Meta & TikTok 2026 compliance rules avoid bans in Tunisia
ChattyFlow team · Updated
On Instagram, Meta allows one private reply per comment, within 7 days; you can then keep writing for 24 hours after each reply from the person, and beyond that only a person can answer, for up to 7 days, with the HUMAN_AGENT tag. On TikTok, automated DMs aren't offered in the US, the EEA, Switzerland or the UK, and comment-to-DM only exists in Vietnam, Thailand and Indonesia. No tool can guarantee an account will never be restricted; following these rules lowers the risk.
Meta's rules in one table
These limits come from Meta's official documentation (see Sources below) and apply to every tool, ChattyFlow included.
| Situation | What Meta allows |
|---|---|
| Someone comments on your post or reel | One private reply, within 7 days of the comment |
| The person replies to that message | You can continue for 24 hours after their reply |
| The person messages you | 24 hours to reply; promotional content is allowed in that window |
| After 24 hours | Only a person can reply, for up to 7 days, with the HUMAN_AGENT tag |
| Instagram Live | Private replies only while the live is running |
TikTok: what's allowed by country
| Feature | Where it works |
|---|---|
| Public reply to a comment | Every country |
| Automated DMs (DM to DM) | Everywhere except the US, the EEA, Switzerland and the UK |
| Comment-to-DM | Vietnam, Thailand and Indonesia only |
Tunisia: the basics of personal-data law 2004-63
When a buyer gives you their name, phone number or address in a DM, that is personal data. In Tunisia, Organic Law No. 2004-63 of 27 July 2004 governs how it may be processed. Here is what the text says, article by article. This is a summary, not legal advice; the national personal-data protection authority (INPDP) is the competent authority.
- Article 7: any processing of personal data requires a prior declaration to the INPDP.
- Article 27: except where the law provides otherwise, processing requires the person's express and written consent, which they can withdraw at any time.
- Article 28: a child's data can only be processed with the guardian's consent and the family judge's authorization.
- Article 30: consent given for one purpose doesn't cover another, and using the data for advertising requires express and specific consent.
- Article 31: people must be told beforehand, in a way that leaves a written trace, among other things what data is processed, for what purpose, and whether answering is mandatory.
- Article 47: passing the data to third parties requires the person's express consent, given in a way that leaves a written trace, except where the law provides otherwise.
The three rules that matter most
Meta's messaging windows
One private reply per comment, within 7 days. Once the person replies, 24 hours to continue (promotional messages are allowed inside that window). After that, only a person may reply, for up to 7 days, with the HUMAN_AGENT tag.
A reasonable sending pace
Avoid bursts of messages. ChattyFlow spaces out its sends, caps volume per hour and per day, and pauses when Meta refuses a send. On TikTok, each public reply waits 10 to 30 seconds.
TikTok DMs through the official API
TikTok DMs go through the TikTok Business Messaging API, which TikTok doesn't offer in the US, the EEA, Switzerland or the UK. TikTok must also clear each account ("Advanced Access"). A tool that sends TikTok DMs any other way isn't using official access.
10 practical rules to lower the risk of a ban
- Connect your account through Instagram Login (Meta's official OAuth), never with your password or session cookies. Any tool asking for your password is non-compliant.
- On Instagram, only send automated DMs to people who commented on your post or messaged you first. No messages to followers who didn't ask for anything.
- Respect Meta's windows: one private reply per comment within 7 days; 24 hours after each message from the person; beyond that, the HUMAN_AGENT tag, only for a genuine human reply, up to 7 days.
- On TikTok, connect tools only through TikTok's official authorization screen, which lists the permissions you grant (comments, messages). Check that your country allows automated DMs.
- Don't post the same generic comment over and over. Vary your public replies: ChattyFlow picks at random from several wordings.
- Don't create extra accounts to get around a limit or a restriction.
- Signed webhooks: a serious tool checks the X-Hub-Signature-256 signature on Meta webhooks, otherwise fake traffic can fool it. ChattyFlow checks it and rejects unsigned events.
- No purchased lists, no contact imports, no auto-follow or auto-like bots, no DMs to strangers.
- Turn on two-factor authentication for Instagram, TikTok and Meta Business Suite.
- If Meta or TikTok restricts your account, don't try to get around it. Pause your automations, read the notice, and use the review or appeal option the platform offers.
What breaks the rules
- DMs to people who never commented or wrote to you.
- More than one private reply per comment, or a private reply after 7 days.
- Automated messages more than 24 hours after the person's last message, or the HUMAN_AGENT tag used for automated messages.
- The same comment posted again and again across several posts.
- Unofficial APIs, shared passwords or browser automation.
Compliant tool vs risky tool
| Feature | ChattyFlow | Risky tool |
|---|---|---|
| Official OAuth (Instagram Login) | Yes | Unofficial automations: no |
| Meta messaging windows | Sends go through Meta's official API, which enforces them | Often bypassed |
| TikTok DMs via the Business Messaging API | Yes, with TikTok's country limits applied | No official access |
| Webhook signature check | Yes | Often missing |
| Anti-spam: varied public replies | Several wordings picked at random | Same reply repeated |
| Sending pace and caps | Spaced sends, hourly and daily caps | Bursts |
| No auto-follow, auto-like or cold DMs | Yes | Common in cheap bots |
| Access blocked from sanctioned countries | Yes | Rarely checked |
FAQ
Is Instagram automation allowed?
Yes, through Meta's official API and within its rules: one private reply per comment within 7 days, 24 hours after each message from the person, no unsolicited DMs. In Tunisia, your buyers' data is also covered by law 2004-63 (see above).
Can I DM everyone who commented last month?
No. Meta only allows one private reply per comment, within 7 days of the comment. After that, you can reply publicly or wait for the person to message you.
Can I automate TikTok DMs from Tunisia?
Yes for automated DMs (DM to DM) and public replies to comments. No for comment-to-DM: TikTok only offers it in Vietnam, Thailand and Indonesia.
My account got restricted. Is it ChattyFlow's fault?
Start with the notice from Meta or TikTok; it usually states the reason. Also look at manual activity (mass comments, logins from many places). If you think an automation is involved, pause it and email support with the account and the date so we can check what ChattyFlow sent.
Does TikTok block automations?
TikTok allows automation through its official APIs: DMs go through the TikTok Business Messaging API where TikTok offers it, once the account is cleared ("Advanced Access"). A tool without that official access can't send TikTok DMs within the rules.
Does ChattyFlow guarantee I'll never be banned?
No. No tool can, because Meta and TikTok have the final say. ChattyFlow uses their official APIs, checks Meta's webhook signatures, applies TikTok's country limits, paces its sends and only writes to people who commented or wrote first. That keeps you inside the published rules.
Sources
- Meta: Instagram private replies (Instagram Platform)
- Meta: Messenger Platform policy (24-hour window, HUMAN_AGENT tag)
- Organic Law No. 2004-63 of 27 July 2004 (French text published by Tunisia's National Institute of Statistics)
Ship a compliant automation today
ChattyFlow works through Meta's and TikTok's official APIs and applies TikTok's country limits for you. What your messages say stays in your hands.
Start free