What are the main reasons a website can be penalized by Google?

Some common reasons are:

Hacked site;
User‐generated spam;
Spammy freehosts;
Spammy structured markup;
Unnatural links to your site;
Thin content with little or no added value;
Cloaking and/or sneaky redirects;
Unnatural links from your site;
Pure spam;
Cloaked images;
Hidden text and/or keyword stuffing

Copied Content
Spammy  links
Hidden Text

Buying links.
Excessive reciprocal links.
Duplicate content.
Overusing H1 tags.
Internal 404s.
Links from sites in another language.
Keyword stuffed content.
Footer links