Google now requires "good policy health" from every gambling advertiser — and clones will fill the gaps it creates

On 14 September 2026 Google’s Gambling and games certification update took effect: every account seeking to advertise in any gambling and games category must now demonstrate “good policy health”. The requirement, piloted in selected markets since March, now covers the whole vertical, worldwide.

What changed

The update has three operative parts:

• Track record gates certification. Manager accounts (MCCs) with repeated online gambling certificate revocations — or whose managed accounts are repeatedly flagged for gambling violations while using a certificate — forfeit eligibility to apply for new certificates and may have existing certifications revoked.
• Domain requirements harden. Websites on free subdomains are ineligible; the domain must be directly owned and controlled by the business; domains unrelated to gambling cannot be certified.
• Structural separation. Under the parallel August update, one Google Ads account cannot hold both an online gambling certification and a social casino certification, and each target country needs its own application.

The agency problem

The MCC clause moves the risk upstream. A licensed operator with a spotless record can lose certification eligibility because its agency’s manager account burned certificates on other clients. For operators running through networks that manage dozens of gambling accounts — the industry norm — the compliance question is no longer “are we clean” but “is everyone under our MCC clean”. Auditing who holds your certificates, which MCC they sit under, and what else that MCC manages just became a board-level item, because the sanction is market-wide ad silence.

The gap nobody prices in

Here is the part Google’s changelog does not say. When a certified operator’s ads stop — a revocation, a slow re-certification, an agency losing its MCC — the branded search results do not stay empty. Affiliate brand-bidders, clone casinos and fake “official site” pages inherit that traffic within days, sometimes hours. We documented the mechanics in the FTC v. Doxo case: search ads impersonating a brand monetise precisely the moments when the real brand’s presence weakens.

Tighter certification means more operators spending more days dark — appeals, re-applications, country-by-country forms — and every dark day is clone revenue. The stricter the ad-side gate, the more valuable the organic and paid impersonation of whoever is stuck behind it.

What this means for you

If you are a licensed operator: audit your certificate chain now — which account holds each certification, which MCC manages it, what else sits under that MCC — and separate social casino from real-money accounts before Google does it for you. Move any campaign infrastructure off shared or free-subdomain properties; certification now formally requires domains you own and control.

And treat SERP enforcement as part of the same programme: takedowns of clone sites, fake “official” pages and rogue affiliates bidding on your brand are what keep your customers reaching you during the certification gaps this policy will create. Google’s own trademark complaint process, host-level takedowns and affiliate programme enforcement all work while your ads cannot.

Counsel’s note. Most operators treat ad-platform compliance and brand protection as separate budgets owned by separate teams — media buying handles Google, legal handles clones. That split fails exactly when it matters: the moment ads go dark, the clones’ traffic share spikes, and the team that could act on it is not watching the SERP. The working method is one owner for branded search: certification status, brand-bid monitoring and clone takedowns on a single dashboard, so a paused campaign triggers enforcement the same day. We broke down the affiliate side in our guide to stopping brand bidding in iGaming.