On August 26, 2026, Google officially confirmed: links in search results no longer lead directly to the website. Instead of the page address in HTML, there is a redirect in the form of google.com/goto?url=... with an encrypted token. The most unpleasant aspect of this situation is that the substituted links do not reach everyone. An ordinary person in a browser sees direct URLs. They are hidden specifically from those whom Google has already classified as automation.
What Exactly Happened
Initial isolated signals appeared as early as June 23, 2026 — noted by Alex Greenland. On July 2, Brodie Clark recorded the phenomenon on a large scale. And on August 26, Derek Perkins, CEO of the position tracking platform Nozzle, reported near-complete rollout, which Google confirmed officially.
The wording from the company representative for Search Engine Roundtable was notably vague: Google has a "long history of applying technical measures against evolving forms of abuse," and the company "regularly takes steps to protect its services and users." They did not specify who exactly is considered abusive.
The mechanics are simple and therefore painful. Previously, the result markup contained a ready address — the parser retrieved it along with the title and snippet in one request. Now there is a link to an intermediate Google redirect, and inside is a protobuf token: a base64 string with the prefix CAES, followed by an encrypted payload. It is impossible to decrypt it on your side — you do not have the key. The only way to find out where the link leads is to follow it.
Three Details That Determine the Cost of the Issue
- The token is one-time use. The same link to the same page for the same request receives a new token with each display. It will not be possible to build a directory "token → URL" and reuse it.
- HEAD does not help. A HEAD request returns 200 without a Location header — that is, without a destination address. A full GET is needed, which returns 302 with a median delay of about 59 ms.
- Not only the organic core is affected. Hidden addresses appear in regular results, videos, AI Overviews sources, the "Related Questions" block, and in ads (addresses
aclk). In a study by Growtika, 493 links across eight queries were analyzed — each concealed the destination address.
The arithmetic is unpleasant. According to Perkins, to resolve all links for five pages of results for one query, between 500 and 1000 requests are needed. An independent measurement by scraping.club after deduplication gives a more modest 295–565 — but this is still two orders of magnitude more than the one request that was previously sufficient.
A key quote from Perkins describes the essence of the shift better than any numbers: the binding constraint is no longer bandwidth or storage, but rate limits.
Why This Is a Blow to Automation
Here lies the most interesting part. According to observations from scraping.club, the substitution of links is not universal: an ordinary user — logged in or in incognito mode — still receives direct URLs. Redirects consistently reach automated clients: scripts that launch a browser with flags like --remote-debugging-port, and headless stacks with full automation.
The practical conclusion to understand before you start rewriting the parser is: the appearance of goto links in your response is a diagnostic signal. It means that Google has already classified your client as a bot. You have not encountered a new format of results — you have seen what the results look like for someone who has been detected. And the first thing to fix is not the link parser, but the characteristics that distinguish you from a human: launch flags, header order, TLS fingerprint, page behavior. We discussed the methodology for such self-checking in the article on how to remove the site detection map based on its scripts.
An amusing detail that confirms this theory: the Google redirect resolution itself is almost unprotected. According to measurements by scraping.club, no proxies, special headers, or TLS impersonation are needed to follow the link — a regular requests library performs just as well as a spoofed Chrome, and at low volumes, 110+ requests per second are achievable without visible restrictions. This means the barrier is neither cryptographic nor network-based. It is a tax on volume: you are not blocked; you are simply billed in requests.
The Second Blow in a Row
This change should not be read in isolation from the previous one. From September 12 to 14, 2025, Google disabled the parameter &num=100, which provided a hundred results on one page. After that, about ten times more requests became necessary for the same depth of results.
The consequences have been noticeable far beyond parsing. According to an analysis of 319 properties conducted by Search Engine Land, 87.7% of websites lost impressions in Search Console, and 77.6% lost part of their unique ranking queries. Real traffic did not change — the measurement broke: the lion's share of "impressions" at distant positions was generated not by people, but by trackers pulling a hundred results.
Combining the two steps: first, the cost of results increased tenfold in terms of the number of requests, and now each result has an additional request for its address. The strategy is clear — Google is methodically raising the cost of industrial scraping of its own results.
The legal backdrop is also telling. Technical measures were implemented precisely when the judicial path faltered: Google's lawsuit against SerpApi under the DMCA was dismissed — the court drew a line between the protection of copyrighted works and the regulation of access to publicly available facts, stating that facts and URLs are not works. We discussed the details of this ruling and its implications in a separate article about the case of Google vs. SerpApi. They could not prohibit it — but they made it expensive.
What Is Breaking in Reports Right Now
The DemandSphere platform listed specific breakdowns that occur if no action is taken:
- The destination domain collapses into google.com. The parser honestly records what it sees in the markup — and the entire output becomes "owned by Google."
- Matching of your own pages breaks down. The system stops recognizing your URLs and assumes you have dropped out of the results.
- Vote share and attribution of competitors are skewed — there is nothing else to count, all links are on one domain.
- The historical series breaks exactly on the rollout date. This is the most insidious: the graph will show a collapse that did not actually occur.
The good news is that purely positional data suffers less. DataForSEO reported on July 5, 2026, that 99.99% of organic results through its API are already returned with direct addresses. The problem concentrates in the blocks of results — according to Growtika's estimate, goto links are preserved in about half of AI Overviews and a quarter of local blocks. This means that what is most important today is suffering: sources of AI responses and local results.
How to Restructure Collection
The engineering conclusion from all of the above is to split the collection into two layers with different request costs.
- First, check if you have been detected. Retrieve the same results with your parser and manually from a clean browser. Direct links in manual runs and goto in automated runs are a death sentence for your masking, not a property of Google.
- Separate the collection of results and the resolution of links. The first layer is heavy: rendering, behavioral plausibility, quality IPs. The second is a primitive GET for 302, without a browser and without impersonation. Running resolution through the same expensive stack is wasting the budget.
- Count limits, not gigabytes. The bottleneck has shifted to the number of requests. Plan your pool of addresses based on required RPS, not traffic volume.
- Do not attempt to cache tokens. They are one-time use. It makes sense to cache the result of the resolution — the combination of "request + position + domain," not the token itself.
- Mark the break date in historical data. August 26, 2026, should stand out in reports as a clear milestone; otherwise, methodological errors will be interpreted as a drop in visibility.
- Check blocks separately. Organic results may already be fine, while AI Overviews and local blocks may not be. Test them as separate entities.
Which Proxies and Where
The separation into two layers also implies a separation of infrastructure — and this is noticeably cheaper than running everything through one pool.
Collecting the results themselves is the most sensitive part. It is important not to stand out from ordinary users, and this layer determines whether you will see direct links or goto. For this, residential proxies are used, and for geo-dependent tasks like local results — mobile proxies, where the IP looks completely natural for a specific region.
However, the resolution of redirects, as measurements have shown, does not impose any special requirements: a regular GET, no impersonation, high speed. This is a classic task for data center proxies — cheap, fast, and capable of handling many parallel streams. The cost difference between the two approaches, with 500–1000 additional requests per search result, becomes a decisive budget item.
Conclusion
Google has not closed access to the results — it has made it more expensive and simultaneously turned the response format into a detection indicator. For the market, this means a continuation of the course initiated by the disabling of &num=100: mass scraping of search data is no longer cheap by default and becomes an engineering task with clear economics.
Practically, the conclusion boils down to two points. If you see goto links — start with masking, not with the parser: it is possible that what needs fixing is not what it seems. If the masking is fine, but redirects are still present — separate the layers of collection and do not pay a premium price for requests that do not need it.