Google masks links with /goto-Redirects on SERP dropping another bomb on competition?
Aktualisiert: 2. Sept.
Key Takeaways:
Google introduces masked links with /goto-Redirect dropping another bomb on Rank Trackers and AI Chat competition
It is a trap: While tool providers celebrate easy fixes and workarounds, I believe it is a trap:
Now Google can identify more easily which users misuse its search engine = those sessions call all the redirect links from a SERP - before it could only see users or IPs doing lots of searches that could still look natural, now it actually sees who reveals all the links to collect the data
Sungathan pointed out that the encrypts for a url change on every reload: That means, every revealed URL can
Google can "silently" collect data on misusers and easily take further steps or hits towards rank trackers
And for AI Chats: their retrieval might not be ready - ChatGPT indexes weird stuff easily and keeps it: Metehan already found example of ChatGPT citing Google goto-links, as well as Claude, Perplexity and MS Copilot
But wait: Google indexes their own URLs as well?!
Google also started to index its own /goto URLs which is ridicusouly stupid: they did not think of that before? Such a major bug highlights that Google lost its way and expertise or at least that this decision was carried out politically rather than by experts.
SEOs started to create loops for Googles crawlers by redirecting their page to the redirect URLs and seemingly killed Google servers
It is not even done properly:
Pedro Dias points out that using Googlebot User Agent you still get the readable links,
same for Accept-Language setting according to Natzir and
even in the source code and network responses there are multiple parts to scrape the correct target URLs without the need to request the /goto-Redirect URLs
Segonzac delivers the technical deep dive:
a protobuf token plus AES-GCM encryption via Tink (server-side key). Impossible to decrypt offline, and pointless to try. Recovering the key would mean brute-forcing it: 2¹²⁸ operations minimum
By measuring payload lengths across the tokens, a clean pattern emerges. AI Overview citations encrypt just the URL, nothing else. Every other result type (Organic, Video, Local Pack…) carries an extra 21-byte block of SERP context baked into the payload ==> when the same destination appears both as an AIO citation and as an organic result, the organic token's plaintext is exactly 21 bytes longer. In other words, AIO links are "clean pointers", while classic results are tracked with extra metadata.
/goto URLs rank inside Google itself, in place of the sites they point to. A site:google.com/goto surfaces thousands of results, and Semrush counts 24,296 organic positions on queries like breitbart (1.5M search volume), quietly eating the URL visibility that belongs to the destination sites.
As a counter measure Google added a Disallow: /goto? to its robots.txt. Not enough: a Disallow blocks crawling, not URL indexing. With a domain this powerful, those wrapper URLs still grab rankings, and the real sites get washed out.
Back in September 2025 Google already killed the ?num=100 parameter to hit AI chat competition that relied on its retrieval systems and caused a pain to rank tracking tools
Sources:
