Google Spam Policy Changes in 2026: What UK Websites Must Know

Google has tightened its spam rules on several fronts in 2026. It ran four spam updates, the latest finishing on 8 October 2026. It made back button hijacking a spam violation from 15 June. It extended its spam definition to attempts to manipulate AI answers. And from 30 August, it stopped applying site reputation abuse manual actions to searches in the European Economic Area (EEA), a change that does not cover the UK. For UK websites, the rules are now stricter at home than across the Channel.

What happened

Four spam updates in 2026

Google's Search Status Dashboard records four spam updates this year:

The September update took about two weeks, much longer than the one-to-three-day rollouts earlier in the year. Google said it "applies globally and to all languages" and confirmed that "the rollout was complete as of October 8, 2026". Google did not name specific targets for these updates. Search Engine Roundtable reported that the June update did not target link spam or site reputation abuse.

Spam now includes manipulating AI answers

On 15 May 2026 Google changed the opening definition on its spam policies page. Spam now covers "attempting to manipulate generative AI responses in Google Search" as well as attempts to rank content highly. Google's changelog said the aim was to make "it clear that the spam policies apply to all of Google Search, including generative AI responses". The policies themselves did not change. Tactics such as scaled content abuse, cloaking and link spam now explicitly count when aimed at AI Overviews and AI Mode.

Back button hijacking became a violation

On 13 April 2026, Google's Search Quality team announced that back button hijacking would count as a violation of its "malicious practices" policy. This means interfering with browser history so visitors cannot return to the page they came from. Enforcement began on 15 June 2026. Affected pages "may be subject to manual spam actions or automated demotions". Google noted that the behaviour often comes from included libraries, imported code or advertising platform configurations, not from the site owner's own code.

Site reputation abuse: different rules in the EEA

Site reputation abuse, sometimes called parasite SEO, is when third-party content is published on a host site mainly to exploit that site's ranking signals. Think of a news site hosting unrelated voucher-code or casino pages. On 13 November 2025 the European Commission opened a Digital Markets Act investigation into whether Google's enforcement unfairly demoted publishers. Google's Pandu Nayak called the probe "misguided".

On 28 August 2026, "following discussion with the European Commission", Google announced that from 30 August, "for users inside the EEA, the impact of the manual action will not apply". Inside the EEA, the affected section may instead be separated in Google's systems so it ranks on its own. Outside the EEA, a manual action still directly affects the flagged part of the site. Site owners everywhere are still notified in Search Console and can request reconsideration.

What this means for UK businesses

The UK is not part of the EEA. Google's documentation says that outside the EEA, pages violating the site reputation policy "may be subject to a manual action when they appear in Search results". So a UK publisher or business that hosts third-party sponsored sections still faces the full penalty for searches made in the UK. If your site also serves EEA audiences, the same pages could behave differently in, say, Dublin than in Belfast.

The other changes affect a wider range of UK sites:

• Ad-heavy sites are exposed to the back button rule. Publishers, recipe sites and comparison sites using aggressive ad or "recommended content" scripts should check that nothing rewrites browser history.
• "AI SEO" tactics carry risk. Agencies offering to get clients into AI Overviews through mass-produced pages, self-serving "best of" lists or hidden text could now trigger spam actions. These are tactics that "attempt to manipulate generative AI responses".
• Spam updates are getting longer. A two-week rollout makes it harder to tell a spam update apart from a core update or a seasonal dip.

What to do now

1. Check Search Console for manual actions. Look under Security & Manual Actions. If you have one, fix the issue and submit a reconsideration request.
2. Audit third-party sections. List any sponsored, partner or white-label content hosted on your domain. Ask whether it is there to serve your audience or to borrow your ranking signals. If it is the latter, remove it, noindex it or move it.
3. Test the back button. Visit your key landing pages from a Google result on mobile and desktop, then press back. Review any ad network, pop-up or "recommended content" scripts, especially ones added recently.
4. Know what scripts you load. MakeItFlow detects the technologies and third-party services running on your site, and checks security headers such as Content Security Policy, which limit which scripts can run. Run a free website audit to see what loads on your pages.
5. Review content made for AI rather than for people. Pages produced at scale or written to influence AI summaries rather than to inform readers are a risk. Consolidate or improve them.
6. Rule out hacked spam. Injected spam pages and links can trigger penalties even though you did not create them. MakeItFlow checks for exposed .env and .git files, a common way in for attackers. Our guide to the signs your website was hacked covers other symptoms.
7. Log update dates against traffic. Keep a simple record of Google's update windows next to your analytics so you can attribute changes accurately.

Frequently asked questions

Does the EEA change to site reputation abuse apply in the UK?

No. Google's change applies to searches made by users inside the European Economic Area, which does not include the UK. For searches in the UK, manual actions under the site reputation policy still affect visibility for the flagged section of a site.

Is optimising for AI Overviews now against Google's rules?

No. Google's 15 May 2026 change clarified that its existing spam policies apply to AI responses. Creating helpful, well-structured content that Google chooses to cite is not spam. Manipulative tactics, such as scaled low-value pages, cloaking or hidden text designed to influence AI answers, are.

My site uses an ad network that might hijack the back button. Am I responsible?

Yes, in practice. Google says the behaviour often comes from libraries, imported code or ad configurations, but the penalty applies to the page that shows it. Review your ad settings with your provider and remove any script that manipulates browser history.

Related reading

• Adobe Completes Semrush Deal: What It Means for SEO Teams: Adobe closed its $1.9bn Semrush acquisition on 28 April 2026. What it means for the SEO tools agencies and in-house teams use, and what to check now.
• Google Updates Its User-Generated Spam Guidance: What Sites Should Change: Google updated its user-generated spam guidance on October 26, 2026: keep share links and new users' pages out of the index and watch Search Console for abuse.

Sources

• Google Search Central: Spam policies for Google web search
• Google Search Central blog: site reputation policy update for the EEA (28 August 2026)
• Google Search Central: Introducing a new spam policy for "back button hijacking" (13 April 2026)
• Google Search Status Dashboard: ranking incident history
• Search Engine Roundtable: Google spam policies apply to AI responses
• TechCrunch: EU launches antitrust probe into Google's anti-spam policy (13 November 2025)