Your SEO Problem Might Not Be an SEO Problem

What regulated industries taught me about E-E-A-T, and why some ranking drops can’t be found in an audit

When I was working at a marketing agency a few years ago, a client portfolio was handed to me in my first week. One of the accounts was an alkaline water filter business whose rankings had been slipping for almost a year. Not collapsing overnight, which might have been easier to explain, but slowly, the kind of decline you can see in the data but never quite pin down. The brief I inherited was vague, the previous person on the account had tried a few things without success, and the working assumption was that there was some technical SEO problem nobody had managed to find yet.

When I started going through the site, I expected to land on the usual suspects: broken internal links, thin content, maybe a Core Web Vitals problem someone had missed. None of that turned out to be the issue. What I found instead, once I started actually reading the pages rather than auditing them, was content full of claims about the health benefits of alkaline water with no real evidence behind them. In a few places the claims crossed into genuinely alarming territory, including suggestions that alkaline water could help prevent or cure serious illness. There were no sources, no lab data, and no qualified reviewer anywhere on the page, just confident claims stacked on top of each other that someone in the business had probably picked up from industry marketing without thinking much about where they came from.

The client had no idea anything was wrong. Nobody had sent them a notice and no regulator had been in touch. The only signal they’d received was from Google, and Google doesn’t send letters. It had quietly stopped trusting the site, and the traffic kept dropping.

Some time later, in a different role with a different kind of client, a cosmetic clinic in Perth came to me with a situation that looked completely different on the surface. Their rankings were fine and their traffic was healthy. What had changed was that the owner had received a document from AHPRA, the health practitioner regulator, listing specific words and phrases the clinic wasn’t allowed to use in its advertising anymore. Some of those words were on almost every page of their website. They weren’t there by accident. A previous marketing person had put them there because that’s what patients were searching for, and nobody had told the clinic that the rules had tightened. The owner forwarded me the document and asked, very reasonably, what they were supposed to do now.

On paper, these two clients had nothing in common. One was a product business losing rankings quietly, the other a health clinic in legal trouble without any ranking problem yet, and on the surface they were operating in different industries, regulated by different bodies, showing entirely different symptoms. But when I spent enough time with both of them, I realised they were dealing with the same underlying issue from opposite directions. One had been caught by Google first, the other by a regulator first, and both were going to end up in the same place eventually, because Google and regulators are asking versions of the same question. Is this business saying things it’s genuinely qualified and permitted to say?

Here’s the part I want to be honest about, because I think it matters. For a long time I thought of this kind of thing as the client’s problem to flag. If there was a regulatory issue, surely someone in their business knew about it and would tell me. That assumption turned out to be wrong in almost every case. The alkaline water client had no idea, the cosmetic clinic only found out because AHPRA forced the issue, and the adult massage service I worked on in Adelaide, which I’ll come back to later, had watched its visibility drop for months without connecting it to the state laws that governed what words it could legally use to describe itself. By the time any of these businesses understood what was happening, Google had already made up its mind. That year of lost visibility for the alkaline water client wasn’t a year they could reclaim once we fixed the content. It was ground that had to be rebuilt from scratch.

What I’ve come to believe, and what this article is really about, is that if you work in SEO, it’s part of your job to understand the regulatory landscape your client operates in, before they do. Not because you need to be a lawyer. You don’t. But the rules that govern what a business is allowed to say about itself are often the same rules, in spirit, that Google’s quality systems are trying to enforce. The regulators got there first. Google has been catching up, and for YMYL businesses, which is Google’s term for anything that could affect someone’s health, money, safety, or wellbeing, the overlap is almost total.

If that sounds abstract, it won’t for long. The rest of this article covers the specific ways it shows up in practice, across the industries I’ve worked in, and what I now do differently because of it.

Why this keeps happening

To understand why the alkaline water client and the cosmetic clinic ended up in the same place, it helps to go back to August 2018, when something quietly shifted in the way Google evaluates websites.

That month Google rolled out what came to be known as the Medic update. Google itself didn’t call it that. Barry Schwartz, an SEO journalist who looked at over three hundred sites that had lost rankings overnight, gave it the name because roughly 42% of the affected sites were in health or medical territory. That was an unusual concentration for what Google had described as a routine update, and it set off a long conversation in the industry about what had actually changed.

