On 18 August 2026, Google began rolling out the August 2026 Spam Update. It is the third spam update of the year, and like the June one before it, Google published almost nothing about what changed. That silence is normal, and it is also why the week after a rollout fills with confident explanations from people who cannot possibly know yet.
Here is what is actually knowable, and what a site owner should do with it.
Spam updates are not core updates
This distinction matters more than most coverage admits. A core update reassesses quality and relevance across the whole index. A spam update enforces the Google Search spam policies, which is a narrower and more specific list: scaled content abuse, site reputation abuse, expired domain abuse, cloaking, hidden text, link schemes.
If you have not done any of those things, a spam update should not move you much. If your rankings dropped anyway during the window, the more likely explanations are a competitor gaining ground, an unrelated daily algorithm change, or something that broke on your own site.
The AI content angle
In May 2026 Google clarified that its spam policies extend to attempts to manipulate generative AI responses, including AI Overviews and AI Mode. That clarification has not been formally tied to this rollout, and nobody outside Google can confirm the link. What it does tell you is the direction of travel.
The policy line has never been about whether a machine helped write something. It is about scaled content abuse: producing pages at volume, with no added value, for the purpose of ranking. A hundred thin service area pages generated from a template hits that definition whether a human or a model typed them. A carefully researched article that a model helped draft and a human edited does not.
The practical test we apply on client sites is simple. If a page were removed tomorrow, would anyone miss it? If the honest answer is no, that page is a liability during a spam update, not an asset.
Site reputation abuse is still the quiet killer
This one catches legitimate businesses by accident. Site reputation abuse covers third party content published on your domain to borrow your authority. The obvious version is a coupon subdirectory rented out on a news site. The version we see on small business sites is subtler: a guest posting arrangement that got out of hand, a directory section a marketing agency added years ago, an old subdomain nobody has looked at since 2021.
Go and look at what is actually indexed on your domain. A site: search on your own domain, scrolled to the end, surprises people more often than it should.
How to tell if this actually hit you
Open Search Console, not your analytics dashboard. Set the date comparison to the fortnight before 18 August against the fortnight after, and compare impressions rather than clicks first. Impressions tell you whether Google changed how often it shows you. Clicks tell you whether people changed their behaviour, which in 2026 is often an AI Overview story rather than a ranking story.
- Impressions flat, clicks down. Not a spam update. Look at whether AI Overviews now appear on your top queries.
- Impressions down across the whole site. Site wide signal. Worth taking seriously.
- Impressions down on a specific section only. Look hard at that section. It is usually the templated one.
- Nothing meaningful moved. This is the most common outcome and it is fine.
What not to do this week
Do not mass delete pages. Do not disavow links on a hunch. Do not rewrite your homepage. Spam update rollouts take days to weeks to complete, and reacting to partial data during a rollout is how site owners turn a small dip into a real problem.
Wait for the rollout to be confirmed complete on the Google Search Status Dashboard, then read a fortnight of stable data, then act. Structured, well sourced pages are also what tends to survive, which is the same ground covered in getting cited in AI answers. If you did nothing against the spam policies, the correct response is usually to keep publishing and improve the pages that were already weakest.
The thing worth doing regardless
Spam updates reward sites that would have been fine anyway. The work that protects you is unglamorous: fewer pages that each deserve to exist, clear authorship, real evidence, and a technical setup that lets Google read all of it. That is the same work that gets a page cited in an AI Overview, which is increasingly where the visibility went.
If you want to understand the click side of this rather than the ranking side, our piece on why traffic falls while rankings hold covers the measurement problem in detail.
Frequently asked questions
When did the August 2026 spam update start?
Google began rolling it out on 18 August 2026. Spam updates typically take anywhere from two days to a fortnight to fully complete, and Google confirms completion on its Search Status Dashboard rather than announcing it separately.
Does the spam update penalise AI written content?
Not by itself. The relevant policy is scaled content abuse, which targets producing many pages with little value for the primary purpose of ranking. A single well researched article that a model helped draft and a human edited and fact checked does not meet that definition. Two hundred near identical location pages do, regardless of who typed them.
How do I know if I was hit by the spam update or a core update?
Check the Google Search Status Dashboard for what was actually running during your drop window. Spam updates tend to produce sharp, section specific or site wide drops for sites violating a specific policy. Core updates produce broader reshuffling across many sites in a niche. If you cannot map your drop to a named policy, it is probably not the spam update.
How long does it take to recover from a spam update?
If the issue is a genuine policy violation you have fixed, recovery usually waits for a subsequent update rather than happening as soon as the fix is live. That can be weeks or months. This is why reacting quickly matters less than reacting correctly.
Should I disavow links after a spam update?
Almost never. Google has said for years that it ignores most low quality links rather than penalising for them, and the disavow tool is intended for sites that know they built unnatural links or received a manual action. Using it defensively on links you did not build is more likely to hurt than help.