Loop Digital May Digital Marketing Industry Update 2026

Read time: 11 minutes

Google spent May rebuilding the front door of the internet. Within three days, it reimagined the Search box for the first time in 25 years, made AI the default surface for its entire ads stack, and rolled out another core update on top of it all.

For SMEs, the headline is simple: the way people find you, and the way Google decides whether to show you, has changed more this month than in any single month for years. AI Mode now has over a billion users, conversational ads are arriving inside it, and a new analytics channel finally lets you see how much traffic ChatGPT, Gemini, and Claude are sending your way.

There were also two serious WordPress stories worth acting on now: the 7.0 release that ships AI infrastructure into the admin dashboard, and a SQL injection flaw affecting over a million sites.

Here’s what changed in May, and what it means for your business.

Digital Marketing Highlights

Google reimagined Search at I/O 2026

At Google I/O on 19 May, Google called it the biggest upgrade to its Search box in over 25 years. The box now takes text, images, files, videos, and even open Chrome tabs, and reasons across all of them at once. Search can also assemble custom layouts on the fly, building interactive visuals, tables, graphs, and mini-apps in real time rather than returning a list of links.

Discovery is no longer a list you scroll. For SMEs, the practical takeaway is the same one that keeps repeating: structure your content so a machine can read, classify, and reuse it. Clear headings, genuine answers, and clean data are what get pulled into these generated layouts.

AI Mode passes one billion users and gets ads

At Google Marketing Live on 20 May, Google confirmed AI Mode now has over a billion monthly users and announced Ads in AI Mode. These look less like traditional search ads and more like a native part of the conversation, with a “Sponsored” tag, generated by Gemini from your asset library and brand guidelines. Direct Offers can also attach to AI answers when the intent is commercial.

People are moving from typing queries to having conversations, and ads are following them there. The ad that wins is the one that fits the next logical step in that conversation, not the one with the best keyword match. Brands access these placements through AI Max and Performance Max, so getting comfortable with both now is the sensible move.

Gemini Omni and a new wave of generative tools

Google launched Gemini Omni, a model family that turns text, images, audio, or existing clips into new video, and made Gemini 3.5 Flash the default model in AI Mode. Alongside it came Google Pics (a Canva-style poster and infographic tool), Pomelli for building brand content and websites, and Docs Live, which lets you create and edit documents by voice. Personal Intelligence in AI Mode is also expanding to nearly 200 countries, so conversational, personalised search is becoming the default for far more of your customers.

For small teams without a designer, the cost of producing decent creative is dropping fast. The differentiator is no longer who can make an asset, but who can brief it well and apply real editorial judgement on top. 

A new “Ask advisor” agent inside Google

Google is testing an agentic advisor that recommends marketing strategies and works towards your goals directly inside its own tools. It lowers the barrier for marketing managers who want to self-serve, which is genuinely useful, but it also means your competitors have the same assistant. A generic strategy that a tool can generate for anyone is not an advantage. The edge sits in the parts a model can’t see: your offer, your local knowledge, your customer relationships.

Google published a generative AI optimisation guide

Google released a new guide to optimising your website for generative AI features in Search. The advice is consistent with people-first SEO: produce genuinely useful content, keep it crawlable, use structured data that matches what’s on the page, and make sure your information is clear and current.

There’s no secret schema or trick. If your content is already strong, well-structured, and easy to crawl, you’re most of the way there. If it isn’t, this guide is a useful checklist to work through.

Digital Marketing Key Takeaways

• Google reimagined its Search box for the first time in 25 years, building answers and layouts on the fly instead of returning links.
• AI Mode now has over a billion users, and conversational ads are arriving inside it via AI Max and Performance Max.
• Gemini Omni and tools like Google Pics make creative easier, so the value shifts to strong briefs and editorial judgement.
• Google’s new “Ask advisor” agent helps anyone with a self-serve strategy, which makes your offer and local expertise the real differentiator.
• Google’s new generative AI optimisation guide confirms there’s no shortcut: useful, structured, crawlable content is what gets surfaced.

SEO Highlights

The May 2026 core update is rolling out

Google released the May 2026 core update on 21st May, the second broad core update of the year, with a rollout window of up to two weeks. It landed just two days after the I/O Search overhaul, and many sites had already seen heavy ranking volatility in the run-up.

Don’t react to short-term movement. Wait until Google confirms the rollout is complete, then compare a full week after against a week before it started. If you see a sustained drop, look at page-level quality and relevance, not technical quick fixes.

Schema’s pitch as an AI shortcut takes a hit

Two things landed together. Google’s FAQ rich results finished disappearing from Search, and days later, an Ahrefs report found that adding schema didn’t produce a clear citation lift across Google AI Overviews, AI Mode, or ChatGPT for pages already visible there.

Schema isn’t dead, but the idea that it’s a fast track to AI citations is now much weaker. Treat structured data as useful plumbing that helps machines understand your pages, not as a lever that buys visibility. Keep FAQ markup if it matches real on-page content; don’t add it purely to chase a feature that no longer exists.

