Google Confirms New goto Redirects Break Search Scrapers

Google confirmed on Aug. 26 that Search is replacing direct result links with server-side redirects through google.com/goto, a mechanism the web-scraping company Autom says it first documented in a blog post explaining the encoding after noticing the pattern turn up consistently in logged-out and private-browsing sessions in late August.

Google's statement, given to Search Engine Roundtable on Aug. 26 and quoted in full by Relevant Audience's write-up of the confirmation, did not name scrapers, AI companies or rank trackers as the target: "We have a long history of deploying technical measures against evolving forms of abuse, and we regularly take steps to protect our services and users." Antonio Fernandez, Relevant Audience's founder and chief executive, wrote that Google had not said which class of tool it was responding to.

What changed in the link itself

Under the format Google used until this rollout, a result's underlying address sat in a readable q= parameter inside a google.com/url link, so any tool parsing the results page's HTML could pull out every destination in one request. The new /goto links carry what Relevant Audience describes as a Tink-encrypted protobuf blob in a parameter it calls a CAES token, one that correlates with the length of the destination URL but cannot be decrypted without a key Google does not share. The actual destination now appears only in the HTTP Location header of the redirect itself, which means reading it takes a second request per result instead of zero.

	google.com/url (old)	google.com/goto (new)
Destination in page HTML	Yes, in q= parameter	No
Requests to map one results page	1	1 per result
Encoding	Plain URL-encoding	Tink-encrypted protobuf

How fast it rolled out

Derek Perkins of the rank-tracking company Nozzle told Relevant Audience he was seeing "nearly a 100% rollout across several residential ip providers" by the time of Google's confirmation, with a single results page now carrying hundreds of /goto links that each need resolving individually. Autom's own post frames the change as one entry in a longer pattern of anti-scraping moves, alongside Google's earlier removal of the &num=100 parameter that let a single request return 100 results instead of 10, and continued work on its BotGuard and SearchGuard detection systems.

What Autom is doing about it

Autom said it updated its own Google Search API pipeline to follow the /goto redirect with an HTTP HEAD request, read the Location header and return the resolved destination in the same response fields its customers already used, absorbing the extra request on its own infrastructure rather than passing the cost downstream. That fix works today, but it depends on Google continuing to answer HEAD requests the same way it answers a browser's click, something neither Google nor Autom has committed to in writing.

Google did not say how far the rollout will extend beyond the residential IP ranges Perkins tracked, whether it plans to rate-limit the redirect endpoint itself, or when, if ever, it considers the change complete. For a company that runs its own automated, proactive cyber-defense push for governments and enterprises, the goto rollout is a reminder that the same automated-harvesting problem CISA described in its advisory on industrial-scale AI distillation applies just as much to Google's own search results page.