A spam link is any backlink built purely to manipulate rankings rather than to genuinely reference or recommend content, links from link farms, comment spam, paid link networks, and other manufactured sources that exist to pass ranking value rather than because anyone actually found the destination worth citing.
Google's guidelines are explicit that both a site's outbound and inbound links should reflect natural, organic behavior, and links that don't tend to draw attention from Google's spam-detection systems whether or not the site receiving them had anything to do with building them. That last part matters: spam links pointing at a site aren't always the site's own doing. A competitor running a negative SEO campaign can point a batch of low-quality links at a target specifically hoping to trigger a penalty, which is why regularly auditing a site's own backlink profile, not just the links it builds, matters. Where spam links are found and can't be removed at the source, compiling them into a disavow file and submitting it through Google Search Console tells Google directly to discount them rather than counting them against the site.
