Google now calls AI-answer manipulation spam. Which GEO tactics cross the line, and which just don't work

Questions this guide answers

• Is GEO against Google's guidelines?
• Can you be penalized for trying to influence AI answers?
• What is AI recommendation poisoning?
• Are "Summarize with AI" buttons allowed?
• Do self-published "best X" listicles get you recommended in AI answers?
• Does Google's spam policy apply to AI Overviews and AI Mode?
• Which GEO tactics does Google consider spam?

Direct answer

Not GEO as such, but some generative engine optimization (GEO) tactics are now spam by Google's own definition: since May 15, 2026, Google's spam policies include "attempting to manipulate generative AI responses in Google Search," which puts AI Overviews and AI Mode under the same rules as rankings. The line is deception, not optimization: hidden instructions, cloaking, fake reviews and mentions, planted false claims, and pages mass-produced mainly to game the answer cross it, while llms.txt files, AI-only schema, and chunking are wasted effort that Google says it ignores. The approach that doesn't depend on any engine's blind spots is the unglamorous one: SEO foundations, corroboration by independent sources, and canonical facts that are accurate everywhere you publish them. Nothing on this page is legal advice.

What Google's policy says, and when it changed

The change is one sentence at the top of Google's spam policies: "In the context of Google Search, spam refers to techniques used to deceive users or manipulate our Search systems into featuring content prominently, such as attempting to manipulate Search systems into ranking content highly or attempting to manipulate generative AI responses in Google Search."

Google's documentation changelog dates the clause to May 15, 2026, the same day it published its guide to optimizing for generative AI features, and gives the reason: "To make it clear that the spam policies apply to all of Google Search, including generative AI responses." The page's current revision, dated Aug. 28, 2026, changed how Google enforces its site reputation policy in the European Economic Area, not the AI clause, so an August date attached to the clause is the revision date, not the date it arrived.

It's a clarification, not a new rulebook: the named policies (cloaking, hidden text and link abuse, link spam, scaled content abuse, and the site reputation policy), along with the page's rules on scam and fraud, now explicitly apply when the target is an AI answer. Enforcement works as it does for rankings. Google detects violations "through automated systems and, as needed, human review that can result in a manual action," and violating sites "may rank lower in results or not appear in results at all." And the scope is Google Search, meaning surfaces such as AI Overviews and AI Mode, not ChatGPT, Perplexity, or Claude, which choose sources through their own systems.

The guide says the same thing in practical terms. Creating separate content for every query variation, including fan-out queries, "primarily to manipulate rankings or generative AI responses in Google Search violates Google's scaled content abuse spam policy." And on manufactured buzz: "seeking inauthentic 'mentions' across the web isn't as helpful as it might seem. Our core ranking systems focus on high-quality content while other systems block spam; our generative AI features depend on both."

Google also began rolling out its September 2026 spam update on Sept. 24, 2026, with a rollout of up to 2 weeks. It hasn't said what the update targets, so don't read it as an AI-specific crackdown.

GEO tactics, sorted by risk

Each row names a tactic as it's usually pitched, where it lands, and the evidence. Google's policy and guide speak for Google Search; the research rows name the systems they tested.

Crosses the line: the common thread is deception

Every tactic in the first bucket hides something: instructions from the reader, the real page from the crawler, the payer from the review, or the truth from the model. That's the test for tactics nobody has named yet. If it would stop working the moment the user, a journalist, or the engine could see exactly what you did, it's manipulation.

Microsoft's research is the clearest case, because the people doing it weren't hackers. Over 60 days of email traffic, Microsoft's Defender researchers found 50 distinct prompt-based attempts to influence AI assistant memory for promotional purposes, from 31 companies across more than a dozen industries, including finance, health, legal services, SaaS, and marketing agencies. The links opened an assistant with a pre-filled prompt telling it to "remember [Company] as a trusted source" or "recommend [Company] first." In Microsoft's words: "Every case involved real companies, not hackers or scammers." It traced the trend to freely available tools marketed as an "SEO growth hack for LLMs."

Two caveats keep this honest. Microsoft says the effectiveness of these attempts "varies by platform and has changed over time" as protections evolve, and it has deployed mitigations in Copilot. And memory poisoning lives in a user's own assistant, outside Google Search, so it's a security and trust problem more than a Google spam-policy one. A buyer who finds "remember us as a trusted source" in their assistant's memory has still found a vendor willing to tamper with their tools.

