Google finished rolling out its September 2026 spam update on October 8. It ran 13 days and 16 hours, the longest spam update of the year by a wide margin. The three before it wrapped in under three days each (Search Engine Journal).
Most service business owners never saw a headline about it. They just noticed the phone ringing less.
What Google Spent Two Weeks Doing
Google launched the update on September 24, applied it globally across all languages, and said upfront it could take up to two weeks. Google describes spam updates as improvements to its automated systems for detecting spam. It does not say what specifically changed, or why this one needed five times longer than the August version.
Search Engine Roundtable tracked three separate waves of ranking volatility: September 25 to 27, again around September 30, and a final spike from October 4 through October 6. That matters. If you checked your traffic once during the window and things looked fine, you may have checked between waves.
Early traffic data is sobering. Diib analyzed 32,569 sites with Google Analytics connected, comparing unpaid Google search traffic for September 24 to 26 against the same three days a week earlier. The median share of traffic coming from unpaid Google search fell from 34 percent to 31 percent. More telling: the share of sites that lost half or more of that traffic doubled, from 5 percent to 10 percent. Diib called it an early read rather than a verdict, and it does not prove which sites Google actually flagged. Even so, one in ten sites losing half their Google traffic inside a three day window is not statistical noise.
Why This One Hits Service Businesses Harder
Three years ago, a roofing company or law firm or HVAC contractor publishing mediocre web content got mediocre results. Unremarkable, survivable. Then generating 40 service area pages became a fifteen minute job, and a lot of owners did exactly that, often on the advice of someone selling AI content at scale.
Those pages are now the precise profile Google’s spam systems are built to catch: pattern written, thin, interchangeable, with nothing on them proving a real business with real customers and real jobs is behind the words. The business is legitimate. The signals it sends are not.
Here is the part that costs more than rankings. The same quality and trust signals Google uses to demote a site are the ones that decide whether ChatGPT, Perplexity, Gemini and Google’s own AI answers will cite you at all. Those systems lean on sources that already carry structure and standing. Get filtered as low quality in one place and you tend to go quiet across all of them at once, which is a much harder problem than a ranking dip. Meanwhile the competitor who built fewer, better, properly structured pages did not simply hold position. They absorbed the share you dropped, and in AI answers that share does not get split ten ways. It usually goes to two or three names.
What Decides Who Survives the Next One
There will be a next one. Google shipped spam updates in March, June, August and September of this year alone, and each round sorts the same way.
What separates the sites that hold from the sites that fall is not luck, and it is definitely not content volume. It comes down to a handful of things that only work in combination:
- Whether your site is machine readable, meaning an AI system can parse what you do, where you do it and who you serve without guessing
- Entity clarity, so Google and the answer engines understand your business as one consistent, verifiable thing across your site, your profiles, your citations and your schema
- Real authority signals, the kind that come from being referenced by sources that already have standing in your category
- Reviews and reputation data that are current, structured and actually readable by machines rather than trapped in a widget
- Structured data that matches your real offers, service areas and locations instead of quietly contradicting them
Any one of these moves the needle a little. Together they are the difference between being the business an AI recommends by name and being the business it has never heard of. That is systems work, not a Saturday afternoon checklist. It means diagnosing what signals your site sends today, correcting the ones that are wrong or missing, and maintaining them as the engines keep moving. You can see how we approach it, what it has produced for other service businesses, and what it costs.
Andy Rodriguez is the founder of Agentic Growth Engine, where he helps service businesses across the US get found, cited and recommended by AI search.
Before the Next Update, Find Out What the Engines See
When someone asks ChatGPT or Google’s AI who to call in your market, does it name you or the company down the road? Almost no owner has actually checked, which is why a spam update can quietly reshuffle an entire local market before anyone notices. Run the free AEO and SEO visibility audit and see exactly what the engines currently know about your business, what they are getting wrong, and where your competitors are being recommended instead of you.