X Automation Rules: What Automated Accounts Can and Cannot Do

The short answer

As of 2026-10-16, X lets automated accounts post, repost and reply, but automated replies and mentions are only allowed to people who opted in first. Replying to strangers because their post matched a keyword is not allowed. Any AI-powered reply bot needs prior written approval from X. API-based bot accounts must say what they are and who is responsible for them.

Three X pages set these rules: the Automation rules in the Help Center, the Authenticity policy (the old "platform manipulation and spam" address now redirects there), and the Developer Policy. Everything below is quoted or paraphrased from those pages as they read on 2026-10-16.

What the Automation rules allow and forbid

The Automation rules page is marked "Updated April 2026" and says it is "primarily intended for developers". It still matters to ordinary users, because it says you are responsible for apps you connect to your account.

The "Do!" list includes:

• Build solutions that automatically broadcast helpful information in posts.
• Run creative campaigns that auto-reply to users who engage with your content.
• Build solutions that automatically respond to users in Direct Messages.

The "Don't!" list includes abusing the API, dodging rate limits, spamming users, and this:

“Use non-API-based forms of automation, such as scripting the X website. The use of these techniques may result in the permanent suspension of your account.”

Source: X Automation rules. The same page also forbids automatically posting about trending topics, posting "duplicative or substantially similar posts" on one account or across several, and automating multiple accounts for the same purpose. Automated likes are out entirely: "You may not like posts or hide replies in an automated manner." Automated reposts are allowed for "entertainment, informational, or novelty purposes", but bulk or aggressive reposting is a violation.

If an app acts through someone else's account, the page says OAuth authorisation alone is not enough consent. You have to describe the automated actions, get express consent, and honour opt-outs immediately.

Automated replies and mentions: the opt-in test

This is the section most people searching for automated reply rules need. It opens with a clear line:

“Automating these actions to reach many users on an unsolicited basis is an abuse of the feature, and is not permitted.”

Source: X Automation rules. The example it gives is the one many growth tools are built around: "sending automated replies to posts based on keyword searches alone is not permitted."

Automated replies or mentions are allowed only when all of these hold:

1. Before you reply, the person has asked, or clearly shown on X, that they want you to contact them. Replying to one of your posts or sending you a Direct Message are the page's examples.
2. There is a clear, easy way to opt out, and you honour opt-outs promptly.
3. You send only one automated reply or mention per user interaction.
4. If the campaign is based on people replying to your post, your automated reply goes to the user's original post.

Being followed does not count. The page says a follow "is not on its own a sufficient indication of user intent to receive an automated response." It also says advertisers, publishers and brands running auto-response campaigns "must request approval from X and may be subject to additional rules."

The Developer Policy repeats the core of this for anyone using the API: "Always get explicit consent before sending people automated replies or Direct Messages" and respect opt-out requests immediately.

AI reply bots need written approval

The Automation rules have a separate section on AI. X says AI reply bots that generate "dynamic, context-aware responses" are possible, but with a condition:

“the deployment or operation of any AI reply bot requires prior written and explicit approval from X.”

Source: X Automation rules. The page points you to your X point of contact or a request through the developer portal. Approval for an AI bot does not replace the opt-in rules above. The section begins "Provided you comply with all other rules".

Labelling a bot account

The Developer Policy is direct about disclosure:

“If you’re operating an API-based bot account you must clearly indicate what the account is and who is responsible for it.”

Source: X Developer Policy. It adds that you should never mislead people about whether an account is a bot, and calls a bot statement in the profile bio "A good way to do this".

X also has an automated account label. The About Automated account labels page says "Our Automation rules require these accounts to display labels and remain connected to a human-run account." Turning the label on links the bot to the human account that manages it, so everyone can see who runs it. The same page describes the feature as a launch and says the label appears once an account "accepts the invitation to our test group", on the profile and possibly on posts. If the label is not available to you, the bio statement is the step the Developer Policy itself suggests.

What the Authenticity policy adds

The Authenticity policy (dated April 2025 on the page) applies to every account, automated or not. Under inauthentic accounts it lists "Unauthorized automation", meaning automated or scripted accounts that do not comply with the Developer Policy. Its content spam list names:

• "Sending bulk, aggressive, high-volume unsolicited replies, mentions, or direct messages"
• "promoting content by replying with content that is irrelevant to the topic of the original post"
• using trending hashtags to drive attention to products or services

Under engagement spam it forbids trading, buying or selling accounts, coordinated engagement exchanges, paying others to inflate metrics, and "engaging with posts aggressively or through the use of automation to drive traffic or attention" to accounts, websites, products or services. The Developer Policy adds that you may not pay or be paid for X actions, including replies.

On multiple accounts, the policy allows up to ten accounts "for different, non-duplicative purposes" and allows social media managers to run accounts for clients, as long as no rule is broken. It forbids using several accounts to boost the same content or to "misuse the mention/reply feature".

Enforcement depends on severity and history. Listed options include anti-spam challenges, restricted reach (such as removal from search results and downranking in replies), temporary loss of features, and suspension.

A checklist before you automate replies

1. Use the X API, not browser scripts.
2. Reply only to people who opted in on X, once per interaction, with an easy opt-out.
3. No replies triggered by keyword matches alone, and no reliance on follows as consent.
4. If replies are AI-generated, get X's written approval first.
5. If you are a brand running an auto-response campaign, request X's approval.
6. Say in the bio that the account is a bot and who is responsible for it; add the automated label if X offers it to you.
7. No duplicate posts across accounts, no automated likes, no paid or traded engagement.

What this does not cover: X's advertising policies, the separate rules a partner manager may set for approved campaigns, and the X Rules beyond spam and authenticity. Policies change, so re-read the linked pages before you build. This is not legal advice.

Agent Agency is software that learns your product from a link and runs AI agents that promote it in online communities.