Google Rewrote the Site Reputation Policy on August 28. Read It Before You Sell Another Sponsored Listing

On 28 August 2026 Google rewrote the section of its spam policies that governs third-party content on a host site. Most of the SEO coverage you'll see this week frames it as a rename — "site reputation abuse" became "site reputation policy," "violation" became "inconsistent with the policy." That's the least interesting part.

The interesting parts are that Google published a list of four objective factors a human reviewer weighs, and that the consequence of failing that review is now completely different depending on where the searcher is sitting. If you run a directory, this matters to you more than it matters to almost anyone else on the web, for a reason that's structural rather than behavioural: every listing on your site is third-party content by Google's own definition. You are, by construction, exactly the kind of site this policy describes.

That doesn't mean you're in trouble. It means the line is drawn in a place you should know precisely rather than approximately.

What actually changed

Two things, both on the spam policies page and both announced in Google's blog post of the same date.

First, the enforcement mechanism split by geography. Google now describes two different outcomes for the same finding:

Google also states that previous EEA manual actions under this policy are being lifted, that the fact of a prior manual action isn't used as a ranking signal inside the EEA, and that a manual action outside the EEA doesn't feed into rankings inside it. There's a new reconsideration process for EEA sites and an alternative dispute resolution scheme run through CEDR.

Second, Google published the review criteria. This is the part worth printing out. The policy now names four factors a reviewer considers, "aimed at understanding the degree to which the host domain exercises control over the page content":

• How the content is presented — are graphic design, formatting, typography and UX consistent with the host domain?
• The quality of the content — are there quality issues on the page that don't appear on the main domain?
• Its stated or implied authorship — is there explicit acknowledgement of ownership or responsibility?
• Does the content appear on multiple other sites in identical or near-identical form?

Google is explicit that no single factor is necessary or sufficient on its own. But four named criteria is four more than we had, and three of the four map directly onto decisions you make when you build a directory.

Why "we host third-party content" is not the problem

Read the definition literally, because the qualifier is doing all the work:

The site reputation policy applies where third-party content is published on a host site mainly because of that host's already-established ranking signals, which it has earned primarily from its first-party content.

And then, immediately after:

Having third-party content alone isn't inconsistent with the site reputation policy; it's only inconsistent if the third-party content is published on a host site mainly because of that host site's already-established ranking signals.

Google's own list of things that are not inconsistent with the policy includes user-generated content sites such as forums and comment sections, syndicated news, editorial columns and opinion pieces, advertorials whose purpose is to reach readers rather than to rank, and "using affiliate links throughout a page, with links treated appropriately."

A directory of coffee roasters, where each listing exists because a user of your site wants to be found by other users of your site, sits comfortably inside that list. The listing is third-party content and it's there for readers. Nothing about the business model triggers this policy.

What triggers it is the word mainly. The moment a section of your directory exists primarily because your domain ranks — rather than because your audience wants it — you're on the wrong side of the sentence. And there are three specific ways directory operators walk into that, usually while trying to make money.

Three patterns that put a directory on the wrong side

1. Selling the domain rather than the placement

There's a real difference between selling a business a better position in your directory and selling an unrelated company a page on your domain.

The first is what promotions and sponsor placements are for: a roaster already listed on your site pays $39/month to have their card promoted in the catalogue grid. The content is the same listing your readers came for; money changes its position, not its nature.

The second is the pattern Google's second worked example describes almost exactly — a publication hosting "an article including links to a marketplace" with no identified author, no commercial disclaimer, no link from any thematic section, duplicating content from a third-party marketplace. Rewrite that as a directory and you get: a /deals/ or /partners/ subfolder nobody navigates to from your header, filled with pages an outside agency wrote, about a category your directory doesn't otherwise cover. If someone has ever offered you three figures a month for "a page on your site," this is what they were buying.

2. Paid links that pass ranking credit

This one isn't even the site reputation policy — it's the separate link spam section, and it's the single most common way a monetised directory gets itself into trouble.

Google's position is unambiguous and, to its credit, not moralistic:

Google does understand that buying and selling links is a normal part of the economy of the web for advertising and sponsorship purposes. It's not a violation of our policies to have such links as long as they are qualified with a rel="nofollow" or rel="sponsored" attribute value to the <a> tag.