The most useful read on it at the time came from Marie Haynes, who has spent years writing about how Google evaluates trust. Her conclusion was that Google had become significantly better at figuring out whether a website was actually trustworthy, rather than whether it merely looked trustworthy on the surface. The question Google was starting to answer was whether the content, the author, the business behind it, and the broader signals around it added up to something a real person could safely rely on.

The SEO industry responded the way it usually does. Author bios appeared on health articles, editorial policy pages went up, and people started adding review dates, citation lists, and credentials underneath blog posts. All of it was sensible and none of it was wrong, but for a particular kind of business, none of it turned out to be quite enough.

Here’s the thing nobody really wrote about at the time, and nobody has written about much since. For businesses in regulated industries, trustworthiness wasn’t a new question. It was a question their regulators had been answering, in detail, for years before Google started measuring it. In Australia, AHPRA had been telling cosmetic clinics what they could and couldn’t say about treatments long before Google decided to evaluate whether those clinics were credible. The TGA had been governing health product claims for decades. State licensing authorities had rules about what tradespeople had to disclose in advertising. In the United States, the FDA had been setting boundaries around therapeutic claims for supplements, CBD products, and medical devices since long before search engines existed. The names of the regulators change depending on the country, but the pattern doesn’t. Wherever there’s a YMYL industry, there’s a regulator who has already drawn a line around what trustworthy looks like in that sector. In 2018, Google started measuring whether websites were on the right side of that line, even if it never used those words.

In practice, this means the regulator’s rules and Google’s quality systems are usually pointed at the same target. They aren’t identical. Google won’t issue a fine, and a regulator won’t drop your rankings. But they’re asking versions of the same question, and a business that fails one is likely to eventually fail the other.

This is where the SEO industry has a blind spot, and I include myself in it for a long stretch of my career. We treat regulatory information as a separate domain. The legal team handles it, the compliance officer handles it, the client will tell us if there’s anything we need to know. We focus on what we’re trained to focus on: keywords, content briefs, technical audits, link profiles. The problem is that for a YMYL business, the regulator’s guidelines are part of the SEO landscape whether we treat them that way or not. Ignoring them doesn’t make them go away. It just means we discover them late, usually after something has gone wrong.

If you’re reading this as a business owner, the takeaway is simpler than it might sound. Your SEO consultant probably isn’t reading your industry’s advertising regulations. That isn’t because they’re bad at their job. It’s because the industry has historically treated that work as somebody else’s problem. This article is, in part, an argument that it shouldn’t be.

The four ways this shows up in practice

Across the regulated businesses I’ve worked on, the overlap between regulators and Google falls into four patterns. They show up differently in different industries and need different responses, but they’re all variations of the same underlying problem. Once you’ve seen them, you start seeing them everywhere.

1. Words your business isn’t allowed to use

There are some words your business isn’t legally allowed to use on its website, even if those words are exactly what your customers are typing into Google.

This sounds strange the first time you hear it. We’re used to thinking of language as something we’re free to choose. But in regulated industries, certain terms are restricted by law, and the website is treated as advertising material whether you think of it that way or not. If a regulated term appears anywhere on your site, whether in body copy, page titles, meta descriptions, or alt text, the regulator treats it as advertising. The intent behind its placement isn’t the issue. What matters is that the term is there.

Here’s what that looks like in three different industries.

In Australian cosmetic medicine, a clinic isn’t allowed to name specific injectable treatments on its website. The brand names you’d recognise, like Botox, Dysport, and Juvederm, are all prescription medicines, and prescription medicines can’t be advertised to the public under the Therapeutic Goods Act. The restriction goes further than most clinics realise. It also covers generic ingredient names like botulinum toxin and hyaluronic acid, and much of the casual shorthand that has crept into common usage. Terms like “lip flip,” “liquid nose job,” and “lunchtime lift” all carry compliance risk in promotional content. The Perth clinic I described at the start had several of these phrases across its pages, and they’re the reason AHPRA’s letter landed on the owner’s desk. None of it was placed there with bad intent; it was there because patients were searching for it. But the TGA doesn’t care why a word is on a page, only that it’s there, and once it’s there, the page is the advertisement, regardless of what the marketing team thought they were producing.