New AI Assistant channel in Google Analytics

From 13th May, Google Analytics added a native AI Assistant channel to its Default Channel Group, automatically separating visits referred from ChatGPT, Gemini, and Claude from your other referral traffic, with no setup required.

For the first time, you can see, free and out of the box, how much business AI tools are actually sending you. Two caveats worth knowing: it only applies going forward, so historical AI traffic stays in Referral; and clicks from AI Overviews or AI Mode inside Google Search still count as Organic, not AI Assistant. Add it to your monthly reporting now so you build a baseline.

Why does AI search skip some content?

Analysis this month reinforced that AI search engines skip content they can’t easily parse, trust, or match to a clear user need. Common culprits are buried answers, vague structure, weak authority signals, and pages written for keywords rather than questions. The fix isn’t technical wizardry: lead with the answer, make expertise obvious, and write for the specific need behind the search. Google also reinforced this month that AI search splinters one need into many smaller queries, so build topic depth that answers the obvious question, then the follow-ups, rather than chasing single keywords.

More AI search links, still no click data

Google is adding more links inside AI search and testing hover previews to nudge clicks, but it still gives SEOs no separate click data for AI surfaces. You can be cited in an AI answer and have no way to see it in Search Console. Until that changes, pair Search Console with the new GA4 AI Assistant channel and track citations directly in the AI tools that matter to you.

AI search clicks favour local domains

A report found AI search often sends clicks to local, market-specific domains, meaning your AI competitors may not be the ones you track in traditional SEO. For UK SMEs, that’s encouraging: strong local relevance, clear location signals, and genuine regional authority can win citations that a larger international brand misses.

AI Overviews can surface negative reviews unprompted

Research this month showed AI Overviews and chatbots now pull complaints, forum threads, and old reviews into comparison answers, even when nobody searched for problems, and even inside a question about a competitor. Recent, repeated criticism on authoritative platforms carries the most weight. Old-style reputation management isn’t enough: keep collecting fresh, genuine reviews, respond to them, and resolve recurring complaints before they become a pattern AI treats as fact.

SEO Key Takeaways

• The May 2026 core update is rolling out; wait for completion before judging any ranking movement.
• Schema still helps machines understand your pages, but new data shows it’s not a shortcut to AI citations.
• GA4’s new AI Assistant channel finally lets you measure ChatGPT, Gemini, and Claude traffic, going forward only.
• AI search still counts AI Overviews and AI Mode clicks as Organic, not AI Assistant, so read the data carefully.
• AI engines skip content they can’t parse or trust; answer-first, well-structured, authoritative pages get cited.
• Google adds more AI search links but still no click data; AI clicks often favour local domains, a real opening for UK SMEs.

Paid Media Highlights

AI Max becomes the default for Search

Following the April news that Dynamic Search Ads are being retired in favour of AI Max, Google used Marketing Live to confirm AI Max as the recommended default for Search going forward. AI Max turned one year old this month and is now, in Google’s words, its fastest-growing AI Search ads product.

If you still run DSA or campaign-level broad match, automatic migration begins in September. Use the voluntary upgrade window now to control how your settings carry across and audit your negative keyword lists, since AI Max matches on site content rather than your keyword lists. Migrating on your terms beats being migrated on Google’s defaults.

Tag Manager controls move inside Google Ads

Google has surfaced Google Tag Manager controls directly inside the Google Ads interface, reducing the back-and-forth that conversion tracking setup has traditionally needed.

This is a genuine quick win, but check your tagging before you rely on it. Confirm no legacy or duplicate tags are creating data discrepancies, because clean measurement is what smart bidding depends on, and AI Max needs a good signal to perform.

Strategy matters more as targeting automates

Across both I/O and Marketing Live, the message was that Gemini is now the operating layer of Google Ads, and AI is the default rather than an add-on. As Google automates targeting, bidding, and creative, the advantage moves up the funnel to the things automation can’t decide for you: the clarity of your offer, the strength of your landing page, and how precisely you brief the AI. The teams that win on AI-generated creative are the ones writing the sharpest briefs.

Paid Media Key Takeaways

• AI Max is now the default for Search; DSA and campaign-level broad match migrate automatically from September.
• Use the voluntary AI Max upgrade window now to keep control of settings and audit negative keywords.
• Tag Manager controls inside Google Ads simplify conversion tracking, but audit legacy tags first.
• As Gemini automates targeting and creative, the edge moves to offer quality landing pages and precise briefs.

Social Media Highlights

Meta reports its first-ever decline in daily users

Meta’s daily active user count fell for the first time in Q1 2026, to 3.56 billion across its family of apps, down from 3.58 billion. Meta attributed the dip to internet disruptions in Iran and a WhatsApp restriction in Russia rather than a broad engagement problem, and revenue still rose 33% year on year.

