Multiple things can cause traffic drops & penalties, here are the principal causes:
A Manual Action.
Google has determined you have broken their guidelines and applied a manual action. These are often link spam related, but there are other manual actions as listed here.
An Algorithmic penalty.
Specific components of Google’s algorithm that looks at areas such as link spam, or content quality.
A Google Algorithm Update.
Google often changes how its algorithm ranks websites. Approximately every 6 months, they release a core update which usually has widespread effects on website rankings. Often content related.
Changes to the search results layout.
Google may have added features that push organic results further down the page resulting in less clicks. Such as quick answers, featured snippets and ads.
If you have made significant changes to your site, it can affect your rankings. Website migrations, redesigns, content changes and new features can all cause this. There may also be accidental technical issues such as blocking URLs from crawling or indexing.
Sometimes there hasn’t actually been a drop in traffic, but an issue in how performance is being reported.