Your SEO Numbers Come From a Supplier You Never Hired

On 26 August 2026, Google confirmed that links in its search results are being rewritten as google.com/goto passthroughs: click one as a human and you land where you expected, read the same page with a script and you get an opaque token. Most of the coverage filed this under “the SEO tools are broken again”, which is the small version of the story. The large version is that every number in your monthly search report arrives through a supply chain, the supplier at the top of that chain has never agreed to supply you, and it has now made its second attempt in twelve months to close the pipe.

TL;DR

• Google now wraps result links in google.com/goto?url=, an encoding that cannot be decoded offline. It is not a block, it is a bill. Nozzle measured 500 to 1,000 requests to resolve one five-page ranking check, against a single request before.
• Google sued SerpApi under DMCA section 1201 in December 2025 and lost its general claims in July 2026. The redirect shipped five weeks after that, with a statement naming no target.
• The precedent is the real lesson: when Google killed &num=100 in September 2025, 87.7% of sites lost Search Console impressions. Those impressions were rank trackers’ bots counted in your first-party data, for years.
• Rankings are vendor-supplied telemetry with a continuity risk, not a KPI. Treat your measurement stack like any other dependency.

What actually changed

Google has wrapped result links before. The old format was google.com/url?q=, with the destination URL-encoded and plainly readable in the query string, so anything parsing the page could strip the wrapper and carry on. The new one is different in kind: the url= parameter uses a Google-specific encoding that is not base64 and cannot be decoded offline. It is an opaque reference to a record in Google’s index, and the only way to learn what it points at is to request the endpoint and read the Location header from the 302 that comes back. One link, one round trip, back to Google.

The rollout is well documented for a change Google never announced: first public sighting by Alex Greenland on 23 June 2026, the pattern documented across organic and paid listings by Brodie Clark on 2 July, and near-total deployment measured across residential IP providers by Derek Perkins of rank tracker Nozzle by 26 August. Google confirmed it the same day, naming nobody: “We have a long history of deploying technical measures against evolving forms of abuse, and we regularly take steps to protect our services and users.”

We went to reproduce it from one of our own servers before writing this. Google returned the enable-JavaScript page and no results whatsoever. The surface everyone’s reporting depends on would not serve us a single result from a datacentre address, which is why Perkins had to measure the rollout from residential IPs in the first place.

It is a bill, not a block

Nothing here is forbidden. The destination URLs are still available and still free. They now cost, by Perkins’s measurement, between 500 and 1,000 HTTP requests to resolve across a single five-page ranking check, where one request previously did the job.

As a deterrent this is considerably better engineered than a prohibition, because it requires no court, no takedown notice and no enforcement budget. It also does not land where Google is aiming. It lands on your vendor’s infrastructure bill, and a vendor absorbing a several-hundred-fold increase in request volume has exactly three ways to pay for it: refresh less often, track fewer keywords, or charge more. Most will do a little of each.

None of it will appear as a line item on your invoice. Your ranking data will simply get slightly staler and slightly shallower inside a dashboard that looks identical to last month’s, and degradation that preserves the interface is the hardest kind to notice.

What Google could not win in court, it shipped as a redirect

The sequence is worth having, stated as sequence rather than causation. Google sued SerpApi on 19 December 2025 under section 1201 of the DMCA, the anti-circumvention provision. On 20 July 2026, Judge Yvonne Gonzalez Rogers dismissed the general claims. SerpApi filed a second motion to dismiss on 24 August 2026. Two days later, Google confirmed the goto rollout. The hearing on that motion is set for 29 September 2026.

For anyone whose product depends on reading a surface they do not own, the lesson generalises well beyond search. Litigation has a docket, a judge and an appeal; a 302 redirect has none of those. When a platform decides the legal route is slow, the engineering route ships on a Tuesday afternoon and there is no motion you can file against it.

The precedent proves your first-party data was never first-party

In September 2025 Google removed the &num=100 parameter, which had let a single request return one hundred results. Rank trackers went from one request per query to ten, and scaled back coverage accordingly.

Then something strange turned up in a place no third-party tool was supposed to touch. Tyler Gargula, director of technical SEO at LOCOMOTIVE Agency, analysed 319 properties and found that 87.7% had lost Search Console impressions and 77.6% had lost unique ranking queries, while clicks stayed flat and average position improved.

Nothing had happened to those websites. Rank trackers pulling one hundred results at a time had been generating impressions inside other people’s Search Console accounts for years, and Google turned the tap off. Search Console is supposed to be the one clean number in search reporting: first-party, straight from the source, no vendor sitting in the middle. It was contaminated by a third party’s scraping, at a magnitude large enough to move nearly nine properties in ten, and the only reason anyone found out is that Google happened to change something else. Every impression baseline, every year-on-year comparison and every visibility chart that spans September 2025 is measuring Google’s anti-abuse posture at least as much as it is measuring your performance.

We made a related argument recently about new domains that get indexed but never shown, where the failure is invisible because no instrument you own distinguishes the two states. This is the sharper version of the same problem. The instruments are not yours.

“No impact” is not the same as “no change”

Vendor responses have been inconsistent, which is itself informative. SE Ranking and Semrush reported no impact on position tracking. Ahrefs acknowledged a temporary data inconsistency with a fix in progress. SerpApi confirmed impact across several products and shipped a fix on 5 September 2026 restoring direct URLs to its API output.

Every one of those fixes is the same fix: follow the redirects. Each of those vendors has absorbed a cost curve that was not in last year’s pricing model, so the useful question is not whether they fixed it but what they are paying to keep it fixed. And a vendor reporting no impact is not telling you nothing changed; it is telling you it already collects data by a route this did not touch, which is a fact about your supplier’s methods you almost certainly could not have stated last week.

Five things to do about it

1. Write down where each number in your search report comes from, and whether you have a contract for it. Most teams, and most agencies, cannot currently answer this.
2. Annotate your charts at September 2025 and August 2026. Two step-changes in the collection layer inside twelve months means any year-on-year search comparison crossing them is not comparing like with like. Annotate it, or stop drawing it.
3. Ask your rank tracking vendor two questions in writing. How are you resolving goto links, and what are your refresh rate and tracking depth today against June 2026? The answers, and the willingness to give them, both tell you something.
4. Move your load-bearing decisions onto data you actually own. Search Console clicks rather than impressions, server logs, conversions, revenue. Rankings are a useful diagnostic. They are a poor KPI, and they were always a poorer one than they looked.
5. Treat measurement vendors as suppliers with continuity risk. Named owner, review date, and a written answer for what you do if the feed degrades or disappears. You already do this for your payment processor. Your reporting stack deserves the same file.

The goto redirect will be routed around, as several vendors have already. What will not be fixed is that the most-cited numbers in digital marketing are extracted from a platform now technically hostile to the extraction, by people who never thought of those numbers as having a supplier at all.

At REPTILEHAUS we build the data pipelines, integrations and reporting layers that businesses make decisions with, and the first question we ask of any dashboard is where each number came from and who else has to stay in business for it to keep arriving. If nobody on your team can answer that for your search reporting, get in touch and we will help you map it.

📷 Photo by Zoshua Colah on Unsplash