Meta groups lookalike ads as one creative.

Their Dec 16 note is the receipt. Ads that share key visual and thematic attributes get treated as variations of the same creative, so learning is shared at that level, not per ad ID.

That is why a brand can ship twelve "tests" and still be running one idea.

Same UGC take, new headline, new CTA. Meta's own example calls that iteration, not diversification.

A Reels cut for Gen Z and a partnership ad aimed at new moms is the other pile. That is the range Andromeda can actually choose between.

What still collapses into one bet:

• Identical visuals with different text CTAs
• A reframe or color grade on the same footage
• The same talking-head script in twelve outfits

What Meta lists as distinct:

• Persona or use case
• Format
• Messaging approach and theme

Volume got cheap. Concepts did not.

Twelve ads in Ads Manager can still be one bet in the auction.

On Monday, Google starts writing coupons into your clients' ads. It finds them on their websites.

The setting is called Automated promotions. It goes live October 12 and it's already set to "On (recommended)."

What Google's email says (Search Engine Roundtable published it Oct 5):

• Google reads the site, picks out coupons and deals, and attaches them to ads as promotion assets.
• It covers Search and Performance Max campaigns with linked location assets.
• Campaigns that already carry a promotion asset are skipped.
• Offers with zero impressions don't show in the Assets report. You find out after one served.

So the exposed account is the one with physical locations and a messy website. The welcome code in the popup, the sale banner nobody took down, the code that only works on a first order.

Menachem Ani put that last one plainly: run new-customer-only codes and "that code can now show to everyone."

On r/PPC the thread is titled "Warning: automated promotions turned on." One reply: "I can't think of an instance where I need Google to automatically apply promotions without our review or consent."

Another found "no way to view all of them on MCC." The switch lives inside each account, one at a time.

Julie Bacchini asked what a lot of agency owners were thinking: "What is it with ad platforms rolling this stuff out in Q4?"

For an agency, the real cost shows up as a client call. A shopper saw a discount in the ad, checkout refused it, and the store owner wants to know who wrote that ad.

TL;DR, account by account:
• No location assets on Search or PMax? Nothing changes.
• Keeping it on? Clear expired offers off the site first, because the site is now ad copy.
• Turning it off: Assets → Associations → ⋮ → Account-level automated assets → ⋮ → Advanced settings → Automated promotions → Off.
• Want one specific offer in the ads? Add it as a manual promotion asset, and Google skips that campaign.

Google just gave Performance Max a real creative A/B test.

Start one this week and the asset group is locked until after Black Friday.

The feature is rolling out now: two sets of headlines, images and video, tested inside the same asset group.

The fine print is in Google's help page. "When an experiment starts, you can't edit, add, or remove any assets in the asset group that's being tested until the experiment ends." The editing pages go view-only.

Google's experiment guidance asks for at least four to six weeks, and the first seven days don't count. Black Friday is November 27.

So a test launched in mid-October is either still running when the sale creative needs to go in, or someone ends it early and Google throws the treatment assets away.

For an agency, that's the Q4 call nobody wants. The client wants the BFCM banners live, and the answer is "that asset group is in an experiment."

The test itself is worth running. Just pick the asset group carefully.

Account by account, before anyone clicks start:
• Sale creative going into this asset group before Dec 1? Test a different group, or wait until January.
• Evergreen group with no promo planned? Good candidate, and it can run through Q4.
• Planning to end it early if needed? Ending discards the B assets, so save copies first.

If a client's rankings fell off a cliff in late September and came back days later, check the data first.

Nozzle, an enterprise rank tracker, published a study on Oct 10 covering 27.5 million Google results pages. Since Sept 13, 8.0% of the pages it could judge came back "poisoned": a complete, normal-looking SERP with most of the keyword's usual sites swapped out. No error, no captcha. Nozzle reads it as Google's answer to AI scraping, with rank trackers caught in the same net.

The numbers that matter for a client report:
• A tracked site missed the top 10 on 58.6% of poisoned pages, against 2.7% before
• It hit about a quarter of all SERPs on Sept 27–29 and has run at 5–11% a day since Oct 1
• 77.9% had their usual sites back within three days

The SEO side noticed fast. Brodie Clark: "Before you report an unconfirmed Google update or panic over a major drop in your rank tracker: check if you were served a poisoned SERP."

