Welcome to our April Digital Digest!
If you’re having deja vu, don’t worry – we are too! ‘Another month, another Google Core Update’ might be the unofficial motto of 2026, but this month the search platform has outdone itself with 2 updates since March 24th alone.
We’re also taking a look at the growing cyber security threat posed by AI, and what the UK government intends to do about it, so let’s get straight into the facts you need to know.
The March 2026 Updates
Google’s most recent updates have finished rolling out as of April 8th.
Google’s latest Core Update began rolling out on March 27th and concluded on April 8th, well within its estimated 2-week timeframe. Labelled as a “regular update”, it was also the first broad core update of the year, but was announced without any official guidance, goals, or changes to Google policy.
Just two days earlier, the March 2026 spam update completed its rollout in 20 hours, officially making it the shortest spam update in Google’s history. As is the case with the March 27th update, no new policies were released, but with three confirmed updates since February it’s safe to assume that websites will be experiencing at least some volatility in the aftermath.
Google recommends waiting at least a full week after a core update has finished rolling out before analysing its impact on traffic, visibility, and rankings. Any changes should be evident now, so take a look at your performance and don’t forget to request indexation for any pages that have been affected by the March updates.
From Participants to Viewers
Social media users are posting, sharing, and engaging less year-on-year.
In our February Digital Digest, we looked into the ongoing shifts in social media engagement and found that the average user now spends only 17% of their time on Facebook viewing content posted by friends and family, and just 7% on Instagram.
According to a recent Ofcom survey, this decline in user engagement is not solely due to the amount of AI and creator-generated content present on these platforms. Whilst it is believed that over 70% of social media content is now AI-generated, the number of adults posting, commenting, and sharing content has also fallen rapidly over the past 12 months.
Last year, 61% of UK respondents said that they actively post on social platforms – this year, that number is down to 49%. Users are widely favouring a passive approach to sharing online, and the argument could be made that this shift in behaviour was always inevitable. With social media becoming less about social interactions and more about algorithmic entertainment, users are now less incentivized to post, react, and engage, instead preferring to view and consume in private.
Back Button Hijacking Banned
Google is updating its Spam Policies to address the rising issue of back button hijacking.
Google’s Spam Policies are a rogue’s gallery of all the spammy, misleading, and even downright devious techniques used to manipulate users and search rankings. Policies such as ‘scraping’ (republishing, reproducing, or copying content from other sites), ‘redirecting’ (sending users to a different, often spam, URL), and ‘link spam’ (selling, buying, or implementing excessive, low-quality links) are all permanent features on this page, and now they’re joined by a new one; back button hijacking.
This newly prohibited practice is defined as preventing a user from using the back button to exit a page or return to the previous one by interfering with their browser navigation. This action may instead result in the user being redirected to a new page, or presented with ads, which Google now considers to be a direct violation of their Malicious Practices policy.
The platform published this new addition to their Spam Policies on April 13th and included a warning to site owners that, as of June 15th, this practice will be penalised. Any sites or pages found to still use back button hijacking will be issued with a spam penalty from Google, either manually or automatically, so take this advanced notice to assess your own site and make sure you’re not in violation of any of Google’s Spam Policies.
The Threat of AI
Should organisations fight the threat of AI with AI? The experts have their say.
In the past month alone, the chief executive of the National Cyber Security Centre (NCSC) and the CEO of Google have publicly weighed in on the dual role of AI in global cybersecurity. Google CEO Sundar Pichai touched on the new use of AI to locate and exploit vulnerabilities in websites, and mentioned that AI models likely already have the potential to break ‘pretty much all’ existing security software.
Speaking at the annual CyberUK conference, NCSC chief executive Richard Horne agreed that AI models can be used to hack sites at rapid speed and vast scale. However, he also introduced a counter approach; one in which the UK embraces AI as a means to identify and address these gaps in security before hackers can.
Existing AI models, including the newly launched Mythos, are already capable of uncovering software vulnerabilities at speed, yet continue developing at unprecedented rates. Embracing AI as a means to defend against cyber attacks would allow organisations to utilise the very systems that might otherwise be used against them, but what exactly does this look like in practice? Only time will tell.
Cabinet Correspondence on Cyber Threats
‘AI cyber threats: open letter to business leaders’ published by the Cabinet Office.
Whether they’re used for reconnaissance, testing, or active infiltration, there’s no denying that the use of AI models in hacking is a very real threat. Horne asserted that defending against AI cyber attacks requires ‘every organisation embedding cybersecurity into their corporate mission’ – a call to action that is echoed in a recent open letter from the Cabinet Office.
Authored by the Secretary of State for Science, Innovation and Technology and the Minister of State for the Cabinet Office, the letter aims to alert all businesses in the UK to the threat posed by advanced AI models. It detailed the acceleration of AI cyber capabilities, including the concerning revelation that these are doubling every 4 months, rather than every 8 months as was previously believed, and that this trajectory is set to continue over the next year.
In order to maintain collective resilience, the letter asserts that ‘every business in the UK has a part to play’, and that now is the time to prepare our national digital infrastructure for AI attacks. We explore this ever-evolving threat – and what exactly you can do about it – in our blog.
The Digital Digest
If you want to discuss any of the developments mentioned in this months’ Digital Digest in more detail, then we are here to help.
Give us a call on 0121 308 0219 or fill in our online contact form, and don’t forget to check out our full blog for more information.
