There is no duplicate content penalty. Google's own canonicalization documentation says some duplicate content on a site is normal and is not a violation of its spam policies, and nothing in the docs describes a punishment for it.
So the honest answer to the question is: not the way you have been told, and yes in three quieter ways that cost real traffic. The penalty myth survives because the costs are real, they just work by a different mechanism than punishment, and the fix depends on which mechanism you are looking at.
What Google actually does with duplicates
When Google finds several pages with the same or very similar content, it does not sanction anybody. It clusters them, picks one URL as the canonical, and treats the rest as copies. The canonical is what usually appears in results and gets crawled most often, while the duplicates get crawled less.
You can suggest which URL should win, with a redirect, a rel="canonical" element, or your sitemap, and the docs are careful to call your suggestion a hint, not a rule. Google decides. Most of what people experience as a duplicate content problem is really this decision going a way they did not want.
The three real costs
First, the wrong version can rank. If your article exists at four URLs and Google canonicalizes the one with tracking parameters, or the copy on a partner's site, that is the version people see. Nothing was penalized. You simply lost the vote you did not know was happening.
Second, signals split. Google's guidance on consolidating duplicate URLs lists signal consolidation as a main reason to declare a canonical: links pointing at scattered versions of the same page are votes for different candidates until the cluster is resolved cleanly. Leave it ambiguous and some of your link equity is always parked at the wrong address.
Third, crawl waste. Every fetch spent on the parameter-soup version of a page is a fetch not spent on content you want indexed, which the docs flag as a reason to manage duplication on larger sites. A five-page blog does not feel this one. A 40,000-URL store does.
There is no safe percentage
A number circulates in SEO forums that some percentage of duplication, usually 20 or 30 percent, is "acceptable" before Google reacts. No such threshold appears anywhere in Google's documentation. The docs describe clustering and canonical selection, which happen per page, not a sitewide duplication meter with a red zone.
The myth survives on a confusion between two different instruments. A plagiarism checker's percentage measures how much of one text overlaps other indexed text, which is a question about writing. Google's duplicate handling asks which of several copies of a page should represent the cluster, which is a question about URLs. A product page that is 40 percent identical to a competitor's is not facing an SEO sanction for the overlap; it is facing a duller problem, that it gives Google no reason to show it instead of the other one.
So when a client or a boss asks you to keep duplication under some percentage for SEO reasons, the honest answer is that the number measures the wrong thing. Distinctiveness matters because a page needs a reason to rank, not because a meter somewhere fills up.
When duplication is a spam problem
There is one road from duplicate content to genuine trouble, and it is not about accidental copies of your own pages. Google's spam policies name scraped content directly: republishing content from other sites without adding original material or citing the source, and copying content while modifying it only slightly, through synonyms or automation, then republishing it.
Notice who that policy describes. It is about sites built from other people's work, and the violation is the taking plus the absence of added value, not the duplication itself. If you write original content and it ends up duplicated, you are on the other side of that sentence, the victim of it, and the removal process is a different article's job.
Being on the right side of it matters practically. A scraper duplicating your post does not put your site in violation of anything. Your risk is the first cost above, that Google occasionally resolves a cluster toward the copy, which is an argument for making your original easy to pick: publish first, link it internally, keep it in your sitemap.
Syndication without shooting yourself
Deliberately republishing your article on another site is the one duplication decision content teams make on purpose, and Google's advice about it changed. The current canonicalization troubleshooting guidance says the canonical link element is not recommended for avoiding duplication by syndication partners, because the pages are often very different. The most effective solution, in its words, is for partners to block indexing of your content.
That moves the fix out of your HTML and into your contract. If you syndicate, the agreement should say the partner's copy carries a noindex, and you should actually check that it does after it goes up, because the default outcome of syndicating to a bigger site with no blocking in place is that the bigger site's copy becomes the version Google shows.
A partner who will not agree to block indexing is telling you what the syndication is for. Sometimes the reach is worth it anyway. Decide that with the trade-off in view instead of discovering it in your traffic graph.
The boring internal duplicates, and the ten-minute audit
Most duplication on a normal site is plumbing, not theft: http and https both resolving, www and bare domain both live, tracking parameters, printer views, a paginated category showing the same intro on every page. Each is harmless individually. Together they decide canonicals for you, silently.
The audit is quick. Pick your three most important pages, and check how many URLs can reach each one. Then pick one URL to be the address, redirect what you can, mark the rest with rel="canonical", and keep only canonical URLs in your sitemap and internal links. That last habit does the most work: your own links are the loudest hint you give Google about which version is real.
Keep the SEO question and the ownership question separate
Duplicate content is an SEO cost question: which URL ranks, where signals pool, what gets crawled. Plagiarism is an ownership question: whose work is it and who gets credit. The overlap is real, a scraped copy is both, but the tests are different, and editors get into trouble applying one where the other belongs. A legitimately syndicated article is 100% duplicate and 0% plagiarized. A competitor's article rewritten line by line is 0% duplicate and entirely the other thing.
For the ownership side, the check belongs in your workflow before publication, not after: vetting a freelancer's draft catches the copy that would become both problems at once. And for finding out where your published text already lives, scanning a post with PlagiarismCheck.io shows you every page on the web it matches, with a link to each, which turns the abstract duplication question into a list of URLs you can act on. It is free, needs no account, and takes a post in 2,000-word chunks.
The summary fits in two sentences. Google does not punish duplicate content, it resolves it, and the resolution goes to whoever made their preferred version easiest to choose. Make yours the obvious choice and duplication goes back to being what it mostly is, a housekeeping detail.