For an agency, the risk is the October report. A one-day dip goes into the deck as a crash, someone rewrites a page that was fine, and the strategy call gets spent on a ranking drop that never happened.

One detail the PPC team will enjoy: ads and Shopping kept their usual results on the poisoned pages. Only the organic list got shuffled.

Per client, before the October report goes out:
• Drop on a single day, back within three days? Treat it as bad data and keep it out of the trend line.
• Tracker says the site vanished? Pull Search Console for the same dates. If impressions and clicks held, nothing happened to the site.
• Rewrite or "recovery plan" already queued off a late-September drop? Re-check it against Search Console before anyone ships it.
• AI-visibility tool that scrapes Google in the stack? Ask the vendor how it filters poisoned pages.

Google will now translate a client's whole Search campaign into another language. The budget comes along untranslated.

The AI campaign localization beta takes an English (US) Search campaign and builds a new, paused copy in one of ten languages.

Headlines, keywords, sitelinks, callouts, image text. With Google's snippet, the landing page too.

One line in the coverage deserves a sticky note. Stacked Marketer: "Budgets and bids copy without currency conversion."

So the US numbers land unchanged in a market with different CPCs, different searches and different competitors.

The copy got localized. The math stayed in dollars.

For an agency, that's a launch-day call waiting to happen. The client hears "we're live in Germany" while the campaign bids US-dollar numbers into an auction it has never seen.

The tool is still useful. It kills the spreadsheet-and-translator week, and the copy starts paused, which is the right default.

Account by account, before anyone hits enable:

• Budget copied from the US? Reset it to that market's CPCs.

• tROAS or tCPA copied over? Treat it as a placeholder until the market has its own data.

• Landing page on the translate snippet? Check that checkout, prices and shipping match the language.

• Keywords translated literally? A native speaker reads the list before it spends.

Some brands we say no to on the first call. On purpose.

For our first stretch running Tegra, we didn't.

A brand showed up with budget and a card, and we found a reason to say yes. Revenue is revenue. The pipeline math felt obvious.

What we kept signing:

• The brand under our minimums, where the account-load math never works.

• The account already in good shape, where we'd tidy the edges for a lift nobody could feel.

• The brand not ready for Google Ads yet: tracking that doesn't match the store, a page that loses the click, a fulfillment problem upstream.

• The brand where we weren't sure we could move the number, followed by six months of proving ourselves right.

None of those blow up. They just sit there, eating senior review time that belongs to the accounts that are compounding.

They also produce the awkward monthly call where someone explains why flat is fine. Nobody enjoys that call, including the person explaining.

So now there's a gate. Four questions before we send a proposal:

1. Is the account already in good shape?

2. Are we confident we can move the number?

3. Is paid actually the constraint, or is it tracking, the offer, or the page?

4. Does it clear our minimums without straining account load?

A no on any one is a no on the engagement.

We say it on the call, with the reason, and point the brand at what it needs first. Sometimes that's a tracking fix. Sometimes it's a better page. Occasionally it's another agency.

Google launched a metric that shows how many conversions you gained by sending Google more data. Google calculates it.

It's called Data Strength Uplift, and it arrived with this month's Demand Gen Drop.

The headline claim: advertisers using Google tag gateway see "on average, over 20% conversion uplift in Demand Gen campaigns." The footnote behind that 20% covers two weeks in June.

The setup itself is reasonable. Tag gateway, your CRM connected through Data Manager, enhanced conversions.

Browsers and ad blockers do hide real sales, and getting them back helps the bidder.

Here's the catch. PPC Land put it well: recovered conversions are ones "that would have happened anyway but were not measured; they are not incremental sales."

So when a client's conversions jump after the setup, it's likely the same sales, now visible. The money was already in the bank. It just got a seat in the report.

Worth doing. Worth explaining before the client finds the new column on their own.

Account by account, before the uplift number hits a report:

• Before installing tag gateway or enhanced conversions, note the date and current conversion count, so the jump has a label.

• After it's live, compare Shopify or CRM orders for the same period, not just Google's column.

