A nofollow link has nofollow among its rel values. It qualifies the relationship for search engines; it does not stop a reader from activating the link, and it is not a reliable way to keep a destination out of search results.
Read the markup
<a href="https://example.com/" rel="nofollow">Read the external example</a>
<a href="https://example.com/offer" rel="sponsored">View the sponsored offer</a>
<a href="https://example.com/profile" rel="ugc nofollow"
>Contributor’s profile</a
>These are illustrative external addresses. rel can contain more than one space-separated value. Google prefers sponsored for paid placements, while ugc identifies user-generated links.
What nofollow does not do
Google treats link qualifiers as hints. The destination can still be discovered through another link or a sitemap. Do not use nofollow to protect private content; use appropriate access controls. A page’s noindex directive is a different mechanism and needs to be crawlable for the search engine to read it.
Choose by relationship
Mark an advertisement as sponsored because it is paid, not because of a target ratio. Mark untrusted user contributions according to your publishing rules. Ordinary editorial references do not need a made-up dofollow value.
Inspection exercise: find an external link in your own generated HTML, read its href and rel, and explain why each value is present. Compare ordinary links and a.
Sources
Reference 1 provide the technical details and current compatibility information.