Google Replaced Every Search Result Link With an Opaque Redirect
Google quietly swapped direct URLs for Tink-encrypted /goto redirects. Resolving 10 links now costs 11 HTTP requests, and a federal judge had just dismissed Google's legal attempt to stop scrapers.
The WJS Desk
Sep 13, 2026 · updated 11 days ago · 5 min read
In late August 2026, Google replaced the direct links in its search results with encrypted redirects. Every result on the page now points to google.com/goto, and the destination URL is locked behind a Tink-encrypted Protobuf blob that cannot be decoded without Google's private key. Resolving where a link actually goes requires a separate HTTP request back to Google.
The change, first documented by the Autom team on August 27 and confirmed the same day by Barry Schwartz at Search Engine Land, drew 632 points and 489 comments when it hit Hacker News on September 12. We read the technical analyses, the court filings, and the thread. The timing tells a story that Google's one-line statement does not.
What Changed
For years, Google search results used a /url?q= redirect format. The destination sat in the query string as plaintext. Any tool could parse it directly from the HTML without making additional requests. Ten destination URLs from a results page cost one fetch.
The new /goto endpoint is different. According to ByteIota's technical analysis, the url parameter contains a Tink-encrypted Protobuf token whose length correlates with the destination URL but cannot be decrypted offline. Each search results page contains roughly 78 /goto anchors pointing to about 40 unique tokens. To resolve the actual destination, you issue a GET request with allow_redirects=False, include a Referer: https://www.google.com/search header, and read the Location from the 302 response.
Derek Perkins, founder of ranking tracker Nozzle, confirmed the rollout reached near 100% across residential IP providers. A standard 5-page ranking check that used to cost 5 requests now costs 500 to 1,000.
The Technical Cost
| Property | Old: /url | New: /goto |
|---|---|---|
| Destination visible in HTML | Yes, plaintext in query string | No, encrypted token |
| Requests to get 10 URLs | 1 (parse the page) | 11 (1 page + 10 resolves) |
| Offline decoding | Trivial URL-decode | Requires Google's private key |
| Optimal throughput | Limited only by parse speed | ~40 URLs/second with 5 workers |
| Click tracking | Bypassed by parsing HTML | Every resolve hits Google |
ByteIota also found that scaling beyond 10 concurrent workers increases latency, suggesting Google is rate-limiting the resolve endpoint. The tokens appear stable for at least 24 hours and are session-independent (collectible on one IP, resolvable from another), which rules out session-based DRM but does not make the math any cheaper at scale.
Worth flagging: The change targets programmatic access specifically. Google fingerprints clients and serves /goto markup primarily to those identified as automated. Regular users clicking links in a browser see no difference, because the browser follows the redirect transparently.
The Legal Backstory Nobody Is Connecting
On December 19, 2025, Google sued SerpApi under DMCA Section 1201, alleging that SerpApi's scraping circumvented SearchGuard, Google's anti-bot system. On July 20, 2026, Chief Judge Yvonne Gonzalez Rogers dismissed every claim. Her reasoning: SearchGuard's function was "to regulate automated access rather than to protect copyrighted works," so the DMCA's anti-circumvention provisions did not apply. Claims about non-copyrighted search results were dismissed with prejudice.
Google filed an amended complaint on August 10, pivoting to contractual arguments. And by the end of August, the /goto redirect was live across nearly all search results. We are not saying correlation is causation, but the timeline is tight: Google lost the legal route to stopping scrapers, and within weeks deployed the technical one.
Google's entire public statement on the change, delivered by an unnamed spokesperson to Barry Schwartz: "We have a long history of deploying technical measures against evolving forms of abuse, and we regularly take steps to protect our services and users."
What the Thread Actually Said
The Hacker News discussion split into camps. User lubujackson called it part of a "long slide into shittification," arguing Google "died like 15 years ago" when it shifted from returning websites to returning answers. User saint_yossarian offered a practical workaround: the udm=web parameter, which restores a more classic search experience.
The conversation also turned into a debate about alternatives. User noisy_boy noted that Kagi's $5 tier provides only 300 searches per month (roughly 10 per day), making the $10 unlimited plan the realistic option. User ruszki, a paying Kagi customer, dissented: "their index is shrinking, or they really made their algorithm worse." User miki123211 suggested Kagi's perceived superiority may reflect protection from SEO manipulation rather than better algorithms.
User brookst summed up the structural problem: "Few are willing to pay even $10/mo" for quality search. And mitxela identified the constraint underneath: "Nobody wants to pay for what they use." As long as that holds, Google can extract whatever toll it wants from the infrastructure layer.
Who Already Adapted, and Who Is Scrambling
The SEO tool ecosystem split into three groups. Semrush confirmed on LinkedIn that their team "was aware of the change and addressed it quickly." SE Ranking said their rank tracking data was unaffected. SerpApi, the company Google had just sued, deployed a fix on September 5. Their VP of Marketing, Hilman Ramadhan, noted that "changes like this are one reason teams use SerpApi instead of maintaining their own parsers."
Ahrefs was more candid. On August 31, they acknowledged "a temporary inconsistency in our data" and cited Yep.com (their own search engine) as a backup data source. Nozzle was discarding affected pages during the testing period.
The Bigger Picture
We have seen this pattern before. Google removed direct image links from Image Search in 2018 after settling with Getty Images. The web did not get those links back. The &num=100 parameter, which let tools request 100 results per page, disappeared in September 2025. Each change is small enough to be individually defensible and large enough to tilt the cost curve against anyone building on top of Google's index.
The /goto redirect is the most aggressive move yet. It does not just raise the cost of scraping. It makes every URL resolution visible to Google, creating a telemetry channel that did not exist before. Whether you see that as a security measure or a surveillance measure depends entirely on who you think Google is protecting.
Google lost the courtroom fight in July and won the infrastructure fight in August. The open web did not get a hearing for either one.
