How Brands Should Reply on X Without Looking Like Spam

A brand should reply on X the way a helpful person would: once, in the thread where someone asked, about the thing that post is about, from an account that plainly says who it is. As of 2026-10-16, X's own rules draw the line at volume and relevance. Bulk, high-volume unsolicited replies are not allowed, replies that ignore the topic of the original post are not allowed, and automated replies triggered by keyword searches alone are not allowed. Everything below comes from X's Help Center and Developer Policy, linked as we go.

What X counts as reply spam

The X Rules say you may not use the service to artificially amplify information or to manipulate or disrupt people's experience. The details sit in X's Authenticity policy (the old platform manipulation and spam page now redirects there). Under “Content Spam”, two items describe exactly what a careless brand account does:

“Sending bulk, aggressive, high-volume unsolicited replies, mentions, or direct messages”

“promoting content by replying with content that is irrelevant to the topic of the original post”

The same list also names copy-pasted posts (“Copypasta”), piling unrelated hashtags into posts, and posting mostly bare links with no commentary. Under “Engagement Spam”, it adds engaging with posts aggressively or through automation to drive traffic or attention to products or services. The policy gives no number for what counts as high-volume, so there is no safe quota to aim for. Judge each reply on whether the person would want it.

Reply in the thread, on the topic

Read together, the rules point to a simple routine for anyone replying by hand from a brand account:

1. Reply only where the post asks a question or describes a problem your product actually addresses. If you have to stretch to make it relevant, it is the off-topic promotion the policy describes.
2. Answer in the reply itself. A link can support the answer, but a stream of links without commentary is listed as spam behavior.
3. Write each reply for that thread. Identical or nearly identical text posted again and again is the Copypasta the policy bans.
4. Stay out of trending hashtags you have no real part in. The policy bans using trending or popular hashtags to drive traffic or attention to products, services or accounts.
5. Move personal details to a private channel. X's Automation rules say not to ask users for personal or private information in a public post, and to use Direct Messages or another private channel instead.
6. Reply once and let the person answer. The Automation rules say that after a user-initiated interaction ends, you should not send follow-up Direct Messages or mention them in a post without their permission.

Automated and AI replies need opt-in and approval

If software sends your replies, the Automation rules (marked “Updated April 2026”) are stricter. On mentions and replies they say:

“Automating these actions to reach many users on an unsolicited basis is an abuse of the feature, and is not permitted.”

The page then gives an example: sending automated replies to posts based on keyword searches alone is not permitted. Automated replies are allowed only when all of these hold:

• the person opted in first, for example by replying to a post from your account or sending you a Direct Message (following you is not enough on its own);
• there is a clear, easy way to opt out, and opt-outs are honored promptly;
• you send one automated reply or mention per user interaction;
• the reply goes to the user's original post when the campaign is based on people replying to yours.

The rules add that advertisers, publishers and brands running auto-response campaigns must request approval from X. AI-written replies get their own clause:

“the deployment or operation of any AI reply bot requires prior written and explicit approval from X.”

Two more points from the same page matter for brands. Non-API automation, such as scripting the X website, may lead to permanent suspension. And account owners are responsible for what third-party apps they authorize do with their account.

Say who you are

Replies from the official brand account already carry their source. The risk is replies that hide it. X's Authenticity policy bans fake personas, meaning manufactured identities used for disruptive or deceptive behavior, and bans running multiple accounts to engage with the same posts or to misuse the mention and reply feature.

If employees reply about your product from personal accounts, they should say they work for you. In the US, 16 CFR 255.5 covers connections the audience would not expect, such as employment or payment:

“such connection must be disclosed clearly and conspicuously.”

One of its worked examples is an employee promoting their employer's product in an online discussion without saying so; the rule says that poster should disclose the relationship, and the employer should train staff (16 CFR 255.5).

For bot accounts, the X Developer Policy says an API-based bot must clearly indicate what the account is and who is responsible for it, and suggests saying it is a bot in the profile bio.

Several accounts are fine when they have distinct purposes. The Authenticity policy explicitly allows brand accounts for different languages or locations and social media managers running accounts for clients, within a limit of ten accounts for different, non-duplicative purposes.

What X forbids outright

These are bright lines in X's policies as of 2026-10-16, not judgment calls:

• trading, buying, selling or soliciting access to X accounts, including temporary transfers (Authenticity policy);
• coordinating to exchange engagement, including replies, likes and reposts (Authenticity policy);
• coordinating with or paying others to inflate account metrics (Authenticity policy);
• using or promoting third-party services to do any of the above (Authenticity policy);
• posting identical or substantially similar content across multiple accounts you operate (Automation rules and Developer Policy);
• automated likes, and paying or being paid for X actions such as replies through the X API (Automation rules and Developer Policy).

What happens if X calls it spam

The Authenticity policy says consequences depend on severity and past violations. The listed options include anti-spam challenges that may lock an account and ask for more information, such as a phone number, or for a solved puzzle, restricted reach (including exclusion from search results and downranking a post in replies), temporary loss of features such as Direct Messages, and suspension. For a multiple-account violation, X may ask you to keep one account and suspend the rest. The Automation rules add removal of posts from Search and suspension of the app or account for spammy use of replies and mentions.

What this does not cover. This guide summarizes X's public Help Center and Developer Policy pages and one US regulation as they read on 2026-10-16. It does not cover X advertising policies or laws outside the US, and it is not legal advice. Check the linked pages before you act, because X can change them.

Agent Agency, which publishes this guide, is software that learns your product from a link and runs AI agents that promote it in online communities.