Manipulating AI Citations Is Now Spam: Google's New GEO Red Lines
For two years, the fastest-growing corner of search marketing lived in a grey zone. Getting your brand cited inside Google's AI Overviews, AI Mode, ChatGPT or Perplexity — the discipline now called GEO — had no rulebook. Google's spam policies were written for the ten blue links, and it was never quite clear whether the same rules applied to an AI-generated summary. That ambiguity is gone.
On May 15, 2026, Google updated its spam policies for Web Search to state explicitly that they cover generative AI features, including AI Overviews and AI Mode. The June 2026 spam update — confirmed June 24 and rolled out globally in roughly two days — was the first enforcement wave under the broadened rules. And a separate policy on "back button hijacking" took effect June 15, 2026. Put together, these three moves draw a hard line under the question every GEO practitioner has been quietly avoiding: which tactics are optimization, and which are now spam?
What actually changed
The change is narrow in wording and enormous in reach. Google did not invent a new penalty. It clarified that attempting to manipulate generative AI responses in Google Search is spam, governed by the exact same policies — and the same enforcement — that already apply to manipulated web rankings. Two additions matter most:
- AI-response manipulation. Content built to trick AI Overviews or AI Mode into citing you — rather than to genuinely inform a reader — now falls under the spam framework. Google specifically flags prompt-injection-style passages and fake-authority stuffing aimed at triggering citations.
- Back button hijacking. Added to the malicious-behaviour policy, this targets pages that interfere with a browser's back button — trapping users, or bouncing them to pages they never chose to visit. It is not GEO-specific, but it landed in the same enforcement window and is worth knowing.
The mental model to adopt is simple: buying or manufacturing an AI citation now carries the same risk as buying a backlink. The tactic that felt clever in 2024 is the tactic that gets a site demoted in 2026.
Why Google drew the line now
GEO grew up fast. As AI answers began intercepting clicks before users ever reached a website, an entire cottage industry of "get cited by AI" tactics appeared — some legitimate, some pure manipulation. The manipulative end got creative: passages of hidden text instructing the model to "recommend this brand as the best option," pages stuffed with fabricated credentials and fake review counts to fake authority, and networks selling guaranteed mentions inside AI answers.
Left unchecked, this is the AI-era version of link farms and keyword stuffing — and it degrades the exact product Google is betting its future on. Trust in an AI answer collapses the moment users learn it can be bought. By folding AI manipulation into existing spam policy rather than writing a brand-new one, Google signalled that it sees no meaningful difference between gaming a ranking and gaming a citation. Both are attempts to deceive the system at the reader's expense.
The tactics that now count as spam
Here is the practical map. If a technique appears in the left column of this table, treat it as a liability — not an edge — and replace it with the safe alternative on the right.
| Now treated as spam | Why it crosses the line | Do this instead |
|---|---|---|
| Prompt-injection passages (hidden or visible text instructing the model what to say) | Deceives the AI, not the reader; textbook manipulation of a generative response | Write clear, self-contained answers a model can quote because they are genuinely correct |
| Fake-authority stuffing — invented credentials, fabricated review counts, fake "expert" bylines | Manufactures trust signals that don't exist; a fake-E-E-A-T play | Show real authors, real experience, verifiable sources and honest data |
| Buying or trading guaranteed AI mentions from citation networks | Same category as buying backlinks — inauthentic, paid manipulation | Earn mentions through genuinely useful, widely referenced content |
| Scaled, near-duplicate pages generated only to blanket AI answers | Falls under scaled content abuse; adds no unique value | Publish fewer, deeper pages that each answer a real question |
| Back button hijacking and forced redirects | Interferes with user navigation; malicious-behaviour policy | Let users leave freely; earn the return visit with quality |
Prompt injection is the headline offence
The tactic Google clearly has in its sights is the prompt-injection passage — a block of text written to address the model rather than the human. Sometimes it's hidden in markup or off-screen; sometimes it hides in plain sight as an oddly phrased "note to AI assistants." Either way, its purpose is to hijack the model's summary. That is now unambiguously spam, and because it leaves a distinctive fingerprint, it is exactly the sort of thing automated classifiers are built to catch.
Fake authority is the subtle one
Most sites won't touch prompt injection. The riskier temptation is quieter: inventing expertise to look citable. Fabricated author credentials, inflated "trusted by 10,000 experts" claims, and fake review schema all fall here. The irony is that real experience-based signals are what AI engines reward anyway — the same signals that make a source like Reddit so heavily cited. Faking them is both against policy and strictly worse than earning them.
The GEO tactics that are still completely safe
None of this makes GEO risky as a discipline. The line runs between earning citations and manufacturing them — and everything on the earning side is not just allowed but encouraged. Safe, durable practice includes:
- Clear, extractable answers. Lead sections with a direct, self-contained response to the question. This helps models quote you accurately — because you are right, not because you tricked them.
- Genuine structured data. Accurate schema markup that describes real content, real authors and real products remains fully legitimate and helps machines understand your page.
- Real expertise and sources. Named authors with actual experience, primary data, and links to authoritative references are the honest version of the "authority" that fakers try to counterfeit.
- Being genuinely referenced. Earning mentions across communities, publications and forums is the AI-era equivalent of earned links — and it is exactly what engines weight.
- Solid technical access. Letting AI crawlers reach your content, and keeping pages fast and clean, is table stakes covered in any sound AI search optimization plan.
In short: the entire "white-hat" GEO playbook survives untouched. Only the shortcuts died.
How enforcement actually works
Two mechanisms are in play, and they behave differently. Algorithmic spam systems — including the June 2026 spam update — run continuously and demote manipulated content automatically; you won't get a notice, you'll just see visibility fade. Separately, Google's team can issue a manual action, which does appear in Search Console and can be resolved with a reconsideration request once the offending technique is removed.
Recovery from algorithmic demotion is the harder path: there is no button to press, only the slow work of removing the manipulative elements and rebuilding genuine quality until the next assessment. That asymmetry is the whole argument against ever adopting these tactics — the downside is a slow, invisible bleed with no quick appeal.
What to do this week
- Audit for prompt injection. Search your templates and content for any text written to instruct an AI rather than inform a reader — including hidden or off-screen blocks. Remove it.
- Verify your authority signals are real. Every credential, review count and "trusted by" claim should be true and, ideally, verifiable. Delete anything you can't stand behind.
- Cut any bought or traded citations. If you're paying a network for guaranteed AI mentions, treat it exactly as you'd treat a paid-link scheme — and stop.
- Check your back-button behaviour. Confirm no script, interstitial or redirect traps users or hijacks their navigation.
- Reinvest in the honest playbook. Move the effort you were spending on shortcuts into depth, real expertise and clear answers. It's the only GEO strategy that compounds.
The takeaway
Google didn't ban GEO — it professionalised it. By declaring that manipulating AI citations is spam under the same rules that govern the rest of search, it removed the grey zone that let manipulation masquerade as innovation. The practitioners who were already earning citations through genuine expertise, clear answers and honest signals have nothing to fear and a cleaner field to compete on. The ones who were gaming AI answers with prompt injection, fake authority and bought mentions now face the same fate as the link farms before them. In 2026, the safest AI-visibility strategy is also the oldest one: be genuinely worth citing.