In the United States, a similar pattern applies under the FDA’s rules for supplements and CBD products. A CBD oil business can’t claim its product treats anxiety, helps with chronic pain, or supports any specific medical condition. Those claims sit on the wrong side of a clear regulatory line, and the FDA has issued warning letters to dozens of CBD brands for exactly this kind of language. The fact that customers are searching “CBD for anxiety” doesn’t change the rule. If anything, it makes the temptation greater and the risk worse.

In the Australian background checking industry, the high-volume search term most people naturally type when they want to verify someone’s background is explicitly prohibited in its capitalised form by the regulator that governs accreditation in that sector. The technically correct term is several words long, and almost nobody types it into Google unprompted. An accredited business that optimises for the prohibited capitalised term is, on paper, doing a perfectly reasonable job of SEO while breaching the terms of its accreditation at the same time.

Three different industries, three different regulators, same mechanic underneath. Your customers are searching for terms your business isn’t allowed to use, and if you build your content around those terms, being good at SEO becomes the same thing as being non-compliant.

If you’re reading this as a business owner: ask your SEO consultant whether they’ve read your industry’s advertising guidelines. If the answer is no, that’s the first conversation to have. The guidelines are usually publicly available on the regulator’s website, and they’re usually clearer than people expect. The TGA, AHPRA, and the FDA all publish their advertising rules in plain English, and an afternoon spent reading them will tell you more about what you’re allowed to publish than any keyword tool ever will.

If you’re reading this as an SEO: before you build a keyword strategy for a regulated client, find the regulator and read the rules. The keyword tool will tell you what people are searching for. The regulator will tell you what your client is allowed to say. The intersection of those two is where the actual content strategy lives. Anything outside it is either wasted effort or active risk.

2. The same country, different rules in different places

The same word, the same phrase, the same kind of service can be perfectly legal to advertise in one part of the country and against the rules in another. If your business operates across state lines, this matters more than most people realise.

Most marketing teams treat localisation as a content task, where you swap in different suburb names, change a few local references, and call the page localised. You don’t usually stop to ask whether the actual words on the page are governed differently from one state to the next. But for some industries they are, and a single template rolled out across every state page can quietly create legal exposure in one market while being completely fine in the others.

The clearest example I’ve worked on is the Adelaide adult massage business I mentioned at the start. In South Australia, certain terms commonly used to describe adult massage services are classified under state law as advertising for adult services, which sits in a different regulatory and tax category from a regular massage business. Using those terms without being licensed in that category isn’t just a marketing decision; it changes how the business is treated for tax and licensing purposes. The same words are used freely in Sydney and Melbourne, where the state laws draw the line differently. A massage business running one national page with those terms is fine in two states and exposed in one.

The owner hadn’t connected any of this to his ranking decline. He’d watched his visibility fall over several months and assumed something was wrong with the SEO. When I rewrote the South Australian pages with terminology compliant in that state, the rankings started to recover. The interesting part, and something I’ve not seen written about anywhere, was how Google was behaving. The searches themselves hadn’t changed. People in Adelaide were still typing the original prohibited terms into Google, the same ones they’d always used. What had changed was what Google chose to surface. Sites using those exact terms in their titles and content weren’t ranking anymore. The results were filled with sites using the alternative vocabulary instead, terms like “adult massage parlour” and similar phrasing. Google had effectively decided which language was acceptable for this category of search in this market, and it had done so without anyone telling it to.

The same jurisdictional problem shows up in less colourful industries. Western Australia requires electrical contractors to display their licence number in any advertising, with official guidance that it should be no smaller than half the size of the largest text in the ad, and that requirement doesn’t apply the same way in Queensland or New South Wales. In the United States, the rules for everything from cannabis advertising to financial services disclosures vary state by state. What’s legal in California isn’t necessarily legal in Texas, and a website doesn’t know the difference unless someone has thought to check.

Geo-targeting in regulated industries isn’t really about location signals or local SEO. It’s about whether the words on each state-specific page are legal in the state that page is targeting. That’s a different question, and no tool will answer it for you.

