Two separate pieces of your measurement stack degraded in the same fortnight, for unrelated reasons, and both of them push your numbers in a direction that looks like a story about performance. Rank tracking data stopped reflecting the SERP. ChatGPT stopped identifying itself as a referrer. If you run a month over month report this week without accounting for either, you will present instrumentation noise to your board as a trend.
Neither of these is a ranking update, and neither is a penalty. That is exactly what makes them dangerous. A spam update leaves fingerprints a practitioner knows how to read. A broken measurement layer produces clean, plausible, confidently wrong charts, and the people reading those charts have no way to tell the difference.
Our position is blunt: for any window that touches late September through mid October 2026, third party position data and analytics channel attribution should both be treated as unverified until you have reconciled them against a first party source. That is not caution for its own sake. It is the only reading the published evidence supports.
What happened to rank tracking data in September and October
Rank tracking data across multiple vendors became unreliable from September 2026 onward, with positions arriving missing, stale or simply wrong, and the problem is a deliberate change in how Google responds to automated SERP collection rather than a bug in any one tool.
The vendor acknowledgements are the part that settles the argument. Sistrix posted a support notice. DataForSEO posted on its status page. SE Ranking said Google rankings were missing positions for some keywords and that most of the issue had been resolved. Advanced Web Ranking and Morningscore both published blog posts about it. When five providers with different crawling infrastructure independently report the same class of failure in the same window, the cause is upstream of all of them.
Practitioners reached the conclusion before the vendors did. Lily Ray said on October 8 that rank trackers are too unreliable at the moment. Robert O'Haver said on October 9 that trackers are off for sure. Marty Eigner put it most plainly on October 10: nothing matches the SERPs. Glenn Gabe documented the divergence twice, once on September 18 when Ahrefs showed a recovery that Semrush showed late and Sistrix did not show at all, and again on October 7 when a site hit by the September 29 spam update dropped in Ahrefs, dropped later in Semrush, and did not drop in Sistrix. Three tools, one site, three different stories.
Note what the Gabe examples do that a vendor status page cannot. They show that the failure is not uniform. If every tool went dark at once you would notice immediately and stop reporting. Instead each tool degrades differently, which means a team using one vendor sees a clean drop, a team using another sees nothing, and both believe their dashboard.
How Google is degrading rank tracking data on purpose
Google is using at least four distinct mechanisms against automated SERP collection, and the newest of them does not block the request but answers it with results that were never shown to a human, which is a categorically different problem for anyone consuming that data.
Derek Perkins of Nozzle described a three pronged approach: wide IP blocking of major residential proxy networks, a significant increase in captchas, and injecting bad data into SERPs it suspects are being scraped. Nozzle's own write up is quoted directly in Barry Schwartz's reporting at Search Engine Roundtable: since September 2026, Google has been poisoning the SERPs it serves rank trackers. Alongside that sit the goto redirects Google began testing in July to identify scrapers, more frequent human verification prompts, and the removal of the num=100 parameter back in 2025.
| MECHANISM | WHAT THE TOOL RECEIVES | WHAT YOUR REPORT SHOWS |
|---|---|---|
| Residential proxy IP blocking | No response, or a challenge page | A gap, or a stale position carried forward from the last successful check |
| Captcha and human verification prompts | A verification wall instead of results | Missing keywords, which most dashboards render as unchanged rather than unknown |
| Goto redirect testing, from July 2026 | A redirect layer the parser has to unwrap | Usually nothing, since vendors describe this as the tractable part |
| Injected or poisoned results, from September 2026 | A complete, well formed SERP that no user saw | A confident, specific, entirely fictional position |
| num=100 removal, 2025 | Only the first page of results | Truncated visibility metrics and distorted share of voice history |
The shape of the poisoning is worth knowing because it is recognisable after the fact. Nozzle found that pages were blocked first and then poisoned, that social sites and forums filled the gaps left behind, and that tracked sites fell out of the top ten. Then it passed within days. If you saw an unexplained one week collapse in September or early October where forum and community results appeared to take over your category and then everything returned to normal with no action on your part, you very likely watched this happen to your own data rather than to your own rankings.
Daniel Skov Jacobsen added a quieter observation on October 9 that deserves more attention than it got: tools increasingly sample rather than count, so a share of daily movement is noise even when nothing is broken. Alex Wolk, reporting months of noisy tracking, concluded that spot checking in incognito is the only method he currently trusts. Dr. Pete Meyers, who has handed off MozCast, noted that Google certainly does not make it easy to maintain. The people who build and watch these instruments are the least confident in them right now.
What changed in ChatGPT referral traffic on October 9
The GPT-6 release stopped ChatGPT from attaching the utm_source=chatgpt.com parameter it had added in June 2026 and stopped it passing a referrer, so visits that arrive from ChatGPT now land in analytics as direct traffic with no surviving evidence of where they came from.
Cedric Huesler of Adobe identified the mechanism and posted it on LinkedIn: GPT-6 opens links with window.open using noopener and noreferrer, and drops the UTM tag. His summary of the consequence is the clearest sentence written about this so far. There is no tag and no referrer, so your analytics files the visit under direct. Chee Lo had flagged the behaviour to Search Engine Roundtable a couple of days before it was written up, and Sébastien Billard reported a sharp drop in ChatGPT human traffic from October 9 alongside a rise in OAI-SearchBot traffic from October 7. Whether OpenAI intended the change is still unclear.
