Growth hacks that don't work anymore, and the platform rules that ended them

The growth hacks that don't work anymore are the ones that borrowed another site's reputation or tracked users without asking: expired domains, mass-produced pages, paid placements on high-reputation hosts, bulk email to unconfirmed lists and device fingerprinting. Google's spam policies, announced March 5, 2024, Gmail's sender rules, in force from February 1, 2024, and Apple's App Tracking Transparency in iOS 14.5 ended them.

What growth hacks no longer work?

The short answer: the tactics that borrowed someone else's reputation, or tracked users without asking, stopped working once the platforms wrote public rules against them. Search, email and mobile advertising each changed, and each rule has a version or a date you can check.

Dead tactic	Platform rule that ended it	Date or version	What a startup does instead (our reading)
Buying an expired domain and hosting thin pages on its old reputation	Google expired domain abuse spam policy	Announced March 5, 2024	Publish original pages on a domain you build yourself
Mass-producing pages to rank, written by software or by people	Google scaled content abuse policy	Announced March 5, 2024	Fewer pages, each answering one question a buyer asks
Paying to place unedited pages on a high-reputation host site	Google site reputation abuse policy	Took effect May 5, 2024	Contributed pieces the host edits for its own readers
Bulk email to unconfirmed lists from unauthenticated domains	Gmail sender requirements	From February 1, 2024	Authenticate the domain, confirm each signup, watch the spam rate
Fingerprinting devices to follow users across other apps	Apple App Tracking Transparency (ATT)	iOS 14.5 or later	Ask through the ATT prompt and build a first-party list

What each rule actually says

Google's three search policies arrived together, aimed at expired domain abuse, scaled content abuse, and site reputation abuse. The scaled content rule applies whether pages come from automation, human efforts, or some combination. Hiring writers to churn pages is covered too. Violating sites may rank lower in results or not appear in results at all.

Gmail now requires every sender to keep spam rates reported in Postmaster Tools below 0.3%. Google also asks senders to confirm each recipient's email address before subscribing them.

On iOS, a user who has not opted in returns an advertising identifier that will be all zeros. Apple also says you may not derive data from a device for the purpose of uniquely identifying it. For install attribution, advertisers can use AdAttributionKit.

This week

1. Check your sending domain for SPF, DKIM and DMARC records, then compare your list hygiene against our lifecycle email benchmarks.
2. List every page created in bulk and mark the ones no buyer would read.
3. Move any surviving hacks into your growth experiment backlog and test the replacements using our growth experiment guide.

Does programmatic SEO still work?

Yes, when the pages carry something a searcher cannot get elsewhere. Google defines scaled content abuse as creating "large amounts of unoriginal content that provides little to no value to users, no matter how it's created." The test is the value on each page, not whether a template or a model produced it.

On generative AI, Google's position is that automation is spam "if the primary purpose is manipulating ranking in Search results." So the question for a growth team is plain: would this page exist if search did not?

What the policy names

Google's own examples describe the template farm closely. Scaled content abuse includes scraping feeds or search results "to generate many pages (including through automated transformations like synonymizing, translating, or other obfuscation techniques)". Doorway abuse covers pages "targeted at specific regions or cities that funnel users to one page" and pages "closer to search results than a clearly defined, browseable hierarchy".

Google's spam report form adds two more categories to check against: scraped content assembled "without adding substantial value" and thin affiliate pages that aggregate product descriptions and links for commissions.

Real data versus mass production

Page trait	Built from real data (our reading)	Mass-produced to rank (our reading)
Source of content	Your own product, usage or pricing data	Scraped, spun or translated text
Difference between pages	Numbers and answers change per page	Only the city or keyword changes
Where the click goes	The answer is on the page	Funnels to one signup page
Site structure	Browseable categories a person would use	Flat list that mirrors search queries

A worked audit you can run this week

Export every page your templates generated and mark each one on a single question: does it show data that is unique to that page? For each page that fails, pick one of three options:

1. Merge it into a regional page that carries real comparisons.
2. Enrich the ones where you hold data, starting with the cities that already get traffic.
3. Remove or noindex the rest.

