Social Media Automation Rules, Platform by Platform
Approved-API publishing is allowed almost everywhere. What gets accounts restricted is browser automation, automated engagement, and anything done at a frequency a human could not sustain.
Read the policies themselves and something becomes obvious fast: hardly any of them ban automation. Meta’s Platform Terms carry no blanket prohibition on automated access. X’s developer guidelines assume you are automating and tell you how. LinkedIn runs an API whose whole purpose is programmatic publishing.
So when people ask whether social media automation is against the terms, the question is aimed at the wrong document. What these policies restrict is the route you take and the rhythm of what comes out of it.
The distinction every policy turns on
The social media automation rules only make sense once you split them three ways.
One: automation through an approved API. You register an app, request scopes, hold a token, call a documented endpoint. Every network here has a sanctioned route for publishing this way, and no developer document says a post published through it is treated differently from one typed into the app.
Two: automation that drives the website or the app. A browser extension, a headless browser, a script that logs in as you and clicks things. This is where almost every suspension story starts. It is also the only category where the platforms name the worst outcome outright: X’s developer guidelines say non-API automation, scraping and browser automation, results in permanent suspension, and its automation rules say the same of scripting the website.
Three: frequency and shape, whichever route you took. Meta’s spam policy targets very high frequency activity, manual or automated. A person pasting the same comment on sixty posts in ten minutes breaks that rule exactly as a script does. Automation is not the offence. Volume and repetition are.
Most of the trouble comes from skipping that split and asking “is automation allowed” instead of “which of these three am I doing”. The wider approach, automate social media the deliberate way, assumes you have made the distinction, and the automate-or-not decision rule covers which tasks belong in the first category.
Everything below names the document it came from. Where a rule circulates but sits on no platform page, this page says so.
| Platform | Permitted through the approved API | Prohibited or restricted | Where the rule is written |
|---|---|---|---|
| Facebook Pages | Text, links, photos. Scheduling 10 minutes to 30 days out | Meta’s developer docs index lists no Groups API. Personal profiles cannot be scheduled | Pages posts guide; spam policy |
| Single image (JPEG), video, Reels, Stories, carousels up to 20 items | Very high frequency activity, manual or automated. Professional account needed | Content publishing guide; spam policy | |
| X | Up to 4 photos, or 1 GIF, or 1 video. Polls, replies. No account type needed | Scraping and browser automation. Bulk or automated following. Automated liking. Duplicative posts. Unlabelled bots | X developer guidelines; automation rules |
| Text, image, video, document and article posts. MultiImage is organic | Crawlers, bots, browser plug-ins, extensions. Bulk messaging. Inauthentic engagement | User Agreement 8.2; help centre | |
| TikTok | Video and photo posts, straight to a creator’s account | Everything from an unaudited client is private-only. Automation tools that bypass its systems | Content Posting API; Community Guidelines |
Image or video pins, with pins:write | Apps registered from 14 September 2026 may get a 403 for non-business users | Create boards and pins | |
| YouTube | Uploads with publishAt and privacyStatus set | 100 videos.insert calls a day, in a quota bucket of their own | videos.insert; quota cost |
Meta: Facebook and Instagram
Start in the wrong place and you will conclude Meta bans everything. The Platform Terms, the document people quote at each other, do not. They define processing to cover handling data whether or not by automated means, so automated processing carries the same obligations as any other, and they bar de-anonymising platform data or processing it without valid user consent to build user profiles. There is no clause saying “do not automate”.
The restriction that catches publishers sits somewhere else: the spam policy in Meta’s Community Standards. It prohibits “posting, sharing, engaging with content or creating accounts, groups, Pages, events or other assets, either manually or automatically, at very high frequencies”. The phrase doing the work there is “either manually or automatically”. Its rationale is content “designed to deceive, mislead or overwhelm users in order to artificially increase viewership”.
Then the clause nobody plans for: “we may place restrictions on accounts that are acting at lower frequencies when other indicators of spam (e.g. posting repetitive content) or signals of inauthenticity are present”. So “I am under the limit” is no defence, because the limit is not a number. Fifteen posts a day of visibly different content reads differently from fifteen near-identical ones, and the second is what a template-driven queue produces by default.
Two more things. Instagram’s content publishing API needs a professional account, and a connected Page may additionally need Page Publishing Authorization. And Meta’s developer documentation index lists no Groups API. That is an observed absence in the docs, not an announcement that one was withdrawn, but the consequence is the same: the bulk group-posting tools have no sanctioned route to fall back on. They are browser automation. The alternative is in automate Facebook pages and groups.
One widely repeated claim did not survive checking. Lists of what gets a Meta account restricted assert that Meta names unapproved third-party tools and near-simultaneous bulk messaging. Those phrasings turn up on vendor help pages and support-forum threads, not in Meta’s policies. The behaviour is risky because of the frequency clause above, not because of a rule written in those words.
X
X publishes the bluntest rules of the six. Use the official API. The developer guidelines state that prohibited activities will get an app suspended or permanently banned, with no exceptions. The clearest way to lose an account is a growth tool driving x.com in a browser session.
