Opt out, patch, and check your bidding before Black Friday

ChatGPT Ads turns creative changes on by default

OpenAI is enabling creative enhancements by default on new and existing self-serve ChatGPT Ads campaigns this week. The feature lets OpenAI rewrite headlines and descriptions to fit a user's conversation, translate ad text, resize images, and send clicks to a different page on your site, all without per-variation approval.

This hits any founder or lean team running ChatGPT Ads where brand voice, legal review, or landing page attribution matters. The tracking page does not yet show each enhanced version individually, so if a rewritten headline creates a compliance issue you will not easily see which variant did it.

The move this week: open Ads Manager, go to campaign settings, and decide per campaign whether to leave enhancements on or opt out. Fifteen minutes if you have a handful of campaigns. Existing opt-outs carry over, so you only need to touch the ones created since the default flipped.

ChatGPT Ads turns on automatic ad changes by default (Search Engine Journal)

One robots.txt token to opt out of AI training across providers

Google announced support for a shared AI training control in robots.txt based on the IETF AIPREF working group. OpenAI, Google, Microsoft, and Anthropic have all said they will honor the same policy token as a training preference. Anthropic says implementation has started, Microsoft has committed to February 2027, OpenAI plans to roll out in the coming months, and Google plans to roll out in 2027.

This hits publishers, SaaS marketing sites with proprietary research, and any brand whose content library is a competitive asset. Silence will be read as consent by crawlers that already respect the token, and the window to set a position before enforcement is now.

The move this week: add an AI training directive group to robots.txt reflecting your stance, either blocking or explicitly allowing. The spec details may still shift before 2027, so keep it reviewable, but parsers that do not recognize the group ignore it, which makes adding it low risk. Twenty minutes with your developer.

Supporting a shared AI training control for websites (Google Search Central)

Google confirms target and budget edits do not reset Smart Bidding

Google Ads product manager Tal Akabas said on the Ads Decoded podcast that changing the target CPA, target ROAS, or budget on a steady-state campaign does not trigger a learning period. The Smart Bidding help page now lists only three triggers for Learning status: new strategy, composition changes, and goal changes. Learning status also never lasts more than seven days.

This hits every PPC operator who has been avoiding target changes in the week before BFCM out of fear of resetting learning. That fear was mispriced. You can tighten a target to protect margin or loosen it to catch demand without entering a learning window.

The move this week: open each Smart Bidding campaign, write down the current target, and pre-decide the range you will adjust to during peak. Thirty minutes. Review your seasonality adjustments at the same time so BFCM dates are already in.

Google says target changes don't reset learning (Search Engine Journal)

OpenAI agents can silently refuse to open your site

OpenAI runs a system-level site safety check that decides whether its browsing agents are allowed to open a specific URL. The check operates separately from GPTBot, OAI-SearchBot, and ChatGPT-User, so your crawler logs can show 2xx responses while agent traffic is blocked. The system card confirms OpenAI restricts the agent from navigating to sites associated with policy violations, and support staff have confirmed safety blocks in writing on previously working integrations.

This hits any brand that counts on ChatGPT citations, agent referrals, or agentic commerce. If you are blocked you lose that surface entirely without a notification.

The move this week: test your main domain and your highest-value product URLs inside ChatGPT with browsing enabled. If the agent cannot open the page while your bot logs show healthy crawler traffic, document the responses and open a review request with OpenAI. Twenty minutes to test, longer if you need to appeal.

OpenAI's agents can silently block your site (Search Engine Journal)

Shopify validates GTINs against the GS1 registry in admin

Shopify now checks product barcodes against the GS1 registry inside admin. New barcodes get autocompleted and marked as GTIN when they match. Barcodes already saved as Custom get a suggestion to be reclassified. If GS1 has your barcode registered to a different product you get a comparison on hover. Bulk accept is available in the products and inventory bulk editors.

This hits merchants selling through Google Shopping, Performance Max, or any feed-driven channel where GTIN quality affects match rates and placement. Nothing is auto-changed on your existing data, so the gain only comes from running the audit.

The move this week: open the product list in admin, filter for products with barcodes, and run the bulk GTIN suggestion accept across your catalog. Spot-check the GS1 mismatches on your top sellers before BFCM feed submissions. Thirty to forty-five minutes for most catalogs.

Admin supports GTIN suggestions and autocomplete (Shopify Changelog)

Yahoo deliverability guide refreshed before peak volume

Al Iverson published an updated Yahoo Mail deliverability guide. Key reminders: addresses on aol.com, att.net, and verizon.net all route to Yahoo infrastructure, and Yahoo calculates spam complaint rate against Inbox Delivered Mail rather than total sends. The guide also walks through the current Complaint Feedback Loop and Sender Hub Insights tooling that replaced the older vintage tools.

This hits any lean marketing team planning to raise send volume for BFCM. If your Yahoo-side complaint rate math is based on sends rather than inboxed mail, your internal number can look safe while the real one is near the threshold.

The move this week: confirm your Yahoo FBL enrollment, verify DMARC alignment on your sending domains, and pull your last thirty days of complaint data recalculated against delivered mail only. Thirty minutes with your ESP open.

ISP Deliverability Guide: Yahoo Mail (Spam Resource)

WordPress ships a security release with an actively exploited flaw

WordPress released version 7.1.4 covering twenty-two vulnerabilities. One of them is in the updater itself: during an update, files extract into a predictable folder and the cleanup step removed an index file, which could leave an installer reachable from the web. Fixes also include stored XSS and a stored denial of service in the Interactivity API. The patch was backported through the 4.7 branch.

This hits every founder running a WordPress marketing site, blog, or docs portal who has been letting manual updates slip. Public disclosures of CVEs tend to attract exploit activity quickly.

The move this week: log into each WordPress site you own, trigger the 7.1.4 update, and confirm it completed cleanly. If you have auto-updates on, verify the version number rather than assuming. Ten minutes per site.

WordPress announces another security release: version 7.1.4 (Search Engine Journal)WordPress 7.1.4 release announcement (WordPress News)

AI Mode ads auto-enroll existing campaigns in ten new markets

Google expanded ads in AI Mode to Australia, Canada, India, Kenya, Malaysia, New Zealand, Nigeria, Pakistan, the Philippines, and Singapore. Brazil, Mexico, and the United Kingdom are flagged as next in Q4. Existing Search, Shopping, and Performance Max campaigns are automatically eligible without a new campaign or separate budget. Google is also launching multiturn ads in the US to allow ads inside follow-up queries.

This hits advertisers already geo-targeting any of the ten new markets. Your campaigns are now serving in a new surface you did not configure, which affects impression share, CPC, and budget pacing without any notification in the UI.

The move this week: open each campaign targeting those markets, confirm current budget caps, and set a review alert for the first full week of serving. If you do not want to serve in AI Mode surfaces, review the available channel controls and set them before BFCM pacing starts. Twenty minutes.

Ads in AI Mode expand to new markets (Google Blog)

Checked, and quiet

Social platform updates we tracked this week stayed small. None required an operator move this week, and we will revisit if ad inventory, targeting, or format changes land on top of them.