If you’re reading this as a business owner: if you operate in multiple states with a single content template, that template needs to be reviewed against the rules of each state, not just localised for keywords. The question isn’t whether the page mentions the right city. It’s whether the page would hold up if the regulator in that state looked at it tomorrow.

If you’re reading this as an SEO: a national content rollout isn’t one piece of work. It’s as many pieces of work as there are states involved, each checked against local rules. That’s slower than the single-template approach, and it’s also the only way to avoid building a problem you’ll later have to dismantle. The South Australian page that ranked well wasn’t the one I wrote first. It was the one I wrote after I understood why the original wording couldn’t work.

3. Claims you can’t back up

If your website makes claims about what your product does, what your service achieves, or what outcome your customer can expect, those claims need something real behind them. If they don’t, the disclaimer at the bottom of the page won’t save you, and Google has become very good at noticing the gap.

This is the pattern that brought down the alkaline water client. Their content was full of confident claims about health benefits, and almost none had meaningful evidence underneath. There were no references to clinical research, no lab reports showing what the filter actually did to the water, and no qualified person reviewing the medical claims, just assertion after assertion with a small disclaimer at the bottom of each page saying the content was for informational purposes only.

The disclaimer wasn’t doing what the business thought it was doing. In Australian regulatory terms, a line at the bottom of a page saying “this product is not intended to diagnose, treat, cure, or prevent any disease” doesn’t give the business permission to make therapeutic claims above it. The TGA looks at the whole page. If the body promises therapeutic outcomes and the footer disclaims them, the disclaimer reads to a regulator as evidence the business knew the claims were problematic and tried to cover itself. It makes things worse, not better.

Google appears to have arrived at a similar conclusion on its own. The alkaline water client was never issued a notice and never heard from a regulator. Google had simply, over a period of months, stopped trusting the site enough to keep it on the first page. When I cleared out the unsupported claims, replaced them with content the business could actually substantiate, and added genuine references and lab data where it existed, the rankings began to recover over the following months and kept improving as Google could see the site was now saying things it could back up.

I’ve seen this pattern in every health-adjacent industry I’ve worked in: supplement brands claiming energy, recovery, or immune benefits with no clinical evidence, skincare companies claiming therapeutic outcomes without studies, functional food businesses drifting from the aspirational into the regulated. In the United States the FDA polices this territory for supplements and CBD, and in Australia the TGA does the same. The specific rules differ, but the principle doesn’t.

What makes this pattern tricky is that the line between an acceptable claim and a regulated one isn’t obvious from the outside. “Hydrating” is generally fine, “hydrates damaged skin cells” might not be, and “supports immune function” depends entirely on what evidence you can produce. The lines also shift, so the useful habit isn’t memorising where they fall. It’s asking whether every claim on the page has something real underneath it, and removing the ones that don’t.

Genuine evidence also isn’t decorative. When a business does have lab data, third-party testing, or peer-reviewed sources, those belong on the page, linked and visible rather than buried in a footer. They’re the strongest trust signal a YMYL site can publish. A protein supplement brand publishing the lab results showing what’s actually in the tub is doing something the regulator wants, Google rewards, and customers genuinely care about, all at once.

If you’re reading this as a business owner: go through your website and find every claim it makes about what your product or service does. For each one, ask whether you have actual evidence: a study, a lab report, a qualified review, a verifiable source. If you can’t produce the evidence, the claim shouldn’t be on the page. That’s true for legal reasons and for SEO reasons, because Google notices when claims and evidence don’t match.

If you’re reading this as an SEO: when you take on a YMYL client, ask for the substantiation before you write the content. Ask to see the lab data, the sources, the credentials of whoever reviews the claims. If none of it exists, the content strategy has to be built around what the client can actually prove, not what their competitors are saying. It’s a slower conversation than most clients expect, and it’s the one that keeps the site ranking when the next quality update lands.

4. Things you have to display on the page

The fourth pattern runs in the opposite direction. Instead of restricting what you can say, some regulators require specific information to appear on anything that counts as advertising, and the absence of that information is itself the compliance failure. There’s nothing to remove and nothing to rewrite. Something has to be added, and if it isn’t there, the page is non-compliant no matter how good the rest of the content is.