• Any target set on the old conversion count gets reviewed once, since the bidder now sees more conversions.

A Shopify store's own app was sending its customers to a fake checkout. The store didn't change a thing.

A developer, Roman Zipp, found a large shop redirecting shoppers to a fake checkout page. The cause: a HulkApps extension delivering malicious code.

He posted it to r/shopify. The replies are the worrying part:

• u/steamerbb: "Same thing happened on August 30th of this year with the Hextom Announcement Bar app."

• HulkApps support, quoted by u/John___Matrix: "We're aware of the issue related to our Hulk Product Options app."

The mechanism is simple. Theme app extensions run code on your storefront.

If the app's side is compromised, the code changes without anyone touching your theme. And the fake checkout looks exactly like yours.

For an agency, that means the client's ad spend buys traffic that can be hijacked after the click. ROAS drops, nobody knows why, and the ads get blamed first, as is tradition.

Account by account, this week:

• Every client store: list installed apps with storefront extensions and remove the ones nobody can explain.

• Stores running any HulkApps app: change the HulkApps password, turn on 2FA, review the app's custom code settings.

• Every client: place a test order in a private window and confirm the checkout URL is the store's real Shopify checkout.

Shopify is handing sales tax filing back to its merchants, right after the busiest selling weeks of the year.

Per Shopify's help center, automated filing continues for enrolled stores through Dec 31, 2026, with state-specific final periods.

After that, Shopify Tax still calculates the tax. Filing it becomes your job, or a partner's.

r/shopify found out the usual way:

• u/sparklejackie: "what else is shopify going to take away from us?"

• u/More_Initiative_9099 noticed the docs now say automated filing applies "only to stores that are already enrolled."

The timing is the agency problem.

Q4 revenue lands in November and December. The first returns Shopify won't file land in early 2027, while everyone's still reconciling Black Friday. Lovely January.

Shopify points merchants to two partners, Numeral and Zamp. Picking one is a finance call. Making sure someone owns it is an account-management call.

Account by account, before Thanksgiving:

• Which clients use Shopify Tax automated filing? List them and the states they file in.

• Who owns filing from January: the client's accountant, a partner service, or nobody yet?

• Q4 sales by state exported and handed to that person before the year closes.

Six weeks before Black Friday, Google added one line to Merchant Center that should worry every flash-sale calendar.

From the help page on automatic item updates:

"Automations may not work for products with frequent price or availability value changes (for example, more than once per day). The product may be disapproved instead of updated if we detect a mismatch."

And then: "We may also stop updates if the total number of detected mismatches becomes too large."

No announcement. No published threshold. Hana Kobzová dated the edit to Sept 27, and Search Engine Roundtable flagged it Oct 8.

Here's why it bites in Q4.

Automatic item updates are the safety net that fixes your Shopping price when the feed lags behind the site. Hourly deals, doorbusters that sell out, a price that drops at midnight and returns at 6am: that's the exact pattern the net may now miss.

So your Black Friday best seller is the product most likely to sit in disapproved. Great timing.

Google's fix is the Merchant API. Plenty of stores on an app-based feed aren't there yet.

Account by account, before the sale calendar locks:

• Any SKU changing price more than once a day? Push it through the API or a feed refresh that runs as often as the price changes.

• Sale prices go in sale_price with dated sale windows, not hand-overwritten price.

• Check Needs attention for price mismatch the morning of every promo, doorbusters first.

If you run Aftersell, rotate its discount codes before BFCM. The app is still off the Shopify App Store.

Aftersell, the post-purchase upsell app Rokt owns, was attacked on Oct 7. Its disclosure says the data accessed included upsell settings, staff email addresses and discount codes for a small group of merchants.

Aftersell's Dhruv Patel put it at 22 stores.

No shopper data was exposed, per the company, and it says the hole was closed within two hours.

Aftersell's page tells merchants they don't need to take action. The app still works, and you can reinstall it through Settings > Apps > Uninstalled.

The attack was the modern kind: millions of requests rotating through 1,460 IP addresses, per Patel. Block one, the next one shows up.

A bot with better follow-through than most agencies.

Here's why it matters even if you're not one of the 22.

