White hat link building, defined by what survives.

Penguin folded into the core algorithm in 2016, and the link spam updates from December 2022 onward completed a shift in enforcement philosophy. SpamBrain, Google's machine-learning spam system, now identifies unnatural links and neutralizes them so they pass no value, mostly without telling anyone. Penalties still exist, but they are no longer the main deterrent. The main deterrent is futility: gray-hat links increasingly just stop counting.

That moves the bar. The question is no longer "will this get me penalized" but "will Google count this at all," and the only reliable yes is a link with genuine editorial merit behind it.

Sorting common tactics by how Google's systems treat them:

• White: data studies journalists cover, expert commentary in press articles, responses to live journalist requests, reclaimed unlinked brand mentions, free tools and research people cite without being asked.
• Gray: mass guest posting on "write for us" sites, niche edits that pay to insert links into old articles, systematic link exchanges, scholarship and sponsorship schemes built for the link. Some of it still passes value some of the time, which is exactly what makes it a slow leak rather than an obvious loss.
• Black:PBNs, undisclosed paid dofollow links, hacked and injected links, automated comment spam, tiered link pyramids. Cheap, detectable, and the specific target of every spam system Google ships.

Enforcement follows a visible pattern. Algorithmic devaluation runs continuously and silently, and handles the overwhelming majority of link spam. Link spam updates arrive as announced recalibrations on the Search Status Dashboard, and sites that leaned on gray tactics watch rankings sag without any message in Search Console. Manual actions are the rare, targeted layer: they come with a notice, they hit link sellers as well as buyers, and they concentrate on egregious, large-scale schemes.

The practical read: gray tactics rarely trigger punishment anymore. They fail silently while the invoices keep arriving, which is a worse failure mode than a penalty, because a penalty at least tells you to stop.

The durable tactics share one property: the link is a byproduct of something a journalist or reader actually wanted.

• Reactive PR: answering live journalist requests with fast, specific, credentialed comment
• Data-led campaigns: original analysis that hands reporters a headline they cannot get elsewhere
• Expert commentary: building a spokesperson journalists quote on their beat, repeatedly
• Mention reclamation: finding places that already cite you without linking and asking for the credit
• Citable assets: calculators, benchmarks, and research that earn references for years after publication

These scale with merit rather than budget alone, which is the point. White hat link building cannot be faked at volume, and that is precisely why it keeps working.

White hat costs more per link and moves slower in the first month. The premium buys links that survive every update instead of needing replacement, zero cleanup debt, coverage that produces brand searches and sales collateral, and citations that AI search engines draw on when they choose sources. Gray hat is not cheaper; it is deferred cost with interest.

Budget for fewer, better links, and hold whoever builds them to the standard a manual reviewer would apply. That applies to an in-house team as much as to any agency you shortlist.