Instagram automation rules: the complete reference

Which rule matters most: you cannot message anyone first

The rule that shapes everything else is simple. A business or creator account can only send an automated DM to someone who has already contacted it. On Instagram, contact means one of three things: the person commented on one of your posts or Reels, they replied to or reacted to one of your stories, or they sent you a DM. If none of those has happened, there is no permitted way to open a conversation by automation, and any tool that claims otherwise is operating outside Meta's official API.

This is why compliant automation on Instagram is always reactive. A comment triggers a private reply. A story reaction triggers an auto-reply. A DM containing a keyword triggers a response. The person acts, then the system answers. The practical consequence is that automation cannot replace outreach. It can only make sure that the people who already raised their hand get an answer within seconds instead of hours, which is where most of the value sits anyway. See how comment-to-DM works for the most common version of this pattern.

How does the 24-hour messaging window work?

Once someone has contacted you, Meta opens what it calls the standard messaging window. From the timestamp of that person's most recent message, you have 24 hours to reply freely, including with promotional content, links, and follow-up questions. Every new message from the person resets the clock. If they reply to your automated DM, you get a fresh 24 hours from that reply. If they go quiet, the window closes 24 hours after their last message.

After the window closes, the standard window no longer allows ordinary promotional sends. In practice this means your automation should do its useful work early: deliver the link, ask the qualifying question, or capture the email while the person is still engaged. Tools that queue a promotional message for three days later are either sending outside the window or not sending at all. The full detail, including what counts as a reset, is in the 24-hour messaging window guide.

What are the rules for replying to comments by DM?

Comment-triggered DMs, which Meta calls private replies, carry two specific constraints. First, you may send exactly one private reply per comment. If a person leaves three comments, you can send three private replies, but you cannot send three DMs in response to one comment. Second, that private reply must be sent within 7 days of the comment being posted. A comment on a two-week-old Reel cannot be answered privately by automation, even if the keyword matches.

Both limits are enforced at the API level, so a well-built tool simply will not let you break them. Where you can still get into trouble is with the content of the reply. A private reply opens a conversation, so the person may answer and start a normal thread, but the first message should relate to what they commented about. Sending a generic sales pitch to everyone who typed any word on any post is technically allowed once per comment, but it is the kind of pattern that produces reports and blocks, which the next sections cover.

How much can you send before you hit rate limits?

Meta documents per-account rate limits for the Instagram Messaging API, and those limits are the real ceiling on how much automation you can run. The exact figures are set by Meta, can change, and are best read directly from the developer documentation rather than from a blog post. What matters for you is the shape of the system: calls are counted per account over a rolling period, and once you exceed the allowance, further sends are rejected until the window rolls over.

A good tool treats those limits as a budget to be paced, not a wall to be hit. Three mechanisms do most of the work. Sends are queued and spaced rather than fired in bursts. Each contact gets a cooldown, so one person cannot receive several automated messages in quick succession. And a daily ceiling caps total volume for the account, which keeps a viral post from turning into a rate-limit event. The Instagram DM limits guide goes deeper on how these interact with account age and history.

What actually gets Instagram accounts restricted?

Restrictions rarely come from a single automated DM. They come from patterns that look like a machine pretending to be a person, or from tools that touch Instagram in ways the platform does not permit. The most common triggers are consistent across the accounts people describe losing access to.

The consequences scale with severity. Mild cases produce a temporary action block on a specific feature. Repeated cases bring feature restrictions, reduced reach, and revocation of the app token that the tool was using. Serious or repeated violations lead to account restriction or a permanent ban, and appeals for automation-related bans are rarely successful.

• Unofficial bots that log into the app or the private web API with your password and script taps, scrolls, and sends.
• Mass DMs to people who never contacted you, including "welcome" messages to new followers.
• Scraping follower lists, hashtag pages, or competitor audiences to build outreach targets.
• Sending identical copy to hundreds of people at volume, which pattern detection treats as spam even when each send is technically permitted.
• Engagement pods and follow-unfollow loops, which distort signals and are explicitly against Meta's terms.
• Messaging outside the 24-hour window with promotional content, or sending multiple private replies to one comment.

How do you vet an automation tool before connecting your account?

Connecting a tool to your Instagram account is a trust decision. The tool acts on your behalf, and any violation it commits lands on your account, not the vendor's. The checklist below separates tools that run on Meta's official API from tools that only look like they do. If a vendor cannot answer any of these clearly, do not connect.

The single most reliable tell is the login flow. Official tools send you to Meta to authorise a connection between your professional account and the app, and never see your Instagram password. A tool that asks you to type your username and password into its own form is driving the app or the private web API, and there is no compliant way for it to do what it promises.

• You log in through Meta's authorisation screen, not by typing your Instagram password into the tool.
• The vendor states that it uses the official Instagram Messaging API through an approved app or tech provider.
• Every feature is reactive: comment to DM, story reply to DM, keyword DM triggers. No "DM new followers" or "DM this list" option exists.
• The tool refuses to send outside the 24-hour window with promotional content, rather than leaving that to you.
• It enforces one private reply per comment and will not queue replies to comments older than 7 days.
• It describes how it paces sends: per-contact cooldowns, a daily ceiling, and queueing rather than bursts.
• It requires a professional (business or creator) account and explains why.
• Lead capture asks for consent inside the thread and does not export data it was not given.

Where does DMPilot sit inside these rules?

DMPilot is built on Meta's official Instagram API through an approved tech provider, which is why every one of its features is reactive by design. It sends a private reply when someone comments a keyword on a post or Reel, pairs that with a public comment reply, auto-replies to story replies and reactions, and responds when an incoming DM contains a keyword. A 24-hour per-contact cooldown is enforced on the link message, one per person per automation per day, and the one-reply-per-comment and 24-hour rules are handled for you.

If you want to see the setup in practice, the comment-to-DM setup guide walks through it, and pricing is a free plan for up to 100 people a month, then a flat $9 per month. The rules above apply regardless of which tool you use; the point of choosing an official one is that following them stops being your problem.

Frequently asked questions