Google Spam Policies and Manual Actions: What Actually Triggers Them

TL;DR: Manual actions are rare for legitimate local businesses and common for ones who bought links or let an agency run a scaled-content scheme on their domain. The important skill isn’t recovery — it’s recognizing which of the tactics being sold to you carry this risk. If you’ve had a traffic drop, the first job is determining whether it’s a manual action at all, because most drops aren’t.

Table of Contents

• Manual action versus algorithmic drop
• The policies local businesses actually brush against
• How to check whether you have one
• The reconsideration request
• Staying clean when you’re scaling content
• What to do about a previous agency’s work

Manual Action Versus Algorithmic Drop

These get conflated constantly and the difference determines everything you do next.

A manual action means a human reviewer at Google looked at your site and applied a penalty. It appears in Search Console under Security & Manual Actions. It’s a specific, named, notified event. It requires a reconsideration request to lift.

An algorithmic drop means a ranking system reassessed your site. Nothing is reported. No notification arrives. There’s nothing to appeal — you improve the site and wait for reassessment.

Most traffic drops are algorithmic, seasonal, or competitive. We’ve reviewed plenty of sites where the owner was convinced they’d been penalized and the actual cause was a competitor publishing better content, a seasonal demand curve, or a broad core update. We’ve also seen sites where a genuine manual action sat unread in Search Console for eight months.

Check first. It takes thirty seconds and it determines whether you spend the next quarter appealing or improving. (For the algorithmic side, we’ve written about recovery timelines after an algorithmic penalty.)

The Policies Local Businesses Actually Brush Against

Google publishes a full spam policy list. Most of it — cloaking, hacked content, malware — isn’t what trips up service businesses. Five are.

Link spam. Buying links, exchanging links at scale, or using a service that places your links across a network of sites built for that purpose. This is the single most common cause of manual actions on small business sites, and it’s almost always something an agency did on the client’s behalf. If you’ve ever bought “10 links per month” without seeing the URLs, this applies to you.

Scaled content abuse. Generating large volumes of pages primarily to manipulate rankings rather than to help anyone. The policy language changed in 2024 to focus on the purpose and value of the content rather than how it was produced — which means AI-generated content isn’t automatically a violation, and human-written thin content isn’t automatically safe. Four hundred city pages with a swapped place name is the local-business version of this.

Site reputation abuse. Hosting third-party content on your domain to exploit your site’s standing — the “parasite SEO” pattern. Relevant if anyone has ever pitched you on hosting a partner’s content section or renting out a subdirectory. Don’t.

Keyword stuffing. Rare now in body copy, still common in Google Business Profile business names. “Asheville Plumber — Emergency 24 Hour Drain Repair” as a business name is a violation of GBP guidelines specifically, and enforcement there can be swift and severe.

Misleading structured data. Marking up reviews you don’t have, or FAQ content that isn’t on the page. Usually produces a structured-data manual action rather than a sitewide one — narrower, but it removes your rich results.

Notice the pattern: four of the five are things a vendor does to you, not things you’d do yourself.

How to Check Whether You Have One

Search Console → Security & Manual Actions → Manual Actions. If it says “No issues detected,” you don’t have a manual action. Full stop. Whatever caused your traffic change is something else.

If there is an action, the notice names the type and scope. Scope matters enormously:

• Sitewide — affects everything. Serious.
• Partial / URL-level — affects specific pages or sections. Often much easier to resolve, because you can remove or fix the affected section.

Also check Security Issues in the same area. Hacked content produces a different notice and a different fix, and a surprising number of “penalties” on older WordPress sites are actually a hacked-content problem — injected spam pages the owner never knew existed.

If Search Console shows nothing and traffic dropped, work the alternatives: check whether the drop aligns with a known core update date, whether it’s concentrated on specific pages or sitewide, whether impressions fell or only clicks fell, and whether a competitor moved. Those four questions resolve most cases.

The Reconsideration Request

If you do have one, the process is straightforward and the standard is high.

1. Fix the actual problem first. Not partially. Reconsideration requests are reviewed by people who see hundreds of these, and a request submitted before the cleanup is complete gets rejected and costs you weeks.

2. Document what you found. Be specific about scale — how many links, from where, over what period.

3. Remove what you can, disavow what you can’t. For link spam: actually attempt removal, keep records of the outreach, and disavow the remainder. The removal attempt matters to reviewers even when it fails.

4. Explain what changed structurally. Not just “we removed the links” but “we terminated the vendor relationship, and here’s our new link acquisition process.” Reviewers are assessing whether the problem recurs.

5. Be honest. Including about the fact that a previous agency did it. That’s an extremely common situation and it doesn’t count against you. Minimizing or misrepresenting does.

Expect weeks, not days. Multiple rounds are normal for sitewide link actions.

Staying Clean When You’re Scaling Content

The scaled-content policy is where legitimate businesses are most likely to drift into trouble, because generating location and service pages at volume is a genuinely reasonable strategy done properly.

The line isn’t volume and it isn’t whether AI was involved. It’s whether each page offers something a visitor couldn’t get from a sibling page. Practically:

• Every page needs information that could only be true of that page — a real job reference, a real photo, a genuine local condition.
• If the only difference between two pages is a find-and-replace, you’ve published one page twice.
• If you wouldn’t link to it from a service page, don’t publish it.
• Publish in batches and check indexing before scaling. Pages that don’t get indexed are Google telling you they’re not distinct enough — and continuing anyway is how a content program becomes a pattern.

What to Do About a Previous Agency’s Work

If you inherited a site and don’t know what was done to it, three checks:

Search Console → Links → Top linking sites. Scan for domains that look like link networks — unrelated topics, foreign-language sites, directories with no editorial standard, sites whose entire content is guest posts. A handful of odd links is normal for any site. Hundreds of them from the same footprint is not.

Crawl your own site and count pages. If there are far more URLs than you expected, find out what they are. We regularly find inherited city-page sets the owner didn’t know existed.

Check your Google Business Profile name against your actual legal or trading name.

None of this requires a penalty to be worth doing. It’s the same audit either way, and knowing what’s on your own domain is a reasonable baseline.

Quick Recap

• Manual actions are notified in Search Console; algorithmic drops aren’t. Check before you act.
• Five policies matter for local businesses: link spam, scaled content abuse, site reputation abuse, keyword stuffing in GBP names, and misleading structured data.
• Four of the five are usually done to you by a vendor.
• Fix completely before submitting a reconsideration request, document scale, and explain what changed structurally.
• The scaled-content line is per-page distinctness, not volume and not whether AI was used.

Frequently Asked Questions

Will using AI to write content get me penalized?
Not by itself. The policy targets content produced primarily to manipulate rankings without offering value. AI-assisted content that’s accurate, specific, and useful is fine; thin AI content published at volume is the problem — same as thin human content.

How long does a manual action last?
Until it’s lifted through reconsideration. It doesn’t expire on its own.

Can a competitor get me penalized with bad links?
It’s very difficult. Google’s systems generally ignore obvious junk links pointing at you. Negative SEO is far more discussed than observed.

Do I need to disavow links?
Rarely, and only in the context of a known link-related manual action. For a healthy site with no action, the disavow file is usually unnecessary.

My traffic dropped but Search Console shows no issues. What now?
Compare the drop date against known core update dates, check whether it’s sitewide or page-specific, and check whether impressions or only clicks moved. Those three answers point at the real cause in most cases.