How to Automate LinkedIn Comments Without Breaking TOS

#TL;DR

LinkedIn comment automation is legal in spirit but TOS-grey: LinkedIn’s User Agreement Section 8.2 prohibits “bots or other automated methods” with no carve-out for opt-in flows. The pattern that survives a 2026 TOS challenge is responsive-only, auto-like and auto-reply triggered by something a real user (the commenter) did first. Outbound-style comment posting (mass-commenting on strangers’ posts at scale) is what got LeadGravity shut down. This guide shows the safe slice and where the line actually gets crossed.

#What “comment automation” actually means in 2026

When people search “automate LinkedIn comments,” they’re usually referring to one of three different actions that the market lumps under one phrase. The distinction matters because LinkedIn’s enforcement treats them very differently. Get the category right before you pick a tool, or you’ll buy the wrong thing and risk the wrong account.

The three categories worth separating:

1. Responsive comment actions. Someone comments on your post, and an automation auto-likes their comment or sends a one-line canned auto-reply. The action is triggered by their engagement, not a bot crawling LinkedIn. This is the safest slice.
2. Comment-to-DM triggers. A commenter types a keyword on your post, and an auto-DM ships with a lead magnet or opt-in offer. This is the “ManyChat-style growth tool” pattern most LinkedIn creators are looking for. For the full breakdown of how this works, see our pillar ManyChat for LinkedIn guide.
3. Outbound comment posting. Bots write and post comments on other people’s posts, at scale, on behalf of a user account. This is the LeadGravity / Phantombuster grey zone and the category LinkedIn enforces against most aggressively.

Categories 1 and 2 sit on softer ground because the recipient acted first. Category 3 is what every “I got banned from LinkedIn” thread on Reddit is actually describing. Treat them as different products, not different settings inside one product.

#The LinkedIn TOS reality check

There’s no carve-out you can quote LinkedIn and win. Section 8.2 of the LinkedIn User Agreement prohibits “bots or other automated methods” full stop, with no exception for opt-in or commenter-only flows. Any honest article about LinkedIn automation has to start there.

What actually happens in practice is statistical enforcement. LinkedIn doesn’t manually review every account; it fingerprints behavior. The signals that get accounts flagged are well documented across enforcement waves in 2025 and 2026: abnormal volume per hour, browser fingerprint inconsistencies, sessions hopping IP addresses, identical comment text posted across many accounts, and DM velocity that no human could produce. Responsive automations triggered by genuine user engagement, at human-realistic volumes, blend into the noise. Outbound sweeps don’t.

The clearest cautionary tale is LeadGravity, a French LinkedIn automation SaaS that shut down in 2026 after, per their own wind-down notice, “formal warnings from LinkedIn concerning the way LeadGravity interacts with their platform.” The product worked. The customers were real. The platform still closed it down. Treat that as priced-in for any tool in this category, including the one publishing this article. Anyone claiming “100% TOS-safe” or “undetectable” should be treated with suspicion on principle.

The session-management layer that LinkedIn automation tools use to act on your behalf, sometimes called a hosted OAuth bridge, handles the authentication mechanics. It doesn’t change the underlying contractual risk. Behavioral safety is still on you.

#What you can safely automate today

The responsive slice covers everything you’d want from comment automation if your goal is lead-magnet delivery and creator-style engagement. Four actions stay on the safer side of the line when you respect volume discipline.

#Auto-like the commenter’s comment back

Liking the comment someone just left on your post is one of the lowest-risk automations in the category. It mirrors a normal human behavior, the “I notice you, here’s a like back,” that creators do manually all day. The signal LinkedIn would have to flag is functionally indistinguishable from a real user paying attention to their notifications.

Volume discipline still matters. Saylink’s default cap, taken directly from the code in LikeCommentJob.php, is 50 likes per day per connected LinkedIn account. That sits well within behavioral norms for an engaged creator. The actions queue and back off automatically on Unipile rate-limit responses (HTTP 429) and on session-expired errors (HTTP 401), with the LinkedIn account flipped to an expired status if credentials go bad. The 50-per-day ceiling is a defensible benchmark even if you use a different tool.

#Auto-reply with a one-sentence canned acknowledgment

A short, specific auto-reply on the original comment reads human at volume if you write it like a human would. “Thanks for the thoughtful take, {firstName}, DMing you the doc now” is the kind of one-sentence acknowledgment that genuinely warms the social signal and increases the chance the commenter sees the follow-up DM.

What kills this pattern is generic AI-generated paragraphs. Four sentences of mid-tier ChatGPT output that all sound templated to the same prompt are exactly the kind of pattern LinkedIn fingerprints. Saylink’s default cap in ReplyToCommentJob.php is 30 auto-replies per day per LinkedIn account. Keep it human-sounding and stay under the ceiling. One canned reply per campaign, not a freshly-generated novel per commenter.