Treat the cleanup as a test with a holdout group, using the steps in how to run a growth experiment. Then rebuild the surviving templates so the answer sits above the fold.

Programmatic pages still work when the data is yours. We think that is the only version worth building now.

Can you still buy expired domains or publish on other sites to rank?

Both tactics borrow ranking strength that someone else earned. They were two of the three policies in the March 2024 announcement covered above, and the definitions are narrow enough to plan around.

Expired domains

Google defines expired domain abuse as a domain "purchased and repurposed primarily to manipulate Search rankings by hosting content that provides little to no value to users" (Google Search Central Blog). Its example is a domain once used by a medical site, repurposed to host low quality casino content. The spam policies page lists others, such as affiliate content on a site previously used by a government agency.

Google says the practice "isn't something people accidentally do." It also draws the line plainly: "It's fine to use an old domain name for a new, original site that's designed to serve people first." Buying a short name for your product is fine. Buying a name for its link history and filling it with unrelated pages is the pattern the policy targets.

If you price domains on a third-party authority metric, note that Google says those scores don't correspond to any of its own signals.

Publishing on someone else's site

Site reputation abuse covers third-party pages published "with little or no first-party oversight or involvement" to ride the host's ranking signals. Sponsored, advertising and partner pages are named. Advertorials written for a publication's regular readers don't have to be blocked. A coupon section counts as close involvement when the host sources coupons directly from merchants, not from white-label services.

How violations get caught

Google detects violations through automated systems and, as needed, human review that can lead to a manual action. The ranking penalties covered earlier follow. After a manual action, the owner receives a notice through Search Console and can apply for reconsideration.

Plan	How it fits the policy (our reading)
Buy an expired domain and launch your new product on it	Allowed, if the site is new and original
Buy a domain from another niche and add pages to use its links	Matches expired domain abuse
Sponsored article the publisher edits for its own readers	Closer to advertorial
A section on a news site that you write and run, unrelated to the host	Matches site reputation abuse

This week, list every domain you own and every paid placement you run. Mark each one against the table. Check Search Console for any manual action notice. Then move the budget behind any risky line into content on your own site, using the founder-led content playbook.

Why did my email open rates jump?

Your open rate jumped because Apple Mail started opening your emails for your readers. When a message arrives, Mail's Protect Mail Activity setting downloads remote content in the background by default, regardless of whether you engage with the email. The tracking pixel your email platform counts as an open is remote content. So the pixel loads when the email is received, not when someone reads it.

Apple states the goal plainly. Mail Privacy Protection prevents senders from seeing whether you opened their message.

What senders lost

Before this feature, according to Apple, email senders may learn when and how many times you opened their email, whether you forwarded the email, your Internet Protocol (IP) address. Mail now sends remote content through two separate relays operated by different entities. The result: senders can’t use your IP address as a unique identifier. In our reading, any segment built on IP location or open time for these readers is now guesswork.

What to measure instead

Apple notes the feature does not extend to links or email attachments. A click still needs a person.

Metric	What it tells you (our reading)
Click rate	The reader acted on the content
Reply rate	The reader cared enough to write back
Conversion rate	The email moved a signup, trial or purchase

Steps for this week:

1. Switch the winning criterion on every subject-line test to clicks or conversions. Clicks are rarer than opens, so check your sample with the A/B test sample size calculator before you send.
2. Rebuild "engaged" segments on clicks within a set window, not opens.
3. Add one reply prompt per sequence, such as a single question the reader can answer in a line.
4. Compare your click and conversion rates against our lifecycle email benchmarks, and write the test up using the format in how to run a growth experiment.

What are the bulk email sender requirements?

Gmail and Yahoo turned long-standing deliverability advice into enforced rules in early 2024. Gmail's rules applied starting February 1, 2024 to everyone mailing Gmail accounts, with a second tier for senders of more than 5,000 messages per day. Yahoo said enforcement would be gradually rolled out through the first half of that year.

Bulk is not only a volume test. Amazon Web Services (AWS) wrote that volume over 5000 per day is one factor, and that the main factor is whether recipients want the mail.

