White Hat vs Black Hat SEO: Google's Spam Policies One by One, the Two Kinds of Penalty, and the Way Back

The hats are trade slang; the rulebook belongs to Google

White hat and black hat are the SEO trade's shorthand for clean and dirty work. Google's own documents use neither phrase, not in its spam policies and not in its page on hiring an SEO. What Google publishes instead is Search Essentials, which has three parts: technical requirements, spam policies and key best practices. Translated, white hat means staying inside all three. Black hat means breaking the second one on purpose and hoping nobody checks.

Google's spam policies, last updated on August 28, 2026, define spam as "techniques used to deceive users or manipulate our Search systems" and state the consequence just as plainly: violating sites may rank lower or not appear in results at all. Google says it finds violations with automated systems and, where needed, human review. This page is the enforcement chapter of our SEO guide: what the rules say, what the punishment looks like, and how to get out.

All sixteen spam policies, in the order Google lists them

The full list as of the August 2026 update. The middle column paraphrases Google; the right column is our read of how an ordinary business ends up there, not Google's wording.

Three of these arrived together. On March 5, 2024, Google announced expired domain abuse, scaled content abuse and site reputation abuse as new policies, and wrote that expired domain abuse is not something people do by accident. Below the sixteen, the page lists more behavior that can demote or remove a site: a high volume of valid copyright or legal removal requests, exploitative personal information removal practices, scams such as impersonating a business to collect payments, and policy circumvention, which means moving the same behavior to a new subdomain, subdirectory or site. Circumvention can cost eligibility for features such as Top Stories and Discover.

Five traps for owners who never meant to cheat

Most small businesses do not set out to deceive Google. They hire someone, install something or copy a competitor, and the result matches a policy anyway. These are the cases we see most, and the fix for each.

Manual action or algorithm: two penalties, different paperwork

"Penalty" is the industry's word. Google says manual action when a person is involved and talks about demotion when its systems act. The difference decides what you can do next, so it is the first thing to establish after a drop.

The Search Status Dashboard keeps the dates. In 2026 it lists spam updates starting March 24, June 24, August 18 and September 24, the last one running about thirteen days. It also lists core updates starting March 27 and May 21, which are not penalties at all: they change how pages are judged without accusing anyone. If you cannot tell which kind hit you, our traffic drop diagnosis sorts the causes, and Google ranking factors covers core updates.

Reading the Manual actions report, notice by notice

Open Google Search Console and find the Manual actions report. A green check mark means no reviewer has flagged the site. Otherwise the report counts the actions and names each one. The notices a business site is likely to see, from Google's Manual actions help page:

The report also carries site reputation notices and a long set of News and Discover policy violations, which matter to publishers more than to a plumber. If pages vanished from Google entirely and the report is empty, look at technical causes first; our guide to a deindexed website walks that path.

Lifting a manual action without making it worse

1. 1

   Read the notice and its URL patterns

   Expand the description to see which patterns are affected. Google notes that not every page matching a pattern is necessarily affected, so fix generously rather than narrowly.

2. 2

   Fix every affected page, not a sample

   Google says fixing the issue on only some pages will not earn a partial return to results. Keep the fixed pages reachable, with no login, paywall, robots.txt block or noindex, or the reviewer cannot see the work.

3. 3

   For a links notice, show the effort

   Download the links from Search Console, ask site owners to remove or nofollow the bad ones, and disavow what you cannot remove. Google warns that disavowing every backlink blindly is not a good-faith effort, and its disavow help page says most sites never need the tool.

4. 4

   Write the request like an incident report

   Google asks for the exact quality issue, the steps taken to fix it and the outcome. Give examples of what you removed and what replaced it. Blaming a former agency is not a fix; describing what you undid is.

5. 5

   Submit once, then wait

   Choose Request Review and do not resubmit before a decision. Google says most reconsideration reviews take several days or weeks, link reviews can take longer, and it emails you when the request arrives and when the review is done.

Algorithmic trouble has no form to fill in. Google's spam updates documentation says changes may help once its systems learn over a period of months that the site complies, and warns that fixes might not bring an improvement. For bought links the news is worse: whatever lift they once gave is gone for good once the systems discount them. Recovery means rising to the level the site earns honestly, which is why visibility recovery work is mostly rebuilding pages and earning links, not filing paperwork.

What the shortcut costs, added up

Take a hypothetical roofer who pays $300 a month for a link package. For a few months the rankings inch up. Then a spam update discounts the links. The money is gone, the lift is gone, and Google says it does not come back. A manual action on top adds hours of link exports, removal emails and a disavow file, then weeks of waiting while competitors take the calls. The honest version of that year would have left the roofer with relationships, pages and reviews that keep working.

A shortcut in SEO is a loan against your own domain, and Google sets the interest rate.

Hiring someone does not move the risk. Google's page on hiring an SEO says "Ultimately, you are responsible for the actions of any companies you hire" and that no one can guarantee a top ranking on Google. Our guide to hiring an SEO lists the questions that expose a black hat vendor, and the trust signals worth building instead are in E-E-A-T.

• Ask any vendor for three links they earned for a business like yours, with the page each one sits on.
• Read the contract for the words "guaranteed" and "package." Either is a reason to keep reading carefully.
• Keep the Search Console property in your name, so a manual action notice reaches you and not only the agency.
• Check Manual actions and Security issues monthly. Both should be empty, and both take ten seconds.

If you suspect old work broke the rules, the free site audit is a sensible first look at the site's health. DataCram's SEO programs do the white hat version by default: no long contract, a defined scope, from $625 a month, with most local businesses between $625 and $2,250 per our SEO pricing.