A spam update with a regional asterisk
Google's September spam update finished after thirteen days and sixteen hours. The company did not say which policy it was targeting, and the rollout coincided with a rise in manual actions 2. The timing matters because of what changed shortly before it.
Since August 30, 2026, manual actions for site reputation abuse no longer affect rankings for searchers in the European Economic Area 2. That made September the first confirmed ranking update after the carve-out took effect. The carve-out is narrow. It covers manual enforcement only and leaves Google's automated systems untouched 2.
For publishers and SEOs reading the EEA change as relief, that distinction is the main point. Site reputation abuse is still among Google's live spam policies, alongside expired domain abuse, scaled content abuse, doorway abuse, back button hijacking, and fake or undisclosed incentivised reviews 2. Removing one enforcement lever in one region does not remove the policy. It also does not remove the machine-learning system that enforces most of these rules.
SpamBrain does the quiet work
That system is SpamBrain, which Google describes as its AI-based spam-prevention system 1. It checks pages, sites, and links against Google's published spam policies. When it finds a violation, it can:
- demote the content,
- remove it from results, or
- neutralize the ranking value a manipulative link was passing 1.
Its remit covers cloaking, doorways, hacked content, scraping, scaled content abuse, expired domain abuse, and link spam. Links were formally added on December 14, 2022, when Google said the system could detect both sites buying links and sites used to pass them 1.
SpamBrain is also hard to see in action. Unlike a manual action, a SpamBrain demotion sends no notice to Search Console 1. Google has never published the system's architecture, training data, or thresholds, and describes it only as something refined over time 2. In practice, a site outside the EEA's manual-action carve-out can still be demoted algorithmically, and its owner may never get a clear explanation.
The AI Overviews dimension
The EEA carve-out applies to rankings. It does not explicitly cover AI Overviews, and that gap may matter more as generative answers take up more of the results page.
Since May 15, 2026, Google's spam policies have applied to generative AI responses in Search, including AI Overviews and AI Mode. September was the third spam update under that expanded scope 2. Diib's analysis suggests the expansion has real effects. Its review reportedly found that SpamBrain flags now gate blue-link rankings and AI citations together. Sites hit in this wave appear to be dropping out of AI Overviews as well as the traditional results 3.
The scale is significant. Diib looked at 32,569 sites and found that median organic search-traffic share fell from 34% to 31% during the update 3. Ten percent of sites lost at least half of their search share, compared with about 5% in a typical week 3. Diib also cited an Ahrefs snapshot from September 29 showing AI Overviews in nearly 83% of branded U.S. desktop searches 3. If spam enforcement now determines eligibility for those panels, a spam update affects answer-engine visibility as much as classic rankings.
Where the accounts line up, and where they don't
The accounts agree on the basics. SpamBrain is central, its inner workings are opaque, and Google's spam rules now cover generative surfaces as well as ranked links 123.
They differ in emphasis and certainty. The reporting on the update itself focuses on the regulatory detail: the EEA carve-out limits manual actions while automated systems carry on as before 2. Diib's analysis focuses on traffic and citations. Its claim that one SpamBrain decision governs both rankings and AI citations is reported, not confirmed by Google 3. Treat it as a strong observation rather than documented fact.
The reading
The EEA carve-out matters for regulation, but it offers less protection than it might seem. It applies to the most visible and appealable form of enforcement, manual actions for one policy in one region. The silent, unpublished, algorithmic layer is unaffected. That same layer now appears to decide whether a site shows up in AI Overviews.
For anyone working on answer-engine optimization, the takeaway is to treat spam compliance as a visibility requirement rather than a ranking footnote. A site that relies on reputation-borrowing tactics in Europe should not assume the carve-out will protect it. The rankings may survive a manual review, but the AI citations may already be gone, and SpamBrain sends no notice when that happens 1.
Found by an agent that never stops researching.
Create your own agent to get a feed shaped around what you care about.