Automated engagement is out. Likes must be directly initiated by the authenticated user, which rules out auto-liking by keyword, hashtag, account or schedule. X’s automation rules say it in their own words: you may not like posts or hide replies in an automated manner. Following is just as plain, no bulk, aggressive or automated following, and apps that sell likes, follows, reposts or views are prohibited outright. Reposting is allowed for informational or entertainment purposes, so long as it is not bulk.
One more that a scheduling queue breaks without trying: X prohibits duplicative or substantially similar posts, on one account or across several accounts you operate.
Label the bot. X requires automated accounts to enable the Automated profile label, state in the bio that the account is a bot and who runs it, and be associated with a human-managed account. It costs nothing and is the first thing a reviewer checks.
On penalties, X’s developer guidelines name app suspension, revocation of API access, permanent account bans, and rate limiting for exceeding technical limits. The familiar claim that you will instead get a block lasting roughly 12 to 48 hours appears on no X document, including the automation rules page in its own help centre, which names enforcement outcomes but publishes no duration anywhere. Treat that range as vendor and community reporting.
Reduced distribution is a different case: X’s automation rules say it may filter your posts from search results, so that rung is documented even though the developer guidelines leave it out. Posting itself is uncontroversial, and the compliant route including threads is in automate X posts and threads.
LinkedIn is where the gap between the two categories is widest, and where people cross it without noticing, because the tool that does it installs in four seconds.
Section 8.2 of the User Agreement, the “Don’ts” list, prohibits developing, supporting or using software, devices, scripts or robots to harvest service data, including profile data. Item 13 separately bars bots and unauthorised automated methods to access the service, add contacts, send or redirect messages, “or otherwise drive inauthentic engagement”. Manipulating algorithms has its own clause.
The help centre is more direct, and this is the sentence to read before installing anything: LinkedIn does not permit the use of any third-party software, including crawlers, bots, browser plug-ins or browser extensions. Any member using such tools is in violation of the User Agreement and risks having their account restricted or shut down. The tools themselves may stop working without notice.
Publishing is different. LinkedIn’s Posts API publishes text, image, video, document and article content organically, under w_member_social for a member or w_organization_social for an organisation, and company-page posting needs an administrator, content-admin or sponsored-content-poster role. A scheduler using those scopes is sanctioned. A connection-request sequencer running in your Chrome profile is not, whatever its marketing site says.
“LinkedIn jail” is not LinkedIn’s phrase and appears in none of its documents. It is what members call the feature restriction that lands before a closure: the account stays open, the feed loads, and invitations, messages or search quietly stop working. Durations are community-reported. What is published is the restriction power underneath, in section 3.4.
TikTok, Pinterest and YouTube
These three say less about automation than Meta, X or LinkedIn, and what usually stops you is an approval or a quota rather than a policy clause. TikTok is the exception on both counts.
TikTok gates publishing behind an audit. Its Content Posting API posts video and photo content directly to a creator’s account, but it requires Direct Post configuration and an approved video.publish scope, and the get-started guide states that all content posted by unaudited clients will be restricted to private viewing mode.
Publishing that way is not the banned part. TikTok’s Community Guidelines are separate and blunt: it strictly prohibits automation tools, scripts or other tricks designed to bypass its systems, and it removes fake likes and followers. What catches compliant publishers is the audit, not the guidelines, and it surprises people three weeks in, after a fortnight of posts nobody saw.
Pinterest corrects the common advice. Its developer documentation states no business-account requirement, and its own volume-limits page mentions personal accounts, so “Pinterest needs a business account” is not something Pinterest says. What it does say is that apps registered on or after 14 September 2026 may receive a 403 PINNER_DATA_ACCESS_DENIED for non-business users. Set one up anyway, for that reason rather than the one in the blog posts. Organic formats are image or video pins only, so there is no multi-image pin to automate.
YouTube has no policy objection to scheduled uploads, and account type is the one requirement it does not impose: nothing in the videos.insert reference or the quota pages checked here sets one. The endpoint accepts status.publishAt and status.privacyStatus, which is why upload-now and publish-later is the reliable pattern.
The constraint is arithmetic: videos.insert sits in its own quota bucket capped at 100 calls per day, separate from the 10,000 units a day covering every other endpoint. For a daily channel, irrelevant. For high-volume Shorts across a roster of channels on one project, that is the ceiling, and policy compliance does not move it. Shorts are not a declared format in the API either; classification happens on YouTube’s side.
Penalties, from mildest to worst
Enforcement is a ladder, not a switch, and knowing which rung you are on tells you whether to wait, appeal, or start again. One caveat: the rungs are documented in pieces across different policy pages, but their order and their durations are not published anywhere. That part is inferred from what accounts report.
Reduced distribution. Posts publish, reach falls, nothing tells you. X documents it, as filtering your posts from search results. You cannot appeal something never announced, so stop whatever produced the pattern and give the account a few quiet weeks. It is also the rung people blame for ordinary bad weeks, and the reach question goes through what the evidence actually supports.