A leaked discount code doesn't stay leaked quietly. It ends up on coupon sites, in browser extensions, and at the checkout of people who were going to pay full price anyway.

Right before BFCM, that's margin walking out the door with a smile.

Account-by-account checklist:

• Stores running Aftersell: rotate the codes its offers use, and put usage limits on the ones you keep.

• Every app with access to discounts or checkout: who installed it, and whether anyone still needs it.

• Notified stores: expect phishing aimed at the staff emails that leaked.

If a client's site runs on PHP, check its version today. Attack traffic is already out there.

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed on Oct 20. Both score 9.2 and can allow unauthenticated remote code execution, and Cloudflare has reported attack traffic against them.

The fix is the PHP runtime itself, not a plugin. Fixed releases:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

PHP 8.1 and earlier get no regular upstream fix. Those need a backport from your host or distro, or an upgrade.

Qualys looked at 155 million installs with a known version. About seven in ten run end-of-life branches, and only 199,000 were patched in the first 12 hours.

The 2-minute check, per site:

• Ask the host whether PHP2Shell is patched. Managed hosts usually say so on a status page.

• On a VPS, confirm the build against your distro's advisory. Backported fixes can keep an older version number.

• Restart the PHP workers after updating. Running processes keep the vulnerable code in memory until they restart.

Shopify-hosted storefronts don't run PHP you manage. WordPress and WooCommerce sites do, and any app backend written in PHP is on its vendor's patch schedule.

Disabling session.upload_progress.enabled is PHP's interim step for one attack path. It reduces exposure and is not a fix.

Shopify rolled back its leave-store prompt on Oct 22. Use the quiet to run one check.

The prompt went live Oct 20 and asked shoppers to confirm before leaving a storefront for an outside site. Merchants on Shopify's forums report it was pulled globally on Oct 22 while bugs get fixed.

The trusted-domains setting Shopify promised has also come off the changelog. There's no return date, so assume the prompt comes back.

For every store you manage:

• List each link that sends shoppers off-site: financing, booking, spec sheets, a help center, a second storefront.

• Pull outbound clicks for Oct 20 to 22 against the week before. The prompt was live for about two days, which is a clean test window.

• Note which of those domains you would add as trusted if the setting returns.

Shopify didn't tie the prompt to any incident. The timing follows the Oct 10 to 14 hijacks of three apps that sent checkout clicks to fake card pages, per Ecommerce Paradise's reporting.

A confirmation box was live for two days. That's roughly how long it takes a client to ask whether it explains the dip.

Performance Max has two new asset toggles, and one was reportedly already on.

Search Engine Land reported on Oct 22 that PMax's Asset optimization settings now include Landing page images and Sourced videos. The advertiser who spotted them said Sourced videos was enabled automatically.

What the features do:

• Landing page images lets Google use images from your site as creative.

• Sourced videos lets Google use videos from other channels, including social, landing pages and linked YouTube channels, up to 10 per asset group.

Google's interface also says ads using these assets get an AI label in the EU, India and New York state.

The 2-minute check, per campaign:

• Open Asset optimization and see which of the two is on.

• Decide whether the client has usage rights to every video on the channels Google can pull from.

• Look at what actually got added before the next client call.

Google calls it expanding the creative library. It's also a creative director nobody hired, working from whatever is on the landing page.

Check whether your Meta Sales campaigns still have a placement exclusion that works.

Meta's help center says Sales, Leads, Engagement and App promotion campaigns no longer let you choose placements manually at the ad set level. Awareness and Traffic keep manual placements.

Meta says the change is rolling out gradually, so two accounts on the same team can look different this week.

What Meta lists instead:

• Account-level exclusions, now settable by objective: Audience Network, Facebook Marketplace and the Facebook right column.

• Placement value rules that raise or lower bids by placement.

• Creative customization per placement. At least one asset is required for each placement, and ads won't deliver where the asset format isn't supported.

What to check this week:

• Which ad sets lean on a manual exclusion, and whether the reason was brand safety, legal or just performance.

• Whether the brand safety and legal ones now live in account controls.

• Whether the performance ones can be expressed as a value rule instead.

Meta also says Advantage+ placements delivered 10% lower cost per result in an experiment. It published no details of the experiment, so that's a number to test, not a forecast.

