Duplicate URLs are normal, not a penalty. Parameters, session IDs, http and https, www and non-www, trailing slashes, print versions, all produce multiple addresses for one piece of content. Google groups them and selects a canonical: the version it indexes and shows.
Signals Google uses
rel="canonical"link elements- Redirects
- Internal linking patterns, which version you link to most
- Sitemap inclusion
- HTTPS preference
- URL cleanliness
The canonical tag is a hint
It is not a directive. Google can and does choose a different URL when other signals contradict the tag. Search Console shows both “User-declared canonical” and “Google-selected canonical”, a mismatch tells you your signals disagree with each other.
Alien Road recommends: make your internal links agree with your canonical tags. This is the single most common contradiction we find: the canonical says /product/ while every internal link points at /product/?ref=nav. Google weighs behaviour over declaration, so fix the links rather than adding more tags.