White / Grey / Black hat SEO

A risk scale, not a morality scale

Google’s Search Essentials name two categories of link behaviour and only two: links that are editorially placed and freely given, and links intended to influence ranking. Every tactic the industry sorts into white, grey or black falls on one side of that single line. The three-hat vocabulary survives anyway, and it should, because it carries information the policy text refuses to give you: how reliably a tactic is detected, how it is punished when it is, and whether the damage is recoverable.

White hat, as a working consultant uses the term in 2026, covers what survives three simultaneous audits: the client’s legal review, a competitor’s spam report, and a core update landing the same quarter. Technical remediation, content a human would cite without being paid, coverage earned on newsworthiness. Grey hat covers tactics that breach the letter of the guidelines while being detected imperfectly and punished probabilistically: paid placements presented as editorial, insertions bought in volume inside existing articles, expired domains rebuilt to carry their historical equity forward. Black hat covers what is both against policy and adversarial to the system itself: hacked injections, cloaking, doorway networks, negative SEO aimed at a competitor’s profile, and now content shaped to poison a generative answer.

The honest position, and the one most proposals avoid putting in writing: virtually all commercial netlinking in France is grey. A link you paid for is a link intended to influence ranking, whatever the invoice line says. The rituals built around that fact, the « editorial collaboration » wording, the pretend outreach email, are theatre for the client rather than camouflage for Google. What separates a serious operation from a reckless one is not the colour of the hat, it is whether the risk is quantified, disclosed and bounded.

How enforcement actually moved in 2026

Read Google’s own Search Status Dashboard rather than a volatility tracker and the past twelve months look like this: an August 2025 spam update that ran 26 days and 15 hours, a December 2025 core update, a February 2026 Discover core update, a March 2026 spam update that rolled out in 19 hours 30 minutes, a March 2026 core update immediately behind it, the May 2026 core update at nearly 12 days, and a June 2026 spam update lasting a bit over two days. Seven confirmed events, and not a single one labelled a link spam update.

That absence is the most useful fact of the year for anyone buying links. When a vendor explains that a rollout « targeted paid links » and that their inventory was spared, ask which confirmation they are reading. There is none. The defensible reading is narrower and less dramatic: link manipulation stayed inside the general spam-enforcement perimeter, and Google chose not to name it separately.

Three documentation changes matter more than the rollouts themselves. On 14 April 2026 Google clarified that spam-report submissions may be used to support manual action, which turns a competitor with a grudge into a functioning enforcement channel and makes a visible footprint far more expensive than a merely statistical one. If you have never read the anatomy of a penalty applied by a human reviewer rather than an algorithm, that is the document to internalise, because the recovery path is completely different. On 13 April 2026 a spam-policy section on back-button hijacking appeared, a reminder that the black-hat catalogue is still being extended in the direction of user deception. And on 15 May 2026 Google stated explicitly that its spam policies apply to generative AI responses in Search, which puts manipulation of AI Overviews and AI Mode into the same policy bucket as manipulation of the ten blue links.

The other lesson of the period is that grey tactics usually die of deprecation rather than penalty. FAQ rich results stopped appearing in Search on 7 May 2026, per Google’s own documentation updates, and an entire schema-stuffing playbook lost its payoff overnight without anyone being sanctioned. Same shape for the 15 June 2026 note that llms.txt is not required by Google Search and carries no ranking effect either way, which ended a small consulting industry before it had a chance to mature. Tactics that depend on a feature rather than on demand have a shelf life set by a product manager, not by an algorithm.

Where the grey zone actually lives in netlinking

Once you accept that paid placement is grey by construction, the useful question becomes which flavour of grey you are buying. A guest article on a real magazine with real readers, a named editor and a rate card is grey with a shallow downside: worst case, the link stops passing value. A link injected into a five-year-old post on a site whose only business is selling paragraphs is grey with a footprint, because the same pattern repeats across every client of that vendor. A network of sites built purely to link outward is grey until the day someone maps the hosting, the registrar pattern or the template reuse, at which point it becomes a single point of failure for every site it points at.

The distinction that survives audit is ownership and visibility, not tactic. When we run placements through a system where the publisher is named before you order, the client can inspect what they are buying: traffic curve, editorial history, outbound-link density, whether the site has an audience or only a metric. Nautilinks owns its French editorial media and writes them in-house, and we publish the list rather than hiding it behind a broker layer. That is not a virtue signal, it is a risk position: a network you can see is a network you can audit, and a network you can audit is one whose footprint you can actually manage instead of hoping nobody looks. The opposite model, the anonymous inventory resold through three intermediaries, is where most unpleasant surprises originate, and it is worth reading how a resale marketplace stacks its margins before assuming the price you pay reflects the risk you take.

Expired domains deserve their own line. Rebuilding an expired domain into a genuine publication, with new content and a coherent editorial line, sits at the acceptable end of grey. Restoring an expired domain’s old URLs purely to 301 them at a money site is a different bet: it works until it does not, and the failure is usually silent, a slow decay rather than a notification in Search Console. Anyone telling you the second is white hat has redefined the word.

What we see go wrong

The recurring failure in audits is not aggression, it is inconsistency. A profile that spent eighteen months at four referring domains a month and then takes forty in three weeks reads as an event regardless of the quality of those forty. The same applies to anchors: a site whose branded share collapses from most of the profile to a minority inside one quarter has changed its own baseline, and the baseline is what any classifier compares against.

Second failure, buying the metric instead of the media. A Domain Rating or a Trust Flow is a vendor’s model of a graph, not a statement about whether a page has readers. Sites engineered to score well on those models are cheap to produce and abundant, which is exactly why their price is low. If a placement costs a fraction of what an actual editorial team would charge to publish, the discount is the risk premium, made visible.

Third, the reflex disavow. Every audit season produces someone who uploads ten thousand domains after a ranking drop that had nothing to do with links. Google’s systems ignore most manipulative links rather than punishing them, and a disavow file is a blunt instrument that can remove value you were still receiving. Reserve it for a manual action or for a genuinely toxic injection campaign you can document.

Fourth, treating black hat as a spectrum extension of grey. It is not. Hacked placements, cloaked redirects and negative SEO carry legal exposure in France on top of search exposure, and no ranking gain justifies putting a client in front of a lawyer. The line here is not tactical, it is one you do not cross.

Operating the grey zone on purpose

Set a risk budget per page, not per campaign. A commercial page that generates most of the revenue can absorb far less exposure than a category page you could rebuild in a week. Concentrating the aggressive placements on the pages you can afford to lose, and keeping the money page fed by links that would survive a human review, is the single most useful allocation rule we apply.

Document every placement as if you will have to defend it: publisher, date, anchor, page, cost, and whether the link is removable. Grey positions become dangerous when they are undocumented, because you cannot unwind what you cannot list. This is also why knowing what a placement actually costs before you price the risk matters more than negotiating a discount: an opaque price hides an opaque inventory.

Finally, change what you measure. Pew Research, in a study published on 22 July 2025 covering 68,879 real Google searches from 900 US adults, found that when an AI summary appeared users clicked a traditional result on 8% of visits versus 15% without one, and clicked a source cited inside the summary on 1%. Whatever the exact transfer to French SERPs, the direction is clear enough: a share of the payoff from any ranking tactic, white or grey, now lands as a citation rather than a click. Judging a netlinking programme purely on positions, while the answer layer absorbs the query, will make a working programme look dead and a dead one look fine. Track branded demand, qualified conversions and citation presence alongside rankings, and pick your hat with the arithmetic in front of you rather than the vocabulary.