It’s a slight, region-driven decline, not a collapse: Meta still reaches over a third of the planet daily. But it’s a useful reminder that no platform’s reach is guaranteed, and a single-channel social strategy carries more risk than it feels like. Spread your presence so one platform’s wobble isn’t your wobble too.

A new AI traffic channel changes how you value social

With GA4 now separating AI assistant traffic into its own channel, you can finally compare social referrals against AI referrals on a like-for-like basis. For many SMEs, this will reframe where attention and budget should go. If AI tools are quietly sending qualified visitors while a social channel is mostly vanity reach, the numbers will now show it. Let the data, not habit, decide your channel mix.

Younger users and the under-16 question

Research drew parallels between concerns over AI chatbots and younger users and the long-running debate about under-16s on social media. Regulation around teen access, already cited by Meta as a factor in some markets, is a live issue likely to shape platform availability.

If your audience skews young, keep an eye on how access rules evolve. Building owned channels, such as email and your own website, protects you from regulatory shifts you can’t control on someone else’s platform.

Social Media Key Takeaways

• Meta saw its first-ever daily user decline; it’s slight and region-driven, but a reminder not to over-rely on one platform.
• GA4’s new AI Assistant channel lets you compare social referrals against AI referrals and rebalance accordingly.
• Regulation around teens on social and AI platforms is a live issue; owned channels reduce your exposure to it.

Web Design and Development Highlights

WordPress 7.0 ships with an AI key warning attached

WordPress 7.0 “Armstrong” launched on 20 May, shipping AI infrastructure (the Abilities API and AI connectors) into core, after the planned real-time collaboration feature was dropped. Within two days, security researchers warned of a rush to steal AI API keys now stored in WordPress dashboards. A bug was also found where the Anthropic provider’s key field could expose the key via browser autofill.

AI API keys can be worth thousands, and Core currently has no per-plugin spend cap. If you adopt 7.0’s AI features, treat your keys like passwords: store them as server environment variables where possible, set billing alerts with your AI provider, rotate keys regularly, keep your plugin count lean, and enable two-factor authentication on admin accounts. There’s no need to panic, but there is a need to set this up properly before you connect anything.

Critical: SQL injection in Avada Builder (1M+ sites)

A high-severity unauthenticated SQL injection vulnerability (CVE-2026-4798) was confirmed in Avada Builder, affecting over a million active installations. It can let attackers extract sensitive data, including password hashes, from the database. A sibling file-read flaw (CVE-2026-4782) was also disclosed. Both are now patched in version 3.15.3.

If your site uses Avada, update to 3.15.3 or later as a priority. Outdated plugins remain one of the most common ways WordPress sites get compromised, and “we’ll do it next week” is how most breaches start.

Security release for WP Bakery

WP Bakery also published a security release, adding capability and nonce checks to its frontend preview requests. If you use WP Bakery, update to the latest version.

Two builder vulnerabilities in one month are a pattern, not a coincidence. Page builders are powerful and popular, which makes them a favourite target. A simple monthly habit of checking and applying plugin updates removes most of the risk.

Web Design and Development Key Takeaways

• WordPress 7.0 ships AI features into core; secure your API keys and set provider billing alerts before connecting anything.
• Avada Builder has a critical SQL injection flaw (CVE-2026-4798) affecting 1M+ sites; update to 3.15.3 now.
• WP Bakery has a security release adding frontend preview checks; update to the latest version.
• Two builder vulnerabilities in one month make monthly plugin maintenance a business-protection task, not an admin chore.

Stay Ahead of Digital Marketing’s Evolution

May made one thing clear: Google is rebuilding how people discover and decide, and it’s doing it fast. Search answers before it links, ads live inside conversations, and the businesses that get surfaced are the ones whose content and data are built for machines to read, trust, and reuse.

At the same time, your site has never been a more valuable target. AI keys in the dashboard and million-site plugin flaws mean security is now part of marketing, not separate from it.

Subscribe to our monthly newsletter for expert analysis and practical recommendations. You’ll know what’s changing, and what to prioritise, before your competitors do.

Get Expert Support from Loop Digital

If May’s updates raised questions, the kind that are easy to put off and expensive to ignore, now is the time to answer them. Three days of Google announcements changed how you get found. A million-site plugin flaw changed how exposed you are. Both are easier to deal with this month than next quarter.

Whether you’re getting your content ready for AI Search and Google’s new generative layouts, planning your move from DSA to AI Max before the September deadline, setting up AI traffic measurement so you actually know what’s working, or locking down your WordPress site against the latest threats, we’ll help you work out what to fix first.

Book your FREE 30-minute consultation with Loop Digital, and we’ll help you:

• Get your content and structured data ready for AI Search, AI Overviews, and Google’s new generative layouts
• Plan your DSA-to-AI Max transition and tighten your offer, landing pages, and briefs for an AI-led ads stack
• Set up the new GA4 AI Assistant channel so you can measure ChatGPT, Gemini, and Claude traffic from day one
• Secure your WordPress site, including AI key handling in 7.0 and urgent plugin updates for Avada and WP Bakery

Book your consultation here.