White hat link building, defined by what survives.

Penguin folded into the core algorithm in 2016, and the link spam updates from December 2022 onward completed a shift in enforcement philosophy. SpamBrain, Google's machine-learning spam system, now identifies unnatural links and neutralizes them so they pass no value, mostly without telling anyone. Penalties still exist, but they are no longer the main deterrent. The main deterrent is futility: gray-hat links increasingly just stop counting.

That moves the bar. The question is no longer "will this get me penalized" but "will Google count this at all," and the only reliable yes is a link with editorial merit behind it.

Sorting common tactics by how Google's systems treat them:

• White: data studies journalists cover, expert commentary in press articles, responses to live journalist requests, reclaimed unlinked brand mentions, free tools and research people cite without being asked.
• Gray: mass guest posting on "write for us" sites, niche edits that pay to insert links into old articles, systematic link exchanges, scholarship and sponsorship schemes built for the link. Some of it still passes value some of the time, which is what makes it a slow leak that's easy to miss.
• Black:PBNs, undisclosed paid dofollow links, hacked and injected links, automated comment spam, tiered link pyramids. These are cheap, easy to detect, and the main target of Google's spam systems.

Enforcement follows a visible pattern. Algorithmic devaluation runs continuously and silently, and appears to handle most link spam. Link spam updates arrive as announced recalibrations on the Search Status Dashboard, and sites that leaned on gray tactics watch rankings sag without any message in Search Console. Manual actions are the rare, targeted layer: they come with a notice, they hit link sellers as well as buyers, and they concentrate on egregious, large-scale schemes.

The practical read: gray tactics rarely trigger punishment anymore. They fail silently while the invoices keep arriving, which is a worse failure mode than a penalty, because a penalty at least tells you to stop.

The durable tactics share one property: the link is a byproduct of something a journalist or reader wanted.

• Reactive PR: answering live journalist requests with fast, specific, credentialed comment
• Data-led campaigns: original analysis that hands reporters a headline they cannot get elsewhere
• Expert commentary: building a spokesperson journalists quote on their beat, repeatedly
• Mention reclamation: finding places that already cite you without linking and asking for the credit
• Citable assets: calculators, benchmarks, and research that earn references for years after publication

Budget alone can't scale these tactics, and they can't be faked at volume, which is why white hat link building keeps working.

White hat costs more per link and moves slower in the first month. The premium buys links that hold their value through updates, no cleanup debt, coverage that can drive brand searches and double as sales collateral, and the kind of sources AI search tools may draw on when they choose what to cite. Gray hat looks cheaper up front, but the cost arrives later as wasted spend and cleanup.

Budget for fewer, better links, and hold whoever builds them to the standard a manual reviewer would apply. That applies to an in-house team as much as to any agency you shortlist.