what it enforces isn't a surprise and the response to it isn't complicated. This post covers what actually rolled out, which sites tend to gain and lose when one of these lands, and why the recovery timeline is the part most people get wrong.
Google announced the August 2026 spam update on 18 August and recorded it as complete two days and sixteen hours later [Google Search Status Dashboard, 2026]. It applied globally and to every language. There was no accompanying blog post, which is normal for this kind of release and is also where most of the guesswork comes from.
What Google released in August, and what it didn't
A spam update isn't the same thing as a core update, and the difference decides what you do next. A core update changes how Google weighs quality across the board. A spam update improves the systems that catch specific, named violations, which Google runs through SpamBrain, its automated spam-detection system that looks for the fingerprints of manipulation rather than judging quality. Nothing new became against the rules in August.
It was the third spam update of 2026 and the slowest of the three, though none of them are slow by the standards of a core update, which routinely takes a fortnight. The pattern is worth seeing together.
| Update | Started | Rollout duration |
|---|---|---|
| March 2026 spam update | 24 March 2026 | 19 hours, 30 minutes |
| June 2026 spam update | 24 June 2026 | 2 days, 1 hour |
| August 2026 spam update | 18 August 2026 | 2 days, 16 hours |
The list of what counts as spam hasn't changed and is published in full on Google's own site. It covers cloaking, doorway abuse, expired domain abuse, hacked content, keyword stuffing, link spam, scaled content abuse, scraping, site reputation abuse, sneaky redirects, and thin affiliation, among others. One line in that document did change earlier this year.
On 15 May Google updated the policy to make clear that the rules apply to "all of Google Search, including generative AI responses" [Google Search Central, 2026]. The page now defines spam to include attempting to manipulate those responses, which puts the summaries at the top of a results page under the same rules as the results themselves. August was the first full enforcement cycle with that sentence in place. Google didn't say the two were connected, and we won't pretend otherwise.
Who gains ground when a spam update lands, and who loses it
Spam updates don't hand out rewards. They remove sites that were ranking on manufactured signals, and everyone underneath moves up a place. That's the entire mechanism. If your local HVAC company, dental practice, or specialty grocer gained three positions this month without doing anything at all, the likeliest explanation is that somebody above you was removed.
The sites that lose ground share a pattern rather than an industry. Operations publishing hundreds of near-identical pages generated at volume fall under scaled content abuse, businesses that bought an aged domain for its history rather than its content fall under expired domain abuse, and the coupon sections and sponsored review directories rented inside newspaper sites fall under site reputation abuse. None of those are edge cases. They're what a lot of cheap search packages are quietly built from.
This is worth saying plainly, because the businesses caught by it usually aren't the ones who did it. A restaurant, a law office, or a flooring contractor who hired an agency in 2024 has no practical way to see whether the links in their monthly report were earned or bought, and no reason to suspect the difference matters. The violation belongs to the site either way.
The sites that gain are duller to describe. They publish things only they could publish, meaning their own pricing, their own service area, and photographs of their own work, and the links pointing at them exist because somebody chose to point at them. That's less a strategy than an absence of shortcuts. It's also the only position that survives an enforcement refresh without needing to know one is coming.
Why the recovery clock is measured in months
Google is unusually direct about this part. Its documentation says that making changes "may help a site improve if our automated systems learn over a period of months that the site complies with our spam policies" [Google Search Central, 2026]. Read the verb. The systems have to learn, which means observing a corrected site repeatedly over time before anything moves.
So a site that lost visibility on 19 August isn't coming back in September, however fast the cleanup happens. That's uncomfortable to tell an owner watching enquiries dry up. It's still better than the alternative, which is billing them for three months of work while implying the next refresh will sort it out.
There's a harsher clause for link spam specifically. Google says that once its systems remove whatever effect spammy links were having, any ranking benefit those links previously generated for the site is lost, so taking them down restores nothing [Google Search Central, 2026]. You don't recover that ground. You rebuild from where you're standing now.
Working out which of these applies to a particular site is a records exercise before it's a technical one, covering what was published, when, and who was paid to point at it. That audit is where our search visibility work starts rather than where it ends, because there's little sense optimising a page that's being held down by something bought four years ago.
One category on the list catches sites whose owners bought nothing at all. Hacked content covers spam pages quietly injected into an otherwise legitimate site, which happens often enough on unmaintained WordPress installations that it's worth ruling out before blaming an agency. Locking the site down is the cheap half of that.
If your traffic moved this month, start with the calendar
The one thing worth doing this week costs nothing. Open Search Console, take your baseline from before 18 August, and compare it against data from 22 August onward. The rollout window itself is noise, and averaging across it hides whatever actually happened.
The broader point outlasts this particular update. Enforcement is continuous and quiet now, arriving three or four times a year with no explanation attached, and the only durable defence is having nothing to enforce against. For most local businesses that's a lower bar than it sounds, because they were never doing any of this themselves. The exposure is almost always something bought on their behalf.
It sits alongside a change we've written about before, where answer engines take the click before a site ever loads. Different mechanism, same shape on the traffic report. If you'd like someone to look at what's actually pointing at your site before the next refresh lands, we're glad to take a look.
Sources
Google Search ranking updates, Google Search Status Dashboard, for the start dates and rollout durations of the March, June and August 2026 spam updates. Spam policies for Google web search, Google Search Central, for the full list of policy categories and the definition covering generative AI responses. Google Search spam updates, Google Search Central, for SpamBrain and the recovery wording. Google Search documentation updates, Google Search Central, for the 15 May 2026 changelog entry.