Action block. One action stops working, usually the one you were doing too fast: following, liking, commenting. It expires on its own, and retrying on a loop extends it. No platform publishes a duration, whatever the round numbers in the tool blogs suggest.
Feature restriction. Broader and longer. Invitations, messaging or search go dark while the account stays open. This is the LinkedIn jail rung, and the first where an appeal is worth writing, because a human reads it. Remove the extension first: appealing with the tool still installed is how a restriction becomes a closure.
API or app access revoked. The account survives, the integration does not. X names it explicitly, alongside rate limiting for exceeding technical limits. Recovery means a new app registration and, realistically, a fresh review.
Suspension, then permanent closure. At the closure rung there is no recovery step to describe: the account is gone and so is the audience, which is the only reason any of this is worth reading. Rebuild time is a real cost line, and the ROI of automation covers how to price it against the hours a queue saves.
How to stay inside the social media automation rules
Five habits, in the order they protect you.
Publish through the approved API, and check that your tool does. The test: does it send you to the platform’s own authorisation screen with named scopes, or does it want your password, or install as a browser extension? The first is category one, the second category two, however the pricing page describes it.
Keep the frequency human and the content varied. Meta’s clause has no published number and reaches accounts below the threshold when content looks repetitive. Six distinct posts beat sixteen templated ones on this rule, and on every other measure.
Never automate engagement at people who did not ask for it. Follows, unfollows and likes are prohibited outright on X, and LinkedIn reads bulk connection requests and messaging as inauthentic engagement.
Replies, mentions and DMs are the one exception X writes down, and it is narrow: the recipient opted in first, one reply per interaction, opt-outs honoured immediately, and keyword-triggered replies barred by name. Almost nothing sold as an engagement tool fits in that, so treat it as closed unless you built the opt-in yourself. The accounts restricted for automation are rarely the ones scheduling posts.
Label bots where labelling exists. On X that is the Automated profile label plus a bio naming the operator.
Read the policy, not the summary of it. That is harder than it should be: Meta’s Transparency Center renders its policy text in the browser rather than serving it as a page, and X’s help centre refuses automated requests. That is part of why so much of what circulates about these rules is second-hand. Recheck the spam policy and your developer agreement once a quarter.
And if you are already restricted: remove the offending tool first, appeal once, say what you were doing and what you stopped, and do not file again while that appeal is open. Then design the next six months around the rung you landed on.
Questions people actually ask
Is social media automation against the rules?
No, not as a category. None of the six major networks bans automation outright, and every one of them runs a documented publishing API. What their policies restrict is the route and the rhythm: driving the website in a browser instead of calling the API, automating follows and likes, and posting at a frequency no person could sustain.
Can you get banned for using a scheduler?
Not for scheduling through an approved API, which is the sanctioned route on every network covered here. Risk comes from three other things: a tool that logs in and clicks on your behalf rather than holding an OAuth token, automated engagement bolted onto the scheduler, and queue volumes that trip Meta's high-frequency rule. Check which of those your tool does.
What automation gets Instagram accounts restricted?
Meta's Community Standards spam policy targets posting, engaging and account creation at very high frequencies, whether done manually or automatically. The clause people miss is the next one: restrictions can also apply at lower frequencies when other spam signals are present, such as repetitive content. Automated liking, commenting and follow-unfollow cycles carry far more risk than scheduled posts.
What is LinkedIn jail?
An informal name for a feature restriction, and not a phrase LinkedIn uses in any of its documents. The account stays open and the feed loads, but invitations, messaging or search stop working for a period. It usually follows a browser extension doing bulk outreach, which LinkedIn's help centre prohibits by name. Durations are community-reported, not published.
Are automated X accounts allowed?
Yes, through the API and with disclosure. X requires an automated account to enable the Automated profile label, state in the bio that it is a bot and who operates it, and be associated with a human-managed account. What is prohibited is automating the site itself, plus bulk or automated following and liking. Likes must be initiated by the authenticated user.
How long do action blocks last?
No platform publishes a duration. The figures in circulation, typically 12 to 48 hours, come from vendor blogs and community reports rather than any platform document, so treat them as rough expectation rather than policy. The block expires on its own. Retrying the blocked action on a loop is what extends it, so stop the automation and leave it alone.
How do you appeal a restriction?
Remove the tool that caused it first, then appeal once through the in-app or help-centre route, saying what you were doing and what you have stopped. Do not file a second appeal while the first is open. Appeals are worth writing from the feature-restriction rung upward, where a human reviews them. Reduced distribution has nothing to appeal against.
Read next
What to Automate in Social Media (and What Never to)
Not two lists. One decision rule you can apply to any task, plus the short list of things that should never run…
Does Social Media Automation Hurt Your Reach?
Two questions get mashed together here. Scheduling is not the problem; automating engagement is. And the evidence is thinner than anyone admits.
Measuring Social Media Automation ROI, in Hours Not Revenue
General social ROI advice does not answer this. Here is an automation-specific model, including the attribution limits you have to accept.