The clearest example I’ve seen is the Australian electrical trades. In Western Australia, the licensing regulations require an electrical contractor’s licence number to be conspicuously displayed in any advertising, and the official guidance interprets that as no smaller than half the size of the largest text in the advertisement. Websites, vehicle wraps, business cards, and Google Business Profiles all count as advertising, and the licence number isn’t optional on any of them, whether the electrician knows about the rule or not.

From an SEO perspective, this requirement lines up almost perfectly with the trust signals Google’s quality systems look for on YMYL service pages. A licence number tells a user, and by extension Google, that the business is registered with the relevant authority and operating within the scope of what it’s authorised to do. Crucially, it’s independently verifiable. A user can check it and a quality rater can check it, and that verifiability is what separates a genuine trust signal from a self-promotional claim.

But treating this purely as an E-E-A-T tactic misses the point. It’s a legal obligation first. An electrician’s website missing its licence number is non-compliant regardless of how strong the content is or how many five-star reviews the business has. The compliance failure and the trust gap are the same gap. The same principle applies across regulated industries: financial services businesses display their Australian Financial Services Licence number, health practitioners their AHPRA registration, accredited background checkers the details tied to their accreditation, and in the US, financial advisors work under SEC and FINRA disclosure rules. In every case, the regulator wants consumers to be able to verify the business is authorised to offer what it’s advertising, and the website is where that verification happens.

What makes this pattern easy to miss is that nothing about a missing licence number looks wrong. The content can be polished, the design professional, and the page still non-compliant. Nobody is looking for what isn’t there, which is why this problem tends to sit on websites for years.

If you’re reading this as a business owner: find out what your regulator requires you to display on advertising material. The information is almost always public and not difficult to understand once you know to look. If your business holds a licence, registration, or accreditation, the relevant number probably needs to appear on your website in a particular form. Adding it is easy. Knowing it has to be there is the part that gets missed.

If you’re reading this as an SEO: early in any regulated-industry engagement, ask what licence numbers, registrations, or accreditation details are required in the client’s advertising. Don’t assume their absence from the current site means none are needed; the previous person on the account may not have known to ask, and the client may not have known to mention it. The check takes ten minutes, protects everyone involved, and tends to surface other compliance gaps along the way.

When the regulator and Google agree completely

The four patterns above can all be navigated with care. There’s a smaller category where the overlap between the regulator and Google becomes so tight that almost no consumer-facing content is possible at all, and it’s worth knowing these cases exist.

The clearest Australian example is medicinal cannabis. These products are almost entirely prescription-only, which means the Therapeutic Goods Act prohibits advertising them to the general public, and the TGA’s interpretation is unusually broad. The prohibition explicitly extends to colloquial alternatives: if “plant medicine” becomes a commonly understood synonym for medicinal cannabis, the TGA treats it the same as the original term. The regulator isn’t just closing the door on the obvious vocabulary. It’s watching for which window the market opens next and closing that one too. This isn’t theoretical. The TGA has issued infringement notices totalling well over a hundred thousand dollars to a single operator for advertising that used indirect references like “plant medicine,” and it has taken companies to court over the same kind of language, including media publishers whose articles about cannabis clinics were treated as unlawful advertising. Even editorial coverage can be the advertisement.

For an SEO in this space, the implication is that there’s no compliant synonym strategy and no clever workaround. The only permissible consumer-facing content is content that doesn’t reference the product or its availability at all. It’s an extreme case, but a useful one, because it shows that some regulatory boundaries are actively defended against exactly the kind of linguistic adaptation that would normally fill a search vacuum.

The other thing worth understanding is what happens when a business gets caught. A compliance notice, a removal from an accreditation register, or media coverage of an enforcement action creates off-site signals that Google’s quality systems can see. The authoritative mentions a YMYL site needs in order to demonstrate trustworthiness can be replaced by negative coverage, and once that happens, no amount of on-page cleanup rebuilds the lost trust. A substantiation problem on a product page can usually be fixed within a week; a news article reporting a regulator’s findings is much harder to dilute, and it sits in exactly the territory Google pays most attention to. Reputation, in Google’s framework, isn’t only what people say about a business. It’s also what regulators do about it, and what gets reported when they do.

