The short answer
Use rel="sponsored" for links you were paid for, rel="ugc" for links your users created, and rel="nofollow" for links you do not trust or cannot vouch for. That is the entire decision in one sentence. Everything else in this guide is about the cases where the answer is not obvious, and about what these attributes actually do now that Google treats all three as hints rather than commands.
The three values exist because one value was doing three jobs badly. For years, nofollow was the only option, so it got used for paid links, for comment links, and for untrusted links alike, and nobody reading the markup could tell which was which. Splitting them apart was a labelling fix: the same link, described accurately.
What each one means
sponsored means money changed hands. Any link that is part of an advertisement, a sponsorship, or a paid placement โ including a product a company sent you for free in exchange for a link โ should carry rel="sponsored". This is the one with the clearest rule behind it, because paid links that pass ranking credit are a manipulation of search results, and search engines and regulators both treat undisclosed paid links as a violation. If a link exists because someone paid for it, mark it.
ugc means a user wrote it. Links in comments, forum posts, reviews, and any other content your visitors contribute should carry rel="ugc". The point is to separate the links you chose from the links your users chose. You did not vet them, you did not endorse them, and you should not have to: the attribute says the link came from a user, and the search engine can weigh it accordingly.
nofollow means you do not vouch for it. Use it for links to pages you do not trust, or where you have no basis to endorse the destination โ a link in a guest post you did not fully review, a link to a site you have not checked, a link you are including for completeness rather than recommendation. It is the general-purpose "no endorsement" marker, and it is also the fallback when none of the other two fits.
The decision, as a table
| The link isโฆ | Use | Why |
|---|---|---|
| Paid, sponsored, or exchanged for a product | sponsored | Money must be disclosed; unmarked paid links are a violation |
| Written by a user: comment, forum post, review | ugc | Separates your editorial links from your users' links |
| One you do not trust or have not vetted | nofollow | Withholds endorsement without deleting the link |
| A normal editorial link you chose | Nothing | An ordinary link is an endorsement; marking it would be wrong |
| Paid and user-written at once | sponsored ugc | The values combine; use both |
Read the last row carefully, because it answers the question people ask most: yes, the values can be combined. rel="sponsored ugc" is valid, and so is rel="nofollow sponsored". They are labels, not radio buttons, and a link can truthfully carry more than one.
They are hints now, not commands
Since 2019, Google treats all three values as hints rather than directives. Before that, nofollow was an instruction: do not follow this link, do not pass ranking credit through it. Now it is a suggestion that Google may follow or ignore, depending on its own judgement of the link and the page.
In practice this changes less than it sounds. Google still generally honours the hint, and a page full of marked links does not pass credit the way an unmarked page does. What changed is that Google reserves the right to use a marked link as a discovery signal โ to find a new page through it, for example โ even when it does not pass ranking credit. So marking a link no longer guarantees it is invisible to crawlers. If a link must not be followed at all, the mechanism is robots.txt, not a rel attribute.
The other practical consequence is that mislabelling is now less catastrophic than it was. A paid link marked ugc instead of sponsored is still wrong โ the disclosure is inaccurate โ but it is not the total loss of control it would have been under the old directive model. Fix it anyway. The attribute is a statement about the link, and statements should be accurate.
Common mistakes
Marking every outbound link nofollow. Some sites do this as a blanket policy, on the theory that it "preserves" ranking credit. It does not preserve anything โ credit is not a substance that leaks out of links โ and it makes the site's markup dishonest: every link claims no endorsement, including the ones the author genuinely recommends. Mark links by what they are, not by policy.
Marking internal links. The three values describe how a link should be treated by search engines, and they are meant for links to other sites. Putting nofollow on your own internal links does not concentrate authority on the remaining pages; it just makes your own site harder to crawl and understand. Internal links should almost always be plain links.
Using nofollow for paid links. It was the old habit, and it is now the wrong label. A paid link is sponsored, and calling it nofollow hides the reason it exists. Google has said explicitly that sponsored is the correct value for paid links, and using the wrong one is a disclosure failure, not a harmless synonym.
Forgetting that comments need it. A comment section with unmarked links is an open invitation to spam, because every posted link passes endorsement by default. If your site accepts user content, the ugc attribute should be applied by the template, not by hand โ one line in the rendering code, not a decision per comment.
Treating the attribute as a security measure. Marking a link does not make its destination safe, does not stop users clicking it, and does not prevent crawlers from ever visiting it. It is a statement about endorsement and ranking credit, nothing more. A link to a malicious site should be removed, not marked.
What to do
Audit your templates first, because most links on a site are generated, not written by hand. Check that comment and forum templates add ugc automatically, that any advertising or sponsored-content template adds sponsored, and that editorial content templates add nothing. One template fix covers every future link; one manual fix covers one link.
Then check the links you wrote by hand: affiliate links, sponsored mentions, and product links in reviews. Affiliate links are paid links โ the commission is the payment โ so they take sponsored, and the same applies to a product sent to you for review. If you are unsure whether a link counts as paid, ask whether the link would exist without the payment. If the answer is no, mark it.
Finally, do not go back and re-mark old links in bulk unless they are paid links, because mislabelled paid links are the one case with real consequences. Ordinary editorial links that carry a stray nofollow from an old blanket policy are worth cleaning up when you touch the page anyway, but they are not worth a dedicated migration. The pre-publish checklist includes a link review step; add the rel question to it, and the problem stops recurring.
Limitations
Google's treatment of these values as hints means the effect of marking a link is not directly observable from outside. We cannot measure, for a given link, whether credit passed or not, because that is an internal judgement. What we can verify is the labelling: whether the markup accurately describes the link. That is the part this guide is about, and it is the part you control.
Other search engines and AI crawlers may treat these values differently, and none has published a complete account of how. The values are a web standard for describing links, so using them accurately is correct regardless of which system reads them โ but do not assume every system reads them the same way Google does.