Google just broke AI Overview citation tracking

If you track which sites get cited in Google’s AI Overviews, there is a reasonable chance your data went wrong this month and told you nothing about it.

On 26 August, Google confirmed it is rolling out google.com/goto passthrough links across search results. Instead of linking to the page it cites, Google now links to itself, and hands you an opaque token that only Google can turn back into a URL. Asked about it, a spokesperson told Search Engine Roundtable: “We have a long history of deploying technical measures against evolving forms of abuse, and we regularly take steps to protect our services and users.”

Most of the coverage has been about attribution and referrer data. There is a sharper, more immediate problem that has had almost no attention: it silently corrupts AI Overview citation tracking, and it does not look like a failure while it is happening.

TL;DR

• Every AI Overview citation is now wrapped. We measured 38 of 38 references across five queries, 27 August. Not a sample — every single one.
• It is not US-only. UK results were wrapped at the same rate on the same day. If you have been waiting to see it in your own browser before worrying, that is not a reliable signal.
• Unwrapped, it reads as google.com. That is a valid domain, so it survives every “did this parse?” check in the pipeline. Your citation counts stay right. Your attribution goes wrong.
• It does not arrive gradually. In our own scan history it sat at 2–8% for twelve days, went to zero, and hit 100% three days later.
• You can check your own tool in about thirty seconds. Instructions below.

What actually changed

Before, an AI Overview reference gave you the page it cited. Now it gives you this:

https://www.google.com/goto?url=CAESggEB6zswFS7Ffx7HsMdGn01fKW1NP-7KF9cY44eA8Hog…

The token is not encoded, it is opaque — there is nothing to decode locally. The only way back to the real URL is to make the request and read where Google sends you. Derek Perkins of Nozzle, who has been tracking the rollout across residential IPs, put the consequence plainly: “The goto links can’t be decoded, so providers will have to follow the redirect links.”

That is a meaningful change in cost. A single AI Overview carries five to eleven references. A rank tracker pulling a full page of results now faces hundreds of redirects per SERP to recover information it used to get for free — and Google is under no obligation to keep that cheap.

The rollout gives you no warning

This is the part we found genuinely instructive, because we had the data sitting in our own scan history and it still would not have told us in time.

Twelve days of low, flat, unremarkable numbers. Then a clean day. Then everything. If you were monitoring the rate and waiting for a trend to justify the work, the trend arrived after the change did.

Why it breaks citation tracking specifically

Citation data is the backbone of AI Overview visibility work. Which publishers get cited, whether you are among them, whether your competitors are, which sources Google leans on for a given question. All of it is keyed on the domain of the cited link.

Wrap that link and every citation in the answer resolves to the same place.

Eleven real citations to six real publishers, collapsed into a single confident and completely false claim. And look at what it costs beyond the pretty chart: Salesforce and Zapier were both cited in that answer. For a CRM brand tracking those two as competitors, that is a competitor visibility event that simply never registers — no alert, no entry in the table, no trace.

Why nobody catches it

Here is the mechanism, because it generalises well beyond this particular bug.

A corrupt URL would have been caught. google.com is not corrupt. It is a real domain, correctly parsed from a URL Google genuinely sent — a valid answer to the wrong question, and validity checks are structurally incapable of catching those.

Which is why the honest version of this story includes us. We were not immune to it and we are not going to pretend otherwise: the first wrapped citations landed in our data on 5 August, and they sat there looking like ordinary records. What surfaced them was not an alarm going off. It was reading the news, then going to look.

Check your own tool in thirty seconds

Whatever you use — ours included — this is worth doing today rather than at the end of the quarter.

1. Open the citation or sources view for any recent Google AI Overview result.
2. Look at the citing-domains list. If google.com is at or near the top, or appears in real volume at all, the tool is not unwrapping. Google does not cite itself this often.
3. Cross-check one query by hand. Run the same search, and read the publishers Google actually credits in the AI Overview. Compare. They should match, and if the tool is affected they will not.
4. Hover a citation link in a live AI Overview and read the target in your browser’s status bar. If you see /goto?url=, you are looking at the wrapper directly.

Or just ask your vendor: do you resolve google.com/goto passthrough URLs in AI Overview citations? It is a yes-or-no question and anyone who has done the work will answer it instantly.

What a real fix involves

More than swapping one URL for another, which is the reason this is worth asking vendors about rather than assuming.

Resolve at capture time, not on read. The destination has to be recovered while the scan runs and stored resolved, because everything downstream — domain attribution, competitor matching, source classification — keys off it. Repairing at display time fixes the chart and leaves the underlying analysis wrong.

Never fall back to the wrapper. This is the decision that matters most, and it is a data-integrity call rather than a technical one. When a redirect cannot be followed, the only safe move is to drop the citation. A missing citation is visible and recoverable. A citation confidently attributed to the wrong domain propagates into competitor analysis, share of voice and reporting, and nothing downstream can tell it is wrong. We drop them, and log it.

Do not assume your upstream handles it. Whoever you get SERP data from — your own scrapers, a data provider, a mix — normalisation is rarely uniform across a results page. It is entirely possible for the organic block to arrive with links already cleaned while the AI Overview block does not, in the same payload, on the same request. Anyone building on top of that data owns the job of verifying it rather than inheriting an assumption.

Repair the history. Once the live path is fixed you still have poisoned records behind you. We resolved ours and rewrote them, then re-ran domain attribution and brand ownership across the repaired set so historical citation data matches what the pipeline would produce today. Worth knowing that this is possible at all: the tokens stay valid for weeks, so history is recoverable — but only until it isn’t, which argues for doing it now.

The wider signal

It would be a mistake to read this as one link format changing.

Google has stated it is deploying technical measures against scraping, and this is what those look like in practice: not a block, not a CAPTCHA, but a steady increase in the cost of turning a search results page into structured data. The wrapper does not stop anyone. It adds hundreds of round trips per page, and it can be made more expensive later without any further announcement.

For anyone doing GEO work, the practical implication is about how you choose tools. The interesting question stopped being can you see AI Overviews a while ago. It is now how quickly a tool notices when the ground moves, how it behaves when a value is unreadable, and whether it tells you plainly when something changed. This will not be the last time.

We caught this one on 5 August, fixed the capture path, and repaired the affected history. The next one will look different — that is rather the point of it.