The question usually turns up after a sudden change in the backlink report: a wave of new links from forums, directories or comment threads, all carrying rel="nofollow". Can links like these earn you a Google penalty? The answer is worth restating, because Google's own position changed in September 2019. Since then, nofollow is a hint, not a directive.
Short answer: no. Receiving nofollow links does not trigger a sanction. Risky situations do exist, but they come from behaviour — comment spam at scale, undeclared commercial links — and not from the attribute itself.
Below is what Google's published documentation actually says, what changed after 2019, and what all of it means in practice for a business site.
Since 2019, nofollow is a hint rather than a directive
On 10 September 2019, Google announced two new link attributes, rel="sponsored" and rel="ugc", and changed the status of nofollow at the same time. The official post is explicit: all three attributes are treated as hints about which links to consider or exclude in Search. That treatment applied immediately to ranking; for crawling and indexing, nofollow became a hint on 1 March 2020 (Google Search Central, 2019).
The reasoning Google gave matters for everything that follows: a link carries useful information, including for understanding unnatural link patterns. In other words, Google no longer systematically drops nofollow links from its view of the web. It sees them, even though it generally gives them no endorsement value.
Two qualifications are worth keeping in mind. First, "hint" does not mean nofollow now passes authority: in the same FAQ, Google states that in most cases these links continue to be ignored for ranking. Second, nofollow was never a way to keep a page out of the index, and it is even less so since March 2020. For that you need a noindex robots tag or password protection. If that is your actual problem, our page on controlling indexing covers it properly.
| Attribute | Recommended use | Expected effect |
|---|---|---|
rel="sponsored" |
Advertising, paid articles, affiliate links, anything given in exchange for something | Marks the link as commercial; Google's preferred value for this case |
rel="ugc" |
Content submitted by third parties: comments, forum posts, reviews | Marks a link the site has not editorially endorsed |
rel="nofollow" |
Other cases where you do not want to vouch for the linked page | Still valid for advertising and user content; no need to change existing markup |
The three values can be combined, and Google says plainly that there is no obligation to convert nofollow attributes already in place.
<!-- paid placement -->
<a href="https://example.com/" rel="sponsored">Partner offer</a>
<!-- link left by a reader in a comment -->
<a href="https://example.com/" rel="ugc">example.com</a>
<!-- both values at once is valid markup -->
<a href="https://example.com/" rel="ugc sponsored">example.com</a>Why an inbound nofollow link does not penalise you
You do not choose who links to you. A search engine that punished sites on that basis alone would hand a sabotage tool to anyone willing to use it. Google said as much long before the 2019 change: nofollow links do not normally harm a site, except in cases of obvious abuse at very large scale, where a manual action remains possible. More than a decade later, the principle has not moved, but the mechanics have.
Google's default response to artificial links is no longer a penalty, it is neutralisation. When the link spam update of 14 December 2022 rolled out, Google wrote that rankings may shift as spammy links are neutralised and any credit passed by those unnatural links is lost (Google Search Central, December 2022). In its webspam report covering 2022, Google said it had detected fifty times more link spam sites than during the previous update — a figure declared by Google, with no published methodology (Webspam Report 2022).
On the sanctions side, the Manual Actions report in Search Console lists two link-related reasons: unnatural links to your site, and unnatural links from your site. The test is whether the arrangement is deceptive or manipulative, never whether an attribute is present or absent (Search Console Help).
Three situations where nofollow genuinely matters
1. Comment and forum spam at scale
Google's spam policies name forum comments with optimised links in the post or signature as a link spam tactic. Adding nofollow does not make the practice acceptable, because what is judged is the volume and the intent. The host site is exposed too: leaving open spaces unmoderated can bring a user-generated spam manual action against the forum or blog itself.
2. Undeclared commercial links on your own site
This is the real penalty risk attached to these attributes, and it comes from their absence, not their presence. Google accepts that buying and selling links is part of the normal economy of the web, as long as those links are qualified with rel="nofollow" or rel="sponsored" (spam policies). Without that markup, a paid article, a partner banner or an affiliate link falls into the unnatural links category.
