Picture the site the checklist produces. 30 posts, 1,000 words each, on a domain that has sat for 6 months, with 100 people a day arriving from search. Every box ticked. The owner applies.
The answer comes back, and it is not a number. It is three words: low value content.
That is the most common rejection AdSense gives, and it is not on the checklist, because nothing on the checklist is Google’s. Search for “AdSense requirements” and you will be told about the 30 posts, the 1,000 words, the 6 months and the 100 visitors as though they were printed in a policy somewhere. Google publishes none of them. Not one.
| The folklore | Where Google writes it down |
|---|---|
| 30 posts | Nowhere |
| 1,000 words a post | Nowhere |
| A domain 6 months old | Nowhere, with one second-hand exception below |
| 100 visitors a day | Nowhere |
Where the numbers come from is not mysterious. Reviewers say no, people compare notes, patterns get mistaken for rules, and the rule that spreads is the one with a number in it, because a number can be ticked off. The checklist optimises the thing that can be measured. The review measures something else. The rest of this article is about what.
The whole published bar fits in a paragraph
Google’s eligibility requirements say four things. You must be 18 or over. You must be able to access the site’s HTML source, which rules out most locked-down hosted platforms. Your content must be “high-quality, original, and attract an audience.” And you must comply with the policies before you apply, not after. The site-readiness guidance adds that the content should be valuable and original, nothing scraped or copyrighted, with an accessible navigation bar and an inviting layout.
That is the entire bar. Read it again and notice what is missing: any number at all.
The one wrinkle is a rule Google has historically applied in some countries, including China and India: that you have owned the site for 6 months before applying. Every source for it is second-hand, all of them report that enforcement has relaxed, and it could not be found on a current Google help page. It keys off where you live, not where the site is hosted, so check the AdSense help for your own country rather than trusting this paragraph.
So the review is a person deciding whether your site is worth putting advertising on. That is a much harder thing to fake than 30 posts, which is the point.
The three words, and what they measure
“Low value content” is a reviewer’s judgement that the site does not yet offer enough unique, helpful, trustworthy information to carry ads. Reviewers apply the standard Google calls E-E-A-T: what the site is for and whether it serves a reader, the demonstrated expertise and credibility of the person behind it, depth and originality, and the experience of using it, layout and ad intrusiveness included.
Word count rarely decides it. A short expert piece that solves a real problem passes where a 2,000-word generic article fails. That is the exact opposite of what the folklore says, and it is why the folklore fails people: it makes them produce the thing that is easy to count instead of the thing that is being judged.
What a reviewer is looking for is an answer to Google’s own who, how and why test. Who wrote this, and is that self-evident to a visitor? A named human with a real background beats a site with no byline, every time. How was it produced: researched, tested, measured, or assembled from pages that already rank? And why does it exist, to help someone or to hold ads?
An About page that names the actual person and a contact route that works are not bureaucracy here. They are the direct evidence for two of those three questions. On the page itself, the things a reviewer sees are a visible byline linking to an author page, a publication date and a visible updated date where a piece has changed, a source list where claims need one, an AI-assistance note where relevant, and an affiliate disclosure above the first affiliate link, not at the bottom.
None of that is on the checklist, because none of it is countable. But two of the things a reviewer wants to see are also things the law wants to see, and the law is less forgiving than a reviewer.
The one page Google genuinely mandates
Google’s required content page is the only place it demands a specific page, and the page is the privacy policy. It must say four things:
- That third-party vendors, including Google, use cookies to serve ads based on prior visits.
- That Google’s advertising cookies let it and its partners serve ads based on visits to your site and to others.
- How to opt out: Ads Settings and aboutads.info for third-party vendors.
- Which third-party vendors and ad networks serve ads on your site, with links to them.
The last one is the one people skip, and a privacy policy pasted from a template generator does not satisfy it.
The rules Google never mentions, enforced by people who are not Google
None of these are AdSense rules. They apply because you are publishing to European readers, and they are enforced by regulators, which is why they matter more than anything a reviewer decides.
Say who you are. Article 5 of the e-Commerce Directive requires your identity and contact details to be “easily, directly and permanently accessible”: legal name, a geographic address (a PO box is not one), an email address, and a second rapid route such as a contact form. The CJEU held that email alone is not enough, a holding reported here second-hand. Germany and Austria call the page an Impressum; every member state has transposed it in some form.
Say what you do with data. GDPR Article 13 wants more from a privacy policy than Google does: who the controller is and how to reach them, the purpose and legal basis of each processing activity, the recipients (name Google as an ad vendor), international transfers and their safeguards, retention periods, and the full list of rights, including withdrawing consent and complaining to a supervisory authority.
