What the policy actually says
Google's spam policies name link spam directly, and the clause that matters is about exchanging money for links that pass ranking signals. It is not a grey area and it does not depend on how natural the link looks.
The policy also covers the quieter variants: free products in exchange for links, excessive link exchanges, and large-scale article campaigns whose purpose is the link rather than the article. The common factor is intent, and intent is inferable from pattern at scale.
How enforcement actually arrives
Two ways. Automated systems can discount or demote without anyone telling you — this is the common case, and it looks like a plateau or a slow bleed rather than a cliff, which is why it so often gets misdiagnosed as an algorithm update.
Or a manual action, which does show up in Search Console. That is the loud version, and oddly the better one: at least you know, and there is a defined reconsideration path.
If you have already bought links
The order matters here. Do not start with the disavow file — that is the last step, not the first.
- Inventory what you bought, from whom, and when. You cannot clean up what you have not written down.
- Try removal first. A link taken down is unambiguously resolved; a disavowed one is a request.
- Disavow only what you genuinely cannot get removed. Over-disavowing healthy links is its own self-inflicted wound.
- If there is a manual action, file reconsideration with the actual inventory and what you did about each item. Vague contrition does not clear it.
- Stop buying. Reconsideration after a second offence is materially harder.
The honest caveat
Nobody outside Google can tell you the probability that a specific link gets you penalised, and anyone who gives you a number is guessing. What is knowable is the shape of the bet: small recurring upside, rare catastrophic downside, against an opponent who gets better at detection every year.