Instagram DM automation rules in 2026: what Meta allows

Automating Instagram DMs is allowed in 2026, on three conditions: it runs through Meta's official Instagram API on a professional account, it only writes to people who contacted you first, and it stays inside Meta's messaging windows. Almost every story about an account getting restricted for "automation" breaks one of those three.

This article lists the rules that matter in practice, in the order you meet them. It isn't legal advice, and Meta updates its documentation, so the sources at the end are worth a look before a big launch.

1. Use the official API, on a professional account

Meta gives automation tools access to Instagram messages through its Instagram Platform API. To use it you need a professional account (business or creator), and the tool you connect must be approved by Meta for the permissions it asks for.

What is not allowed is everything that pretends to be you in the app: tools that ask for your Instagram password, browser extensions that click and type for you, and bots that follow, like or comment on other accounts to get attention. These break Instagram's terms, and they are the main reason accounts get restricted. If a tool asks for your password, don't connect it.

2. The person writes first

Through the API, an automation can only answer people who reached out to you. That includes someone who:

• sends you a DM,
• replies to your story or mentions you in theirs,
• comments on your post or reel (you answer with a private reply),
• comments during your Instagram Live,
• taps an ig.me link or a "Send message" ad that opens a chat with you.

There is no official way to send automated DMs to a list of usernames who never wrote to you. Tools that claim to do it are working around the API, with your account as the risk.

3. The 24-hour messaging window

Every message a person sends you opens a 24-hour window. Inside it, your automation can reply and send follow-ups. When it closes, you have to wait for the person to write again.

Two practical consequences:

• Design flows that earn a reply. A question with tap-to-answer buttons keeps the window open, because each tap is a new message from the person.
• Don't plan a drip campaign in DMs. A sequence that sends a message on day 1, day 3 and day 7 will fail on Instagram once the window has closed. Collect an email address and send the sequence there instead.

You can work out when a window closes with the free messaging window calculator.

4. The human agent exception

Meta allows one exception to the 24-hour rule: a real person on your team can reply up to 7 days after the person's last message, using the human agent tag. It exists for cases a day isn't enough for, such as a weekend when the business is closed or a problem that takes longer to solve.

It is for human replies only. Using it to send automated or promotional messages outside the window is against Meta's rules. In ChatinFlow, the tag is used only for replies a teammate writes in the inbox; automated steps stay inside the 24-hour window.

5. Comments get one private reply

When someone comments, your tool can send them one private reply, within 7 days of the comment. Comments on an Instagram Live can get a private reply only while the broadcast is running. After the private reply, you can write again only when the person answers, inside the 24-hour window that their answer opens.

A public reply under the comment is separate from the private reply, and is a normal comment from your account. The full setup is in our comment-to-DM guide.

6. Rate limits

Meta caps how many requests an account and an app can make to its API in a given time. The numbers differ by endpoint and Meta changes them, so treat any single figure you read online with care. What matters in practice is that a post that takes off can bring more keyword comments in an hour than your account is allowed to answer in that hour.

When Meta answers that an account is sending too fast, ChatinFlow waits for the time Meta asks for and tries again, instead of dropping the message. Because a private reply can be sent for 7 days after the comment, a short delay doesn't cost you the lead.

7. Let people opt out

Give people an easy way to stop your marketing messages, and honor it. In ChatinFlow, STOP works out of the box: a contact who writes STOP, or asks to unsubscribe, is marked as unsubscribed and no longer gets your broadcasts, and START reverses it. Mention it once, for example at the end of a first message that promises more tips.

8. Content and promotion rules still apply

Automation doesn't change what you are allowed to say:

• Instagram's Community Guidelines apply to DMs too.
• Giveaways and contests must follow Instagram's promotion rules. See Instagram giveaway rules in 2026.
• Paid partnerships and affiliate links need a clear disclosure. In the US, the FTC's guidance for influencers applies to the DM as much as to the post.

9. Personal data

If your flow asks for an email address or a phone number, say what you will use it for, in the same message. If you will send marketing emails, the person should know that before they give the address, and every email needs a way to unsubscribe. In the EU and the UK, data protection law adds more, such as a lawful basis for processing and the right to ask for deletion.

What gets accounts flagged

• Tools that log in with your password or act as you in the app.
• Following, liking or commenting on other accounts in bulk.
• Messages to people who never contacted you.
• Many identical messages in a short time, especially with links.
• A high rate of people reporting or blocking your messages.

The last one is the easiest to control: answer what people asked for, keep messages short, and don't send more than the conversation needs.

A short checklist before you go live

• The account is a professional account, connected through an official integration.
• Every flow starts with something the person did: a DM, a comment, a story reply, a link tap.
• The first message delivers what was promised; follow-ups wait for a reply.
• No automated message is planned outside the 24-hour window.
• STOP works, and the first message that asks for an email says what it is for.

The free Instagram DM checklist walks through these points one by one.

Sources

• Meta for Developers, Private Replies: one private reply per comment within 7 days, Live comments during the broadcast, follow-ups within 24 hours of the person's response. Checked October 2026.
• Meta for Developers, Features Reference: Human Agent: human agent replies within 7 days of a user's message, for issues the standard window can't resolve. Checked October 2026.
• Federal Trade Commission, Disclosures 101 for Social Media Influencers. Checked October 2026.