Requirement	All senders	Bulk senders
Authentication	SPF or DKIM	SPF and DKIM
DMARC	Recommended	Policy of at least p=none, must pass
From: alignment	Not required	Aligned with the SPF or DKIM domain
Forward and reverse DNS	Required	Required
TLS connection	Required	Required
Spam rate	Below 0.3%	Below 0.3%
Unsubscribe	Not required	One-click header, visible link, honored within 2 days

The checklist to run this week

1. Publish one SPF record that lists every service sending as your domain, including your email service provider.
2. Turn on DKIM. Gmail requires a DKIM key of 1024 bits or longer.
3. Publish DMARC at p=none with a reporting address. Yahoo states that relaxed alignment is acceptable.
4. Confirm a reverse DNS (PTR) record exists for each sending IP.
5. Add the list-unsubscribe headers for one-click unsubscribe and keep a link in the footer. Yahoo's rule: honor unsubscribes within 2 days.
6. Split mail streams by subdomain. AWS gives the example of marketing.example.com for marketing and receipts.example.com for transactional mail.
7. Track complaints in Google Postmaster Tools and Yahoo's Complaint Feedback Loop.

Get the denominator right on step 7. Yahoo's spam rate is calculated in our system based on mail delivered to the inbox. Here is a worked example: 40,000 messages reach the inbox in a week, and 0.3% of that is 120 complaints. If your dashboard divides by all 50,000 sent, those same 120 complaints show as 0.24%, which looks safe when it is not.

Skipping steps 1 to 3 has a visible cost. Unauthenticated messages might be marked as spam or rejected with a 5.7.26 error. Compare your post-fix numbers against our lifecycle email benchmarks.

Why cheap retargeting and app attribution stopped working

App Tracking Transparency (ATT) is Apple's permission layer for cross-company tracking. Since iOS 14.5, an app needs the user's permission through the ATT framework to track them or read the device's advertising identifier. Without that permission, the identifier comes back as all zeros.

Apple defines tracking as linking data from your app with data from other companies' apps, websites, or offline properties for targeted ads or ad measurement. That definition reaches three old growth habits.

Old tactic	What Apple's rule says	What to do instead (our reading)
Uploading customer lists to an ad network for retargeting or lookalikes	Apple lists sharing emails or IDs with an ad network to retarget users or find similar users as tracking	Spend that effort on lifecycle email and in-app messages to users you already have
Using a third-party software development kit (SDK) to measure ads	An SDK that combines your app's data with other developers' data counts, even if you don't use it for that	Audit every SDK in your build and ask each vendor what it does with your data
Matching users on hashed emails or device signals	Hashed email or phone is not a substitute for permission, and you may not derive data from a device to uniquely identify it	Accept less user-level ad data and measure at the campaign level

What you can still measure on your own product

ATT governs data joined with other companies. Your own product events, tied to your own account ID, sit outside it. The identifier for vendor (IDFV) can be used for analytics across your own apps without the ATT prompt.

A working setup for this week:

1. Log signup, the first key action and repeat use against your user ID, in your own analytics.
2. Group users into a weekly cohort and track activation and week-four retention.
3. Compare campaign-level spend against signups by week, not by user.

In our reading, the gap between those two numbers tells you more than either one alone. If paid and organic signups activate at a similar rate, the paid traffic is worth keeping; check it against your payback period.

Why self-promotion on Reddit gets removed

A founder posts a launch announcement into ten subreddits on the same morning. By lunch, most of the posts are gone and the account has a few warnings. The founder did nothing illegal and broke no spam law. They ran into a rule system with two layers, and they ignored the one that matters most for promotion.

Reddit's own rules describe the structure. Communities are run by users, and some of those users act as moderators. Each community's culture is shaped by the community rules enforced by moderators, and implicitly, by the upvotes, downvotes, and discussions of its community members. Underneath sit the platform-wide rules that apply to everyone, enforced by Reddit's admins.

Layer	Who enforces it	What it means for a startup post (our reading)
Community rules	Moderators	Each subreddit sets its own limits on links, launches and promotion. One community may allow them where another removes them.
Community culture	Members, through votes and replies	A post can follow the written rules and still sink if members read it as an ad.
Platform-wide rules	Reddit admins	These apply in every community and sit beneath the local rules.