Treat the timing as approximate but the direction as settled. The tag was present in June, it is absent now, and the gap opened in the first half of October. For a quarterly report that distinction barely matters. For a weekly one it matters enormously, because the week of October 6 straddles it.
Huesler's October 9 to 13 sample, roughly 500 pages where ChatGPT drove at least 5 percent of visits, compared with the prior week
The consent banner numbers are the most elegant part of the analysis and the reason it should persuade you. A visitor who sees a consent banner on mobile is probably arriving for the first time. ChatGPT referrals showed that at 55 percent. Direct visits normally showed it at 36 percent, because direct traffic is mostly people who already know you. In the window after the change, direct jumped to 44 percent: the new direct cohort behaves like strangers, not like regulars. That is a fingerprint, not a coincidence.
Why your direct traffic rose without anything improving
A rise in direct traffic during October 2026 on pages that previously earned ChatGPT referrals is most likely the same visitors arriving through the same path with the identifying parameter stripped, which means the increase is a relabelling rather than a gain in demand or brand strength.
This is the failure mode we expect to cause real damage, because the number moves in the flattering direction. Nobody interrogates a chart that says direct traffic is up 18 percent. It gets attributed to brand investment, to the podcast, to the conference, to whatever the team most wants to believe is working. Meanwhile the AI referral line falls, and somebody reasonably concludes that the generative visibility programme is not delivering and should be cut. Both conclusions are wrong, drawn from the same single change, and they reinforce each other.
There is a harder consequence underneath the reporting problem. If ChatGPT referrals land as direct, they are invisible to most attribution models, which means the pipeline they generate is credited elsewhere or to nothing. We have written before about how AI traffic distorts the signals downstream systems learn from, and this change makes that worse rather than better. Any bidding, budgeting or content decision that reads channel performance is now reading a channel mix that is wrong in a known direction.
Which measurement sources still hold up
First party sources that observe your own servers or your own Google property remain trustworthy through both of these failures, because neither depends on scraping a SERP or on a third party passing a parameter it has stopped passing.
That is the whole logic of the reshuffle. Rank trackers broke because they infer the SERP from the outside. Channel reports broke because they depend on a referrer somebody else controls. Anything you observe directly was untouched by both events, which is why the hierarchy below is not a general ranking of data quality but specifically a ranking of what survived October.
| SOURCE | STATUS THROUGH THIS PERIOD | WHAT TO USE IT FOR |
|---|---|---|
| Search Console performance data | Unaffected, Google reporting on its own surface | Trend direction, query level impressions and average position, the reference for ranking claims |
| Server and CDN logs | Unaffected, your own infrastructure | AI crawler activity, OAI-SearchBot and friends, genuine retrieval demand |
| Analytics sessions and conversions | Reliable in total, unreliable by channel | Volume and outcome measurement, not source attribution, for October |
| Analytics channel attribution | Degraded from early October for AI referrals | Nothing load bearing until you have re-based direct traffic |
| Third party rank trackers | Degraded since September, with injected data possible | Corroboration only, never the headline number, never a single day read |
| Manual incognito spot checks | Reliable but unscalable | Verifying a specific contested keyword, which is what Alex Wolk now relies on |
Search Console is the obvious promotion, with one real limitation worth stating rather than glossing: it does not give you click and query data for AI Overviews and AI Mode in the way practitioners want, and its own reporting has had a rough quarter too. We covered the impressions up, clicks down discrepancy earlier this month, and what the generative AI report in Search Console actually measures in September. Promoting it to primary source does not mean treating it as perfect. It means treating it as the least compromised instrument you currently hold.
Log files are the underused answer here. They are the only place you can watch AI retrieval happen without depending on anyone's goodwill about parameters, and they were unaffected by both failures. Most teams we work with on reporting and analytics have log data available and have never once looked at it, which is a strange place to be in a year when every other measurement surface is getting less reliable. Good seo reporting software helps, but the underlying source matters more than the dashboard drawn on top of it.
How to report October without misleading anyone
Reporting honestly through an instrumentation break requires three things: naming the change next to the number it affects, re-basing the affected series from the date of the change rather than smoothing over it, and declining to compare across the break at all where the comparison would not mean anything.
None of that is difficult. What stops teams doing it is the fear that an asterisk reads as an excuse. In practice the opposite is true. A report that identifies an industry wide measurement failure before the client reads about it elsewhere builds more credibility than a clean chart ever did, and a report that quietly claims credit for a direct traffic rise caused by OpenAI dropping a URL parameter destroys credibility permanently the moment anyone works it out.
One caution against overcorrecting. Neither of these failures means measurement is futile or that AI visibility cannot be tracked. It means the cheap proxies got cheaper and the first party sources got comparatively more valuable, which is a sensible thing to have learned. Teams running serious generative engine optimization programmes already report on crawler activity, citation presence and branded demand rather than on a referral line somebody else controls, and those programmes had a quiet October.
See where you are cited today
A free snapshot audit of your rankings and AI citations before we ever talk.
Tyler leads work at the intersection of SEO and generative engines at Something Inc., helping B2B brands get ranked and cited across every major AI engine.