Facebook Messenger Bot App Review: Why Chatbot & Automation SaaS Tools Get Rejected or Restricted (2026)
If you run a chatbot builder, auto-reply tool, or messaging automation SaaS on Facebook Messenger — ChatPion, BotSailor, Chatwoot, and similar platforms all live in this category — the pages_messaging permission is the gate that decides whether your product can send a single message on a client’s Page. Getting the permission approved is only step one. Meta also polices how your bot behaves after launch, and that is where most automation tools quietly get restricted.
What pages_messaging App Review actually checks
24-Hour Standard Window
A Page can message a user freely — including promotional content — for 24 hours after that user messages the Page, clicks a CTA, or reacts to a message. Outside that window, standard messages are not allowed at all.
Message Tags
Tags let a business send specific, non-promotional updates outside the 24-hour window — but only for the exact use case each tag is meant for. Reviewers check that your bot maps tags correctly, not just that it uses them.
One-Time Notification
Lets a user opt in to receive exactly one follow-up message after the 24-hour window closes (for example, a back-in-stock alert). The token is single-use and expires within a year — not a general messaging workaround.
Human Agent Tag
Extends manual (non-automated) replies out to 7 days, for cases the bot cannot resolve in time. This tag needs its own App Review approval and is only available with Business Verification completed.
Where automation SaaS tools actually get flagged
Most rejections and post-launch restrictions on chatbot platforms are not about the core send/receive permission — they come from how the messaging rules are implemented once the bot is live.
- Using a deprecated message tag.
CONFIRMED_EVENT_UPDATE,ACCOUNT_UPDATE, andPOST_PURCHASE_UPDATEstopped working from an April 2026 policy change — any API call still sending them now returns an error. Automation tools built on older tag logic need to migrate to Utility Templates or the Marketing Messages API before this breaks live client accounts. - No automated-experience disclosure. Bots must tell the user they are talking to an automated service at the start of a thread, after a long gap, or when a conversation hands off from a human to the bot — a requirement Meta calls out specifically for California and German users. A generic “this is a bot” line dropped in the wrong place does not satisfy it.
- Bot type mismatch. Meta classifies bots as Automated, Manual Reply, or Hybrid. If your platform is submitted and approved as “Automated,” it is held to a strict 30-second response requirement for every text message, quick reply, button click, and persistent-menu tap. Multi-tenant SaaS tools that queue messages for processing can quietly breach this without realizing it.
- Tag misuse in the screencast. App Review wants to see the specific tag and use case in action — not a generic demo of “sending a message.” A screencast that shows a promotional message sent under a transactional tag is a fast rejection.
- Human Agent access assumed, not applied for. SaaS tools that let end clients hand off to a live agent often forget that the Human Agent tag is a separate App Review item gated behind Business Verification — it is not bundled into the base messaging permission.
Automated, Manual, or Hybrid: which one is your bot?
Automated
Every response is pre-programmed. No human ever replies through the tool. Held to the 30-second responsiveness rule on all inputs except the initial Get Started button.
Manual Reply
A live person replies to every message through the platform — common for agency dashboards layered over Messenger. Not subject to the automated responsiveness clock.
Hybrid
Mixes automated flows with human hand-off (a common shape for support and sales bots). Declaring the correct type in the App Dashboard or Discover submission avoids a policy-violation notice later.
What happens if a bot is flagged
A Page found in violation of Developer Policies gets an explanation through its Page Support Inbox, not a silent ban. If the bot is genuinely automated, the fix is adjusting its behavior to match the responsiveness policy; if it is really hybrid or human, the fix is updating the response setting in Page Settings → Advanced Messaging. Meta gives 7 days to respond or correct course before the ability to send messages can be limited — which, for a multi-tenant SaaS tool, can mean every connected client account losing messaging at once.
Frequently Asked Questions
Does every chatbot builder need its own App Review, or can it reuse a template app’s approval?
Each app registered in the Meta App Dashboard needs its own App Review approval for pages_messaging. A SaaS platform that provisions a single shared app across client Pages still submits one review for that app; a platform that spins up a separate app per client needs review for each one.
Can a chatbot send marketing messages outside the 24-hour window?
Only through Sponsored Messages (not available on Instagram Messaging API) or an approved message tag matched to that exact use case. Sending promotional content under a non-promotional tag is a policy violation, not a workaround.
Is the automated-bot disclosure required everywhere, or only for some users?
Meta requires it “when required by applicable law” and specifically flags California and German markets/users for extra attention — but discloses it as best practice for every automated experience regardless of jurisdiction.
This is general information based on Meta’s published Messenger Platform policy and is not legal advice — Meta makes all App Review and enforcement decisions independently. For a deeper look at general Meta App Review preparation, see our Facebook App Review service and App Review rejection fix pages. If you run a script-based automation tool, our ChatPion and BotSailor approval pages cover platform-specific setup support.