Meta's new terms start Oct 30. Check your Advantage+ AI toggles before then.

Per Adweek's reporting, the revised Commercial Terms add an "AI Features" section making advertisers "solely responsible" for what Meta's AI creates or changes in their ads. That includes features Meta switches on itself.

Agencies told Adweek they have already seen Meta add sitelinks, translations and AI images to live ads. Exverus pulled running ads to remove them.

Meta says advertisers can turn off individual Advantage+ features in Ads Manager at any time. It didn't directly answer whether the new terms cover features an advertiser never switched on.

For every account you run:

• Open each live campaign's creative enhancements and uncheck what the client didn't approve. Some of them sit in collapsed menus.

• Get written sign-off from the client on whichever AI features stay on.

• Screenshot the settings before Oct 30, so you can show what was on and when.

The current terms already treat an agency placing an ad as acting on the advertiser's behalf. Who pays when one toggle gets missed is now a client-contract question.

Meta describes the update as consolidating its AI ad terms. Housekeeping that moves the liability is still housekeeping, technically.

One old checkout extension can freeze a client's Shopify app. Since Oct 1, ones on API 2025-07 or older can't update.

Shopify's changelog says any app with checkout or customer account extensions on API 2025-07 or earlier "will be unable to be updated." The CLI checks every extension in the app, so one old one holds up the whole release.

The extensions keep running. What stops is the next version of the app, including a BFCM fix.

Before Nov 27:

• Ask each checkout app vendor which API version their extensions target. Shopify says 2025-10 and later use Polaris web components.

• Flag apps that haven't shipped an update since summer. That's my shortcut for the likeliest stuck ones, not a Shopify rule.

• Pick a fallback for any app that can't update, like a native checkout setting or a different app.

A code freeze nobody scheduled is still a code freeze.

The email worth sending every client this week:

"No new campaigns after November 13."

Every big change restarts learning: a new campaign, a new bid strategy, merged asset groups.

Smart Bidding needs time and conversions to settle. Black Friday week is the most expensive week to relearn.

So the calendar flips:

• Now to Nov 13: launch, restructure, test
• Nov 14 to Cyber Monday: budgets and targets only, in small steps
• December: read the results, then rebuild

Clients who hear this in October trust you in November.

Clients who hear it on November 25 think it's an excuse.

Google may be pulling promotions from client landing pages into Search and PMax ads that have location assets.

Google's help page says it sources promotions from the landing page and attaches them to eligible Search and Performance Max campaigns that have location assets and no manual promotions. Each one is eligible to serve for less than 24 hours, and Google may turn it back on if it's still visible on the page.

The setting is at account level, so it has to be checked account by account.

What to check before Black Friday pages go live:

• Assets > More (three dots) > Account level automated assets > Advanced settings > Automated promotions.

• Assets > Asset type "Promotion," then look for "Google AI" under "Added by."

• Segment reports by click type to see what the promotions drove.

• If a promotion needs exact dates or terms, upload it manually. Campaigns with manual promotions are skipped.

Google is moving Merchant Center user access to passkeys.

For agencies, that turns a settings page into a client access problem.

What it touches:

• Shared logins that three people use. Those stop working cleanly.
• Ex-employees who still have admin on a client's Merchant Center.
• Client accounts where only the agency has admin, and the founder can't get in.

The 20-minute version for every client:

• List every user on the Merchant Center account
• Remove anyone who left
• Make sure the client owns at least one admin seat
• Give each person their own login

Do it before Black Friday. The day a feed breaks is a bad day to find out nobody can log in.

Google's new channel prioritization can't be set from a manager account.

Each client account or campaign gets done on its own.

Per Google's help page, the controls became available progressively from Oct 15. You set High or Low priority per channel, optionally with a budget allocation percentage on Low channels.

The date that matters is February 2027, when Search campaigns with Display Expansion enabled migrate automatically. To keep today's behavior, Google says to set the Google Display Network to Low with a 50% allocation.

What to do now:

• List client Search campaigns with the Display Network on. Those are the ones that migrate.

• Flag Target Impression Share campaigns. Google says the Display Network won't serve on them.

• Plan on the interface. API and Editor support is listed as "coming soon."