Say what you store on the reader’s device. A cookie policy listing every cookie and local-storage item, who sets it, why, for how long, and how to withdraw consent, including a link that re-opens the consent dialog. Google’s demand that you “clearly identify each party” means the vendor list has to be reachable from here.
Be careful what you host. Under the Digital Services Act, the moment you host user comments you are a hosting service, with obligations: a usable way to report illegal content, a statement of reasons when you remove something, terms in plain language, and a duty to notify law enforcement of content indicating a threat to life. Micro and small enterprises are exempt from the most expensive parts, but not from all of it.
Say when a machine helped. EU AI Act Article 50 has been enforceable since 2 August 2026. If you publish AI-generated or AI-assisted text on matters of public interest, disclosure obligations attach. Decide the policy once, write it down, and apply it from the first article, rather than retrofitting it across an archive later.
The file that breaks with a redirect
ads.txt is one line at the root of your domain, and it takes 15 minutes:
google.com, pub-0000000000000000, DIRECT, f08c47fec0942fa0Replace the publisher ID with yours, exactly as it appears in your account. The field order is from the IAB spec, Domain, Account ID, Account Type, Certification Authority ID, and the last value is Google’s own certification authority ID, the same for everyone.
Per the IAB ads.txt spec v1.0.3,
the serving rules are strict, and one of them quietly undoes the other 14 minutes. The file
must sit at the root, https://example.com/ads.txt, be fetchable with a plain GET and no login,
and be served as text/plain; charset=utf-8. Subdomains do not inherit it; the SUBDOMAIN=
directive delegates. And redirects are not permitted. The www redirect you set up for tidy
URLs makes the file unreachable at the host that is actually serving the ads. Serve it with a 200
on whichever host carries them.
Google calls the file “not mandatory, but highly recommended”, then puts an Authorized inventory requirement in the Publisher Policies. In practice: publish it, keep the publisher ID exact, and treat a mismatch as a revenue-loss bug rather than a formatting nit.
The script that will slow your fast site down
If any of your readers are in the EEA or the UK, Google’s EU user consent policy requires a certified Consent Management Platform integrated with the IAB TCF. Not a cookie banner you wrote yourself. Not a banner that sets a flag. A certified vendor’s script, and since 1 March 2026 it has to speak TCF v2.3; an older integration degrades or stops ad serving to those readers.
Here is the irony for anyone who has built a fast site. A CMP is a blocking third-party script in
the <head>. It has to run before any ad or analytics tag, so on a first visit it is frequently the
Largest Contentful Paint element and a top contributor to layout shift. There is currently no
self-hostable certified CMP, because the certification process assumes a vendor. Budget for it in
your performance work rather than meeting it on launch day.
If your subject is money
Three things that are not obvious, in rising order of seriousness.
Crypto content is not restricted by AdSense policy, but it depresses ad demand. The advertiser categories that pay well tend to avoid it, so the same traffic earns materially less than it would in a mainstream vertical. That is a business fact, not a compliance one, and it belongs in your revenue expectations from the start.
Financial content sits in YMYL, “your money or your life”, where Google applies a materially stricter quality bar. Expertise signals that are optional elsewhere are close to mandatory here.
The genuine legal landmine is the UK financial promotions regime. Content that invites or induces investment activity can be a financial promotion, which must be issued or approved by an authorised person. Getting this wrong is a criminal offence, not a policy violation, and “it was just an article” is not a defence. Educational explanation is generally fine; recommendations and inducements are not. If you write about specific investments for a UK audience, take actual advice.
A disclaimer page, saying plainly that nothing is financial advice, that figures are estimates, and that readers should verify before acting, should be treated as required rather than optional.
The order of work
- Publish real articles first. Not 30. Enough that a reviewer can see what the site is for and that a person with knowledge wrote them.
- About and Contact, naming a human, with a contact route that works.
- Privacy policy satisfying both Google’s four disclosures and GDPR Article 13.
- Cookie policy, with a link that re-opens consent.
- Terms and Disclaimer. Leave comments off.
- A certified CMP on TCF v2.3, if any traffic is EEA or UK.
ads.txtat the root,text/plain, no redirect.- Apply, then keep publishing while the review runs.
What this does not cover
The rules for your country, your tax position, or your circumstances. Nothing here is legal advice, and the regulatory items are summaries of primary sources rather than substitutes for them: the e-Commerce Directive, GDPR, DSA and AI Act citations point at the instruments, and the CJEU contact-route holding is reported second-hand.
It also cannot tell you whether your site will pass. Nobody can, because the deciding step is a person applying a standard about value, and value is the one thing a checklist cannot contain.
Everything with a Google support link was checked against that page. Everything without one is marked as second-hand where it matters, and dates are given because this area changes: the TCF version deadline and the AI Act date both moved before they landed.