Most tools marketed as "social media automation" fall apart on first contact with production. They work on three accounts for two weeks. On a hundred accounts over six months, every account dies in one afternoon because the behavioural pattern has become obvious to the detection systems.
What actually works at portfolio scale doesn't look like a script. It looks like risk engineering — with portfolios, ratings, diversification and metrics. An operator does not automate a single account. An operator manages risk across hundreds of accounts simultaneously.
This is not automation of a single account. It is risk-portfolio management across hundreds of accounts simultaneously.
The Instagram tax
Instagram has invested more in detection since 2019 than almost anyone else in the industry. It shows. Accounts created cold — no warming, no residential IP, no sensible device fingerprint — live an average of eight to fourteen days before permanent ban.
What works:
Warming phase 1 — the first 72 hours
Account created on a vetted residential IP, in a location matching the bio it will eventually have. The first 72 hours: no automated activity at all. Login, check the feed, open a few profiles, close. That's it. Any automated like, follow or comment in that window radically shortens the account's lifespan.
Warming phase 2 — days 4 through 14
Gradual ramp. First like on day two. First follow on day three. First comment on day five. All activity still looks like a real person — irregular, with pauses, sometimes a story tap, sometimes Reels browsing. Only in week two can the account perform useful work for the operator.
Fingerprinting: where most tools fail
An account must have a stable but realistic browser fingerprint. Stable — so usage continuity is believable (same canvas, WebGL, audio signatures session after session). Realistic — so it matches actual users (not some odd combination of iPhone 5S with Chrome 120).
Three most common mistakes we see in operators trying to do this without proper infrastructure:
- All accounts share the same fingerprint — instant pattern detection.
- Fingerprint changes randomly between sessions — detection of missing device continuity.
- Fingerprint is generic 'anti-detection' — using the same anti-detection libraries as thousands of other bots. Instagram catches this immediately.
In practice: each account gets a dedicated device profile built for a real user persona and preserved session-over-session. Profiles designed deliberately, based on demographic statistics of the target geography.
Content rotation
Twenty accounts posting the same content (even with 15% variation) → pattern. An operator doing real work makes sure every account has its own content stream — either generated independently or adapted at the semantic level, not by synonym swap.
TikTok: state of the art in anti-automation
TikTok probably has the best anti-automation system among the major platforms. Several reasons:
- The native app enforces real device fingerprints — browser emulation is detected within the first five seconds.
- Behavioural signals (how long you hold a tap, how you scroll, where you look on screen via video pause patterns) are used very aggressively.
- The FYP ranking algorithm is complex enough that even if you build working automation, content will not surface without real engagement engineering.
In practice: browser automation barely works on TikTok. Operators serving TikTok at scale use device farms (real phones, plugged into USB hubs) driven by ADB or native wrappers. Radically more expensive than browser automation, but the only way for accounts to survive beyond two weeks.
Caveat: if your use case is scraping public TikTok data, browser automation works (for now). If it's account-side interaction — we don't touch it without a device farm.
LinkedIn: gentle but unforgiving
LinkedIn is the most liberal of the three — in the sense that tolerance for automation is higher when behaviour looks professional. But when LinkedIn detects a pattern, the penalty is specific and painful: not an account ban, but a shadow ban on invites, messaging and search visibility. The account lives, but is practically useless.
What makes the difference:
- LinkedIn weighs engagement against targets. Sending invites to 200 people who do not respond is more dangerous than sending to 50 who do.
- Content context matters. Identical connection messages to 100 people → flag. Personalised message (gen-AI with real per-recipient personalisation) → tolerated.
- Sales Navigator provides "legal" volumes that are tolerated — several times higher than the free tier. Often worth it.
LinkedIn is also the legally safest — most case law has shown scraping of public profiles is legal (hiQ v. LinkedIn 2017–2022), although ToS still forbids it. Legal risk ≠ technical risk; both need separate consideration.
Portfolio management: the real engineering problem
After running several hundred accounts per platform, the single account stops being a unit of planning. The unit of planning is the portfolio.
A portfolio has metrics:
- Health score — aggregate of reach, engagement, platform warnings, shadow-ban status. Accounts below threshold are resting or retiring.
- Age cohort — accounts created in the same week are one cohort. If a whole cohort dies in month three — something was wrong in the warming.
- Geo distribution — accounts cannot all come from one ASN. In practice we mix across 4–6 residential IP providers.
- Persona diversity — bio, avatar, content pattern. Clusters of similar accounts are risky; detection algorithms look for clusters.
An operator does not look at "account A". An operator looks at the health score of the 2025-Q4 cohort and decides whether to continue it, retire it, or increase load.
What is legal and what is not
This depends on jurisdiction, but general principles in the EU (February 2026, based on current regulations):
- Scraping public data: generally legal, although ToS usually forbids it. Breach of ToS alone is not a civil offence if no damage occurs.
- Creating fake accounts: not necessarily illegal, but breaches practically every ToS, and may be classed as fraud if used to deceive others (for example, fake reviews).
- Engagement automation (likes/comments): a grey zone, but a single account autonomously deciding what to like is hard to distinguish from a human.
- Spam (DMs to strangers): illegal in many jurisdictions (anti-spam law, ePrivacy in the EU).
- Election manipulation or disinformation: strictly illegal and regulated (DSA in the EU since 2023).
This is not legal advice. Every use case needs counsel familiar with the client's jurisdiction. But "scraping public data for business intelligence" and "spamming DMs for affiliate revenue" are entirely different animals from a risk perspective.
The point
Social media automation as operators actually ship it does not look like a GitHub script. It looks like risk engineering. A portfolio of accounts with health metrics, diversification, cohorting, monitoring. Every account is a position in the portfolio — with its own risk score, its own role, its own end of life.
Most "automation tools" on the market solve only one layer — interaction automation. Ninety percent of what actually keeps a portfolio alive sits below that — in fingerprinting, warming, diversification, content rotation, monitoring. No off-the-shelf product gives you that layer. It has to be built. And it has to be maintained.