Instagram DM automation rules: what is allowed

Use the official API only

Instagram allows automation only through its official API. There are two ways in: the Instagram API with Instagram Login, and the Instagram API with Facebook Login. Either one is fine.

Some tools ask for your Instagram username and password instead. They log in as you and click around like a person. This breaks Instagram’s terms, and it can get your account restricted.

A simple test: an official tool sends you to Instagram’s or Facebook’s own login screen to connect your account. It never asks you to type your Instagram password into its own form.

Use a Business or Creator account

The messaging API works only with Instagram Business and Creator accounts. Personal accounts cannot use it. If you have a personal account, you can switch to a Business or Creator account for free in the Instagram app.

No cold messages

A business can message only people who started the conversation: people who sent you a DM or commented on your posts. You cannot message:

• a list of people, such as customers from an email list;
• followers of another account;
• people you found through a hashtag.

Example: a gym wants to DM everyone who posted with #legday this week. That is not allowed. Instead, the gym posts a reel that says “Comment PLAN for a free workout plan” and answers the people who comment.

What counts as starting a conversation? A DM, a reply to your story (it arrives as a DM) or a comment on your post or reel. A DM opens the 24-hour window. A comment allows one private reply.

The 24-hour messaging window

After a person writes to you, you can message them for 24 hours. Every new message from them restarts the 24 hours. When the window closes, a normal message fails until they write again.

A reply to your story opens the window, because it arrives as a DM. A comment does not.

Example: Ana asks about a price at 10:00 on Monday. You can reply until 10:00 on Tuesday. If she writes again at 18:00 on Monday, you have until 18:00 on Tuesday. Read the full guide to the Instagram 24-hour messaging window.

Private replies to comments

A private reply is a DM you send in answer to a comment. You can send one per comment, within 7 days of the comment.

The comment does not open the 24-hour window. You can send more messages only after the person replies. Their reply opens the normal window.

Two more details. Private replies to Instagram Live comments work only while the broadcast is running. And a reply to someone who does not follow you can land in their message requests. Read more about Instagram private replies.

The human agent tag

Meta allows one exception to the 24-hour window, for human support. A person on your team may reply up to 7 days after the person’s last message, using the HUMAN_AGENT tag.

It needs Meta’s approval: the Human Agent permission, granted in App Review. The tag is for human support only. A person must write the reply, and automation cannot use it.

Example: a customer asks about a damaged order late on Friday. Your support person checks with the courier and replies on Monday morning, with the tag.

Message length: 1,000 bytes

Meta’s messaging docs say message text must be UTF-8 and at most 1,000 bytes. Bytes are not the same as characters:

• Plain English letters, digits and spaces take 1 byte each.
• Many non-Latin letters take 2 or 3 bytes. For example, Cyrillic and Arabic letters take 2 bytes, and Hindi letters take 3.
• Most emoji take 4 bytes.

So a message in Russian fits about 500 letters, and a message of only emoji fits at most 250. DM Flow’s editor counts the bytes for you.

Rate limits

Meta’s documentation lists these rate limits for each Instagram professional account:

A call is one request to Meta’s API, such as sending one message. Normal accounts never reach these limits. Meta can change them, so check the source before you rely on a number.

Meta’s own pages do not agree on one number. The Instagram Platform overview lists 100 calls per second for text messages. Meta’s Messenger Platform page lists 300 for the same messages. The other limits match on both pages. You may also read “200 DMs per hour”: that number is in neither page. It is a pacing rule that some tools apply to themselves, not a Meta limit.

Say when people are talking to automation

In some places, the law says people must know when they are talking to a bot. California and Germany are two examples. Meta asks businesses to make this clear where the law requires it.

A simple way is a short line in your automated messages, such as “Automatic reply from Mila’s Shop”. The rules differ from place to place, so check the ones that apply to you and your customers.

What happens when a rule is broken

For most rules, Instagram simply refuses the message. It returns an error and delivers nothing. A message after the 24-hour window fails this way. So does a second private reply to the same comment, or a private reply after 7 days.

Tools that log in with your password are different. They break Instagram’s terms, so the risk is not a failed message but a restricted account.

This is why a good tool checks the rules before it sends. A refused message often means a customer who never got an answer.

A compliance checklist

Check each item before you turn on an automation.

How DM Flow follows each rule

DM Flow’s Instagram DM automation is built on Instagram’s official API. It checks the rules before each message, so you do not have to keep them in your head.

Comment replies run through comment to DM. DM replies run through keyword auto-reply. Every conversation lands in one Instagram DM inbox.

DM Flow does not send broadcasts or drip sequences. If you need multi-step flows, read our honest comparison with ManyChat.