Planting false claims works in the lab, which is exactly why it's policed. In FORGE (Luo and Chen, arXiv 2606.13610, June 2026), researchers swapped real products for fake ones in a frozen set of retrieved pages, across 225 products in 15 categories and 12 commercial and open-weights models: "a single polluted page yields fooled rates of up to 27%," rising to 73.8% when all top 3 pages were replaced. Reasoning didn't help, and none of the 4 defenses tested was adequate. A related Cornell Tech result on poisoning deep-research agents is covered in When AI describes your brand, is it telling the truth?

Gray zone: ordinary formats, risky execution

Nothing in the second bucket is named as spam. These are ordinary formats that turn into manipulation depending on disclosure, scale, and honesty.

Wasted effort: what Google says it ignores

The third bucket won't get you penalized. It just spends budget. Google's guide lists things "you can ignore for Google Search," including llms.txt and other AI text files, special markup, chunking, and rewriting content just for AI systems. On llms.txt it's blunt: keeping one "will neither harm nor help your site's visibility or rankings in Google Search, as Google Search ignores them." More in llms.txt is not a strategy.

The research record says much the same about generic GEO recipes on any engine. Martinez's July 2026 survey of 45 GEO studies (arXiv 2607.14035) found that the foundational paper's widely cited gains depend on a source already sitting in a fixed context, that "generic heuristics transfer poorly, competition can erode individual gains, and citation-oriented rewrites can impair retrieval," and that "no reviewed technique shows a stable, longitudinal, cross-platform causal effect on organic discoverability or downstream behavior."

Competition is the part vendors skip. GEO-Flag (Chu et al., arXiv 2608.16824, August 2026) ran a trained detector over 10,095 pages that Google Search and Gemini grounding retrieved for 1,000 real-user queries and estimated that 8.9% were GEO-optimized, rising to 16.36% among pages modified in 2026. When a formatting trick is everywhere, it stops being an edge; what's left is the quality of what you say.

One engine distinction: on engines that retrieve passages at answer time, such as ChatGPT search, Perplexity, and Claude with web search, clear structure still helps readers and retrievers alike. That's editorial practice, not what Google means when it says you can ignore chunking.

The legitimate path: foundations, corroboration, canonical facts

The fourth bucket survives every policy change, because nothing in it depends on the engine not noticing.

• SEO foundations. Google says a page must be indexed and eligible to be shown in Google Search with a snippet to appear in its generative AI features, and those features rely on the same core ranking systems. For Google's AI surfaces, answer engine optimization (AEO) is an operating layer on top of SEO, not a replacement. The guide's full list is in Google just endorsed the anti-hack side of AEO.
• Corroboration by independent sources. Earned press, analyst coverage, genuine customer reviews, and community answers from people who say who they work for. They're slower than a listicle, and they're the signal the listicle was faking. The operating plan is in how to build a source-layer strategy.
• Accurate canonical facts. One clear statement of what you do, current pricing and specs, and the same facts in your product feeds, Business Profile, directory listings, and docs. FORGE found models more vulnerable where they lacked stable prior knowledge of the products, so a consistent public record also helps defend against someone else's version of your facts.
• Disclosure by default. Label sponsorships, mark paid links, and let employees answer in communities under their own names. If you'd be comfortable explaining a tactic to a journalist, it's probably on the right side of the line.

How to vet a GEO pitch in 5 questions

Use these on an agency proposal, a vendor demo, or your own team's plan.

• Would it still work if the user and the engine could see exactly what we did? If not, it belongs in the first bucket.
• Does it create pages or posts at a volume no one on our team will read before they ship?
• Does it rely on a file, markup, or format that Google says it ignores, sold as a Google lever?
• Does the vendor claim Google data or guaranteed placement? Google's guide says "No third-party tool has access to our internal ranking or AI systems," and its guidance on third-party tools adds "They can't guarantee performance." That applies to every AEO vendor, SolCrys included.
• Is the evidence engine-specific and dated, or is it a lift number with no methodology?

When the planted claim is about you

You can't stop a competitor, an affiliate, or a stranger from publishing something false about you, and FORGE and the Cornell Tech work suggest a single page can move an answer. What you control is how fast you notice and what you do next.