#Trigger a DM from a keyword comment

The comment-to-DM trigger is the ManyChat-style primitive most LinkedIn creators want. Someone types a keyword like “GUIDE” on your post, a check confirms they’re eligible (first-degree connection, keyword matched, not already messaged), and the DM ships with the lead magnet attached. For the full mechanics, see our pillar on comment-to-DM on LinkedIn.

The same volume discipline applies. LinkedIn fingerprints DM velocity per session, and tools in this category typically default to around 40 DMs per day per account to stay inside human-realistic norms. A viral post with 600 commenters becomes a multi-day delivery window, not a same-hour blast.

#Filter by first-degree connection

The cleanest TOS-safe pattern adds a first-degree connection filter on top of everything above. First-degree DMs land in the normal inbox, free, and look indistinguishable from manual messages. Second-degree and beyond pushes commenters into connection-request territory, which has its own daily caps for unpaid accounts and its own enforcement profile. If a tool offers an “auto-send connection request, then auto-DM after acceptance” flow as part of comment automation, that’s a separate risk category. Saylink does not ship that flow today; the codebase covers read-post, read-comments, read-reactions, first-degree check, send-DM, like-comment, and reply-comment. Nothing in the connection-request column.

#What you should not automate (the LeadGravity zone)

Four patterns that consistently get LinkedIn accounts flagged in 2025-2026 enforcement waves. Avoid them regardless of which tool you use, because the risk is the behavior, not the vendor.

Outbound comment posting on strangers’ posts. Bots that crawl LinkedIn, find posts matching a keyword or hashtag, and drop comments on behalf of a user account. This was the headline feature of multiple shut-down tools in the broader category and the pattern most aggressively enforced against. There is no responsible way to do this at scale. For the deeper discussion of the engagement-driven model versus scraping-based outbound, see our Phantombuster alternative breakdown.

AI-generated comment text posted on other people’s posts. Even occasional, one-off use has flagged accounts in recent enforcement passes. The fingerprint is recognizable: comments that read fluent but generic, posted across many target accounts in tight time windows, with timing patterns that humans don’t produce. Mid-2025 onward, this category got expensive fast.

Mass connection requests plus auto-DM. Adjacent to comment automation but worth flagging because it tempts the same buyers. Cold-outbound connection-request blasts followed by templated DMs get accounts restricted in days, not months, especially when the connection target list came from a scraped CSV. The TOS-safe pattern is exactly inverted: let people opt in to a public post, then DM only the ones who engaged.

Profile-view automation, endorsement automation, follow-back automation. Out of scope for this article but worth listing because they’re all explicitly TOS-flagged and they all live in the same tool category. If you find a “LinkedIn automation suite” that bundles them with comment automation, the comment automation is the loss-leader; the rest is the liability.

#A practical workflow: comment automation in 15 minutes

Here’s the end-to-end setup for responsive comment automation on a single LinkedIn post, grounded in what Saylink’s code actually does (verified against CampaignController and app/Jobs/). The same shape applies to any tool in the category that ships the comment-to-DM primitive; the toggles and field names will vary.

1. Pick one LinkedIn post you’ve published in the last 72 hours that’s getting comments. Comment automation on a dead post is wasted effort. The post needs organic engagement first; the tool amplifies it, it doesn’t manufacture it.
2. Paste the post URL into a new campaign. One campaign equals one post. There is no multi-post sequence inside Saylink, by design. If your playbook needs to fan out across multiple posts, run multiple campaigns.
3. Set the keyword filter (optional but recommended). Something specific like “GUIDE” or “TEMPLATE” so only commenters who explicitly opted in get the DM. Leaving it blank targets every commenter, which works for low-volume creator posts but raises the noise floor.
4. Toggle auto-like on the commenter’s comment. This is the safest of the three responsive actions. The job runs in the engagement queue with the 50/day cap enforced inside LikeCommentJob. Failures back off and retry with sensible defaults; persistent failures deactivate the campaign automatically (Saylink does this after three consecutive job failures, per checkConsecutiveFailures() in the same job).
5. Write the optional one-sentence auto-reply. Use the {firstName} template variable so the reply reads as personalized at volume. Keep it under one sentence. The 30/day cap in ReplyToCommentJob is your ceiling.
6. Write the DM template (the lead-magnet delivery itself). This is what every eligible commenter receives. Variables fill in at send time. There is no branching, no conditional logic, no “if they reply, send variant B.” One template, every eligible commenter.
7. Toggle first-degree-only on. Lower risk profile, higher response rate. Second-degree commenters are still tracked in the participant table for visibility; they just don’t get the DM.

That’s the entire setup. No flow builder, no node graph, no multi-step sequences inside Saylink, the codebase doesn’t ship any of those (there’s no Flow, Trigger, Sequence, Step, or Node model anywhere in the repo, verified). If your playbook genuinely requires conditional branching, no LinkedIn-only tool ships it in 2026. Be honest about the gap before you buy. For a closer comparison against the nearest alternative, see our Saylink vs LeadShark breakdown.