What to actually do about all of this

If you’ve read this far, the temptation is to close the tab and go check your own website. Before you do, it helps to have a structure, because this work is methodical rather than instinctive. Here’s the audit I now run, in some form, for every regulated client I take on. It’s the work I wish I’d been doing years earlier.

Find the regulator before you open any SEO tool

Identify every regulator with authority over how the business advertises. For an Australian cosmetic clinic that’s both AHPRA and the TGA, since they govern different aspects of the same content. For a financial advisor it’s ASIC. For a US supplement brand it’s the FDA, and possibly the FTC for advertising claims. For a licensed tradesperson it’s the state authority that issues the licence, which changes depending on where they operate.

Then find each regulator’s advertising or media guidelines. They’re almost always published openly and written in plainer language than people expect. Read them once, then read them again with the client’s website open in another tab. Most of the patterns in this article become visible within an hour of doing this.

Turn the rules into a working document

Build a simple three-column list: terms that are permitted, terms permitted only under specific conditions, and terms that are prohibited. The middle column matters most, because some terms can only be used by qualified practitioners, or with particular disclaimers, or in particular contexts, and those conditions get forgotten unless they’re written down.

This document becomes the starting point for every piece of content the business publishes, and it changes the keyword conversation from instinct to documentation. When a client asks why a high-volume term isn’t being targeted, the answer stops being “I think it might be risky” and becomes “the regulator lists it as prohibited, and here’s the relevant section.” Share it with the client as a deliverable they can hand to their legal or compliance people. Most regulated businesses know their obligations in general terms but haven’t connected them to their search strategy, and putting it in writing closes that gap.

Then check the claims, the disclosures, and every jurisdiction

The rest of the audit applies the four patterns directly. Go through every claim the site makes about what the product or service does and ask what evidence sits behind it; where the evidence doesn’t exist, the claim comes off the page, even when that’s an uncomfortable conversation. Check that everything the regulator requires on advertising material is actually present, in the form the regulator specifies, because a missing licence number looks like nothing at all until someone knows to look for it. And if the business operates across multiple states or countries, run each location’s pages against that jurisdiction’s rules separately. The test for any geo-targeted page is simple: would it hold up if the local regulator opened it tomorrow?

Accept that the most important work here is invisible

Almost none of this produces a metric that looks impressive in a monthly report. The terms you didn’t target don’t appear in rank tracking, the claims you removed don’t show up in a dashboard, and the licence number you added doesn’t move traffic. The value shows up later, when a quality update lands and the site holds while competitors drop, or when the regulator sweeps the industry and your client isn’t on the list. That’s the trade this whole approach makes: less that’s visible this quarter, more that’s still standing in five years.

The shift this article is asking for

If there’s one thing I’d want a reader to take away, it’s a small change in the order of operations.

The standard approach to SEO starts with what the customer is searching for. You do keyword research, analyse the competition, build a content strategy around the opportunity, and optimise from there. That order works in most industries. It doesn’t work in regulated ones, because by the time you’ve decided what to target, you’ve already made commitments the regulator may not let you keep.

The order that works starts with what the business is actually allowed to say. Find the regulator, read the rules, and understand what’s permitted, what needs substantiation, and what’s prohibited before you think about keywords at all. Keyword research and competitor analysis still happen, but inside a smaller and more honest space than the one most SEO workflows assume is available.

This sounds like a constraint, and at first it feels like one. In practice it tends to be the opposite. The businesses that work this way end up holding ground their competitors can’t take, because the competitors are still operating in territory the regulators have already claimed. They keep ranking through quality updates that knock other sites down, and they avoid the surprise letters and unexplained traffic drops that catch everyone else out.

The thing that has surprised me most, looking back across these clients, is how often the regulator’s rules turn out to be a clearer guide to good content strategy than any keyword tool. The regulator has already worked out what trustworthy looks like in that sector and published it, usually in plainer language than people expect. The work isn’t figuring out what trustworthy means from scratch, but reading what’s already been written and applying it before someone forces you to.

That’s really the heart of it. The regulators got there first, Google has been catching up, and the SEOs and businesses who see the connection are the ones whose websites still rank in five years for the things they actually deserve to rank for.