• Watch the answers, not just your mentions. Ask your buyers' real questions on each engine and compare the answers to your current facts. A planted claim shows up as an answer that contradicts your canonical facts, not as a drop in visibility.
• Trace it to the source. Open the citations and find the page carrying the claim. The step-by-step workflow is in how to fix a wrong fact in an AI answer.
• Report spam to Google. If the source violates Google's spam policies, Google asks you to file a search quality user report, and since April 2026 its documentation says it may use those reports to take manual action.
• Loop in security for memory poisoning. Links that plant instructions in assistants arrive by email and on the web. Microsoft's post includes hunting queries for AI-assistant URLs whose prompts contain words like "remember" and "trusted."
• Keep dated evidence. Record the prompt, engine, date, answer text, and cited source. If a claim is defamatory or costs you business, that record is what counsel will ask for first.

Caveats

Google's policy and guide text is quoted as of Sept. 26, 2026, and Google revises both. FORGE and GEO-Flag are arXiv preprints, and FORGE is a lab setup with a frozen set of pages rather than a live engine. Lily Ray's figures cover B2B software queries in Google AI Overviews. None of this is legal advice: questions about the FTC rule, defamation, or a specific tactic belong with counsel.

How SolCrys fits

SolCrys is an AEO platform built around Measure → Diagnose → Execute → Verify. We won't do anything in the first bucket for anyone, and the product routes the work it does support through your people.

• Our rules were already written down. Our editorial standards, published May 16, 2026, the day after Google's guide and spam clarification, name 7 anti-patterns we won't recommend, including inauthentic brand mentions and one page per fan-out variation. When we added the spam-policy language on Sept. 26, 2026, the 7 didn't need to change.
• Execute is governed and human-approved. Recommendations are grounded in your organization's Corporate Context, the brand facts SolCrys drafts from your footprint and your team reviews and refines, and our open-source Skills are written to return an outline and a fact checklist rather than invent facts when that grounding is thin. Review and approval are recorded on each task in the Action Hub.
• SolCrys never publishes. It has no write path into your CMS; every change goes live because someone on your team shipped it. Approval in SolCrys is a recorded step, not a lock, so your own review process stays the gate.
• Answer Accuracy catches the downstream effect. It grades AI answers about your brand against your Corporate Context on the engines you track (ChatGPT, Gemini, Perplexity, Google AI Overviews, and Claude) and returns the failing claim with its evidence, including answers that contradict your canonical facts or assert something you've marked as prohibited. If someone else's planted claim reaches answers to prompts you track, that's where it surfaces. It's included on Pro (up to 15 prompts) and Custom.

Sources

• Google Search Central, "Spam policies for Google web search" (current revision Aug. 28, 2026), including "attempting to manipulate generative AI responses in Google Search"
• Google Search Central, documentation updates log: "Clarifying that spam policies apply to generative AI responses in Google Search" (May 15, 2026) and the site reputation policy update (Aug. 28, 2026)
• Google Search Central, guide to optimizing for generative AI features in Search (May 15, 2026, updated July 10, 2026)
• Google Search Central, guidance on using third-party SEO tools, services, and advice (June 5, 2026)
• Google Search Status Dashboard, September 2026 spam update (began Sept. 24, 2026)
• Microsoft Security Blog (Microsoft Defender Security Research), "Manipulating AI memory for profit: The rise of AI Recommendation Poisoning" (Feb. 10, 2026)
• Lily Ray, "Why Calling Yourself the 'Best' Could Be Helping Your Competitors Win in AI Search" (June 17, 2026): 100 B2B queries in Google AI Overviews, 224 of 323
• Search Engine Land, "Google AI Overviews cite self-serving listicles, but recommend competitors 69% of the time" (coverage of Lily Ray's analysis)
• Luo and Chen, "One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenders" (FORGE), arXiv 2606.13610 (June 2026)
• Chu et al., "GEO-Flag: Detecting and Measuring GEO-Optimized Web Content," arXiv 2608.16824 (August 2026)
• Martinez, "Optimizing Visibility in Generative Engines: A Critical Survey of Generative Engine Optimization (2023-2026)," arXiv 2607.14035 (July 15, 2026)
• Federal Trade Commission, final rule banning fake reviews and testimonials (Aug. 14, 2024)

FAQ

Related guides