The request that decides most self-promotion outcomes is short: Reddit asks users to "abide by the rules of communities in which you participate and do not interfere with those in which you are not a member." In our reading, a brand account that shows up only to drop a link is a visitor, not a participant. Moderators enforce for their members, so the post goes.

Reddit also asks users to follow "not just the letter of these rules, but the spirit as well." We think this is why technically compliant promotion still gets removed. A moderator judges intent as well as format.

What rule-following participation looks like

Use this as a weekly routine for one community at a time:

1. Read the sidebar and pinned posts first. Write down what the community says about links, self-promotion and launch posts. If it is silent, message the moderators and ask before you post.
2. Comment where you have real expertise for a few weeks before you mention your product at all.
3. When you do share, follow the community's format exactly: the designated thread, flair or weekly promotion post if one exists.
4. Disclose that you work on the product in the post itself.
5. Track removals and replies per community in a simple sheet. A removal is a signal to reread that community's rules, not to repost elsewhere.

Treat each subreddit as its own channel with its own rules, and test them one by one with a structured growth experiment. For the full channel approach, see our Reddit marketing playbook and the broader community-led growth playbook.

How to audit your growth tactics this week

In our reading, start with email, because it is the one channel where a rule can change your status for good. Then run the same check on every other tactic you rely on.

A worked example: the subdomain math

Gmail counts volume at the level of the primary domain. Its help page states that messages sent from the same primary domain count toward the 5,000 limit, and it gives this case: every day you send 2,500 messages from solarmora.com and 2,500 messages from promotions.solarmora.com to personal Gmail accounts. That sender is bulk. Splitting mail across subdomains to stay under the line does not work.

The status also sticks. Senders who meet the above criteria at least once are permanently considered bulk senders, and Gmail adds that changes in email sending practices will not affect permanent bulk sender status once it’s assigned. A single launch-day blast can put you in the bulk tier for the life of the domain.

Gmail tightened enforcement after that. Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. A fresh domain gets no grace period: for domains that have not crossed the threshold since January 1, 2024, the enforcement progression for new domains will be on an accelerated timetable.

One scoping note for business-to-business (B2B) senders. Sender requirements and Google enforcement apply only when sending email to personal Gmail accounts. Check what share of your list sits on personal addresses before you size the problem.

The audit, step by step

1. List every running tactic. Note the channel and the platform rule it depends on.
2. Add up Gmail volume across the whole domain. Include every subdomain. If you have ever crossed the line, treat yourself as bulk from now on.
3. Read your bounce logs. Gmail returns codes such as 4.7.27, which means your email has been rate limited because SPF authentication didn't pass. Gmail also says senders are encouraged to check their email compliance status using Postmaster Tools.
4. Check list sources. Yahoo's guidance reads: Don't purchase mailing lists or subscribe users by having an opt-in checkbox automatically checked on your website.
5. Label each tactic keep, fix or retire. Use the table below.
6. Move replacements into a backlog. Score them with impact, confidence, ease (ICE) in the growth experiment backlog template, then run the top one using how to run a growth experiment.

Finding	Label (our reading)	Replacement to backlog (our reading)
Subdomains used to split volume	Retire	Separate streams by purpose, as covered earlier
Rate-limit codes in logs	Fix	Repair authentication before the next send
Pre-checked opt-in box	Retire	Confirmed opt-in on signup
Inactive subscribers still mailed	Fix	Yahoo suggests you consider sending a reconfirmation email to inactive subscribers periodically

Compare the results against our lifecycle email benchmarks once the fixes have shipped.

What this page does not cover

This page covers search, email, iOS tracking and Reddit rules. It does not cover other social or ad platforms, and it does not compare or recommend any email, analytics or attribution vendor. It is not legal advice on privacy or email compliance, so check your obligations with qualified counsel.

Related on Race to Scale: Pricing page examples from six SaaS companies and what each one does; Landing page examples for startups: six pages, section by section; A/B test sample size and duration calculator, with the formula.