3. Nofollow used as camouflage
Some paid link campaigns add a nofollow in the belief that it buys protection. Since 2019 that is a questionable calculation, because Google explicitly looks at all links in order to spot unnatural patterns. A profile made of hundreds of near-identical links is still a pattern signal, marked or not. We set out that logic in more detail on our link building page.
Spam reports do not trigger an automatic sanction
A persistent assumption is that a penalty involving nofollow links would come from a competitor reporting you. That is worth correcting. On 3 July 2020, Google clarified that spam reports are used only to improve its spam detection algorithms. The same post notes that Google receives hundreds of reports a day and that, while many do lead to manual actions, they account for a small share of the manual actions issued, most of which come from the internal teams' own work (Google Search Central, July 2020).
In practice: a competitor reporting you does not press a penalty button. And a manual action is always notified in Search Console, with a reconsideration request available. No notification means no manual action, however bad the rankings look that week.
What helps, and what does not
- Do not disavow by reflex. Google is blunt about this: the disavow tool is not useful for most sites, and is only justified when a considerable number of artificial links point at you and they have caused, or are likely to cause, a manual action (Google Help). A badly built disavow file can remove legitimate signals.
- Qualify your outgoing links. Use
sponsoredfor anything paid for,ugcfor comments and forums. Google preferssponsoredbut acceptsnofollow, so there is no need to rewrite your archives. - Moderate your open spaces. Comments, member profiles, internal directories: this is your responsibility as publisher, and it is the first thing that gets checked.
- Monitor rather than react. The Links report in Search Console is enough for most small and mid-sized businesses. Pointing a simple dashboard at it lets you follow the shape of the profile over time without spending an hour on it every week.
The newer attributes are still rarely used
One useful marker on real-world adoption. The 2025 edition of the Web Almanac, based on the July 2025 HTTP Archive crawl of 16,213,084 sites (home pages, lab testing), found nofollow present on 32.3% of sites analysed on mobile and 30.8% on desktop, against 0.5% for sponsored and 0.5% to 0.6% for ugc (Web Almanac 2025, SEO chapter).
Six years after launch, the finer-grained attributes remain marginal. That is not a problem in itself, since nofollow is still accepted. But it is a reminder that an outgoing link audit almost always turns up commercial links nobody ever qualified. That, and not the inbound side, is where the real exposure sits. Our backlink audit and technical SEO audit pages cover the two halves of the question.
Common questions
Does a nofollow link pass authority to my site?
Not in the vast majority of cases. Since September 2019 Google has treated nofollow, sponsored and ugc as hints rather than directives, but it also states that these links generally continue to be ignored for ranking. Their value lies in direct traffic and visibility instead.
Should I disavow the nofollow links pointing at my site?
No. Google says the disavow tool is not useful for most sites and reserves it for cases where a large number of artificial links has caused a manual action, or looks likely to. A poorly built disavow file can strip out legitimate signals along with the rest.
Do affiliate links have to be marked as sponsored?
Yes, or nofollow as a fallback. Google treats the sale of advertising links as normal provided they carry rel="sponsored" or rel="nofollow". Without that markup they fall under unnatural links and expose the site to a link scheme action.
Can a competitor get me penalised with nofollow links?
It is very unlikely. Google neutralises links it judges artificial rather than sanctioning the targeted site, and spam reports officially feed its detection algorithms rather than triggering a penalty. Any manual action is always notified in Search Console.
Does nofollow stop the linked page from being indexed?
No, and it never did that job. Since 1 March 2020 nofollow has been a hint for crawling and indexing as well. To keep a page out of the index you need a meta robots noindex tag, password protection, or removal of the page.
Are links from social media worth anything?
They are generally nofollow or ugc, so they pass no direct authority. Their value is elsewhere: traffic, awareness, and sometimes helping a new page get discovered. They carry no penalty risk.
How do I know whether I actually have a manual action?
Open the Manual Actions report in Search Console. If it reports no issues, you do not have one, whatever a ranking drop might suggest. Algorithmic neutralisation of links is not a manual action and produces no notification.