#How to spot a tool that crosses the line

You don’t need to be a LinkedIn engineer to evaluate an automation tool. Four questions surface the TOS risk profile in under five minutes on any vendor’s pricing or features page.

Does the tool post comments on other people’s posts that the user didn’t write? If yes, that’s outbound-zone behavior. Doesn’t matter how the marketing copy frames it. The fingerprint LinkedIn enforces against is “this account is dropping written comments on strangers’ posts in a pattern humans don’t produce.”

Does it ask for your LinkedIn email and password directly, rather than routing OAuth through a hosted session-management layer? Credentials sitting on a third-party server is a meaningfully higher risk profile than the session-bridge pattern most established tools use. If the onboarding flow asks for your raw LinkedIn login, walk away.

Does it advertise “unlimited daily DMs” with no behavioral caps published? LinkedIn enforces against velocity regardless of what the vendor promises. Tools that publish their daily ceilings (Saylink’s 40 DMs/day, 50 likes/day, 30 replies/day per account, taken straight from config/services.php) are signalling that they’ve thought about the risk. Tools that promise unlimited are signalling that the cap problem will show up on your account, not theirs.

Does it advertise “100% TOS-safe,” “undetectable,” or “fully compliant”? Reputable tools in this category don’t make that claim. LeadGravity did. The product still got shut down after formal LinkedIn warnings. Any vendor making the absolute claim is either selling marketing copy or hasn’t lived through an enforcement wave yet.

#FAQ

#Is automating LinkedIn comments legal?

Legal and TOS are different categories. Comment automation is not illegal under any law we’re aware of, but LinkedIn’s User Agreement Section 8.2 prohibits “bots or other automated methods” with no opt-in carve-out. You can comply with the law and still violate the platform’s TOS. Enforcement is account-level: LinkedIn can restrict or close your account, not sue you, and that’s the actual risk priced into every tool in this category.

#Can LinkedIn detect comment automation in 2026?

Yes, statistically. LinkedIn doesn’t manually review accounts; it fingerprints behavior. The signals that flag accounts are well documented: abnormal volume per hour, browser fingerprint inconsistencies, IP-hopping sessions, identical text posted across many accounts, and DM velocity humans can’t produce. Responsive automations at human-realistic volumes blend into the noise. Outbound sweeps and high-velocity blasts don’t, and that’s how accounts get restricted.

#What happened to LeadGravity, and why did they get shut down?

LeadGravity ran a LinkedIn automation product out of France until 2026. Per their own wind-down notice still live on their domain, the founder cited “formal warnings from LinkedIn concerning the way LeadGravity interacts with their platform” as the reason for shutting down. Data export was offered through 2026-06-15, then the product closed. It’s the most public recent precedent for “LinkedIn does enforce, and the platform can close a real business that was operating in this category.”

#How many auto-replies per day is safe?

There is no LinkedIn-published number, and any vendor that gives you a guaranteed figure is selling certainty they don’t have. As a defensible benchmark, Saylink’s default in ReplyToCommentJob is 30 auto-replies per day per LinkedIn account, and the auto-like default is 50 per day. Those caps sit well within behavioral norms for an engaged creator. Treat them as ceilings, not targets; ramp up from lower volumes if the account is new.

#Should I use AI to generate the auto-reply text?

Use AI to draft one canned reply you’ll use across the whole campaign, edit it down to one human-sounding sentence, then ship that. Do not use AI to generate a fresh reply per commenter. The fingerprint of fresh-AI-per-commenter is recognizable: fluent but generic text, posted at velocity, with timing humans don’t produce. That’s the pattern enforcement waves in 2025 and 2026 have flagged. One canned reply, written by a human, deployed at a sub-30/day volume is the safer pattern.

#Wrapping up

Comment automation in 2026 works when you stay on the responsive side of the line. Auto-like and auto-reply on the commenters who engaged with your post, trigger DMs from explicit keyword opt-ins, filter by first-degree connection, and respect the volume ceilings published by tools that have thought about the risk. Everything outbound, automated commenting on other people’s posts, mass connection blasts, AI-generated content posted at velocity, is where accounts actually get closed. The honest framing is that no tool in this category is 100% TOS-safe; the bridge-session model carries category risk that no vendor controls. What you control is your behavior on top of it.

If you want the responsive comment-to-DM workflow set up on your next LinkedIn post, create a Saylink account and walk through the campaign builder. The defaults are conservative on purpose.

#Read next

• ManyChat for LinkedIn: The Complete Guide, the pillar on why ManyChat itself doesn’t support LinkedIn and how comment-to-DM really works in the native equivalents.
• Saylink vs LeadShark: 2026 LinkedIn Automation Showdown, the side-by-side breakdown of the two main LinkedIn-only tools shipping the comment-to-DM primitive.
• Phantombuster Alternative for Creator-Driven Lead Capture on LinkedIn, the engagement-driven model versus scraping-based outbound and why each one carries a different platform risk.
• Or browse the full Saylink blog index for tutorials, comparisons, and TOS-safety guides.