So: paid listings are fine. Paid listings whose outbound website link passes ranking credit are link spam. The fix is one attribute, and the qualifying outbound links documentation spells out which value to use. Two things worth checking in your own codebase today, because most directory templates get at least one wrong:

• Does the outbound link on a paid or promoted listing carry rel="sponsored"?
• Does your submission form let anyone add a link, and if so, does the rendered link carry rel="nofollow" until a human has approved it?

The link spam section also names "low-quality directory or bookmark site links" as an example of link spam. That's aimed at the buyer, not you — but it's a useful reminder of what the category looks like from Google's side, and a reason to be selective about who you accept.

3. Bulk descriptions that exist on forty other sites

The fourth review factor — content appearing on multiple sites in identical or near-identical form — is the one that catches honest operators by accident.

If you seeded your directory from a CSV and generated descriptions from each business's own homepage, you have a fleet of pages whose text is a light paraphrase of text that already exists elsewhere. That's not site reputation abuse on its own, but it lands you in two other policies at once: scaled content abuse ("using generative AI tools or other similar tools to generate many pages without adding value for users") and, if you're monetising through affiliate links, thin affiliation ("product descriptions and reviews are copied directly from the original merchant without any original content or added value").

We build a description generator into DirectoryLaunch and we document it, so let's be straight about it: AI enrichment is a tool for getting a submitter past a blank textarea, not a strategy for manufacturing a thousand indexable pages. The difference between the two is whether a human ever looks at the output. If your import pipeline goes CSV → LLM → published with no review step, you've built the thing the policy describes, and you built it faster than a human spammer could have. The data-sourcing workflow we've written about works because enrichment is one step of several, not the whole pipeline.

Google's own remedy for content in this category is blunt: "If you're hosting such content on your site, exclude it from Search." Sometimes the right move on ten thousand thin pages is noindex, not a rewrite.

The four factors, translated into directory questions

Here's the same list from earlier, rewritten as things you can actually check on your own site this afternoon.

Google's first worked example — the one it says it's unlikely to take action on — is worth studying because it's essentially a directory. A publisher runs a coupons section with a specialist partner, on a different CMS, under a subfolder. It survives because it's linked from the homepage and from article snippets, organised into categories specific to that publisher, disclosed as commercial, attributed to a named editorial team, cross-referenced in the publisher's own editorial and newsletters, and reachable from the main nav — with a contact route for problems. Different CMS and outside partner and largely non-exclusive content, and it still passes, because every signal of editorial control is present.

That's the bar. It's not "don't take money." It's "own what you publish."

What this doesn't change

Three things are unchanged, and it's worth saying so plainly because the discourse this week will blur them.

Programmatic pages are not covered by this policy. City and category pages you generate from your own data are first-party content, whatever their volume. The risk on those pages was always thinness and crawl budget, not site reputation — that's a different conversation entirely, and it's the one most directory operators should be having instead.

Structured data is unaffected. Nothing in this revision touches markup, and marking up a sponsored listing correctly doesn't launder it. If you're still working out what markup earns you, we covered what actually shows up in Google separately.

Monetising a directory is not the risk factor. Google's non-examples list explicitly protects advertorials aimed at readers and properly-qualified affiliate links. Charging for placement, charging for leads, charging for anything at all — none of that is what this policy is about. The risk factor is publishing content you didn't choose, don't stand behind, and can't be reached about.

What to do tomorrow morning

Give this ninety minutes, in this order.

1. Open every URL on your site that someone paid to have published. Not paid to have promoted — paid to have published. If that list is empty, you're done with the site reputation part; skip to step 4.
2. For each one, run the four-factor table above and write down which factors it fails. Failing on presentation is a CSS afternoon. Failing on authorship is a byline and a disclosure line. Failing on all four means the page was never really yours.
3. Check whether those pages are reachable from your main navigation. In both of Google's worked examples, integration into the site's own navigation and editorial is what separated "unlikely to take action" from "likely."
4. Grep your templates for outbound listing links and confirm the paid ones carry rel="sponsored". This takes five minutes and is the highest-value item on the list, because it's the one where the rule is a bright line rather than a judgement call.
5. Pull twenty listing descriptions at random and search an exact phrase from each. If more than a handful return the business's own site verbatim, your enrichment step needs a human in it before your next import.
6. Subscribe to the documentation updates page or its RSS feed. This revision landed with no fanfare beyond one blog post; the next one will too.

None of this is emergency work. But the review criteria are public now for the first time, which means "we didn't know where the line was" has stopped being an available position.