Collecting emails from Instagram DMs without breaking the rules

Steps

1. 1
   Decide what the email is for before you ask

   Write down the one thing you will send: a weekly newsletter, a launch sequence, an offer. If you cannot state it in a sentence, you cannot get meaningful consent for it.
2. 2
   Write consent text that answers four questions

   Who you are, what you will send, how often, and how to stop. Two sentences is usually enough. Put it in the DM immediately before the ask, not in a policy nobody will open.
3. 3
   Ask, then wait for an explicit reply

   The person should type their email or otherwise confirm after reading the consent text. Silence, a like, or an earlier comment on your post is not consent to email marketing.
4. 4
   Record the consent alongside the lead

   Store the timestamp, the source (which post or automation), and the exact consent wording shown. If you are ever asked to prove consent, this record is what you will need.
5. 5
   Export to your email tool and honour unsubscribes everywhere

   Move leads into the list they agreed to, and nowhere else. When someone unsubscribes, remove them from the email tool and from any spreadsheet or export you still hold.

Why does a DM need more care than a signup form?

First, a plain statement: this page is general information about common practice, not legal advice. Privacy and marketing rules differ by country and change over time, and the right answer for you depends on where you and your subscribers are. Check with a qualified advisor for your jurisdiction before relying on anything here.

With that said, the reason a DM needs extra care is that a signup form has consent built into its shape. Someone who finds a form, reads the label, types their email and clicks subscribe has done something deliberate. A DM conversation is different. The person commented on a Reel because they wanted a recipe or a checklist, not a newsletter. When you ask for their email inside that thread, the context is "send me the thing", and it is easy to blur that into "email me forever" without the person ever agreeing to the second part.

That gap between what the person wanted and what you plan to do with the address is where most problems start. The fix is not complicated, but it has to be explicit: tell them what they are agreeing to, at the moment they agree, in words they can read in a chat bubble. DMPilot's lead capture includes a consent text field for exactly this reason, so the wording appears in the DM before the email request rather than being assumed.

What should the consent text say?

Good consent text is short and specific. It names you or your business, so the person knows who will be emailing them. It says what they will receive, in concrete terms: not "updates" but "a weekly email with one recipe and occasional offers". It gives a rough frequency, so nobody is surprised by a daily sequence they expected to be monthly. And it says how to stop, usually "unsubscribe from any email" or "reply STOP".

It also helps to separate the delivery of the promised resource from the marketing consent. If someone only wants the checklist, they should be able to get it from the link in the DM without handing over an email. If you want to offer the checklist by email and add them to a list, say both things. Bundling the two silently is the pattern that regulators and email providers dislike most.

• Who: "This is Maya from Studio Bloom."
• What: "I send one short email a week with hair care tips and salon offers."
• How often: "Weekly, occasionally more around launches."
• How to stop: "Every email has an unsubscribe link, and you can reply STOP here any time."
• The ask: "If that sounds good, reply with your email address and I will add you."

What do you need to keep on record?

Consent you cannot demonstrate is close to useless if anyone questions it. At a minimum, store the email address, the date and time it was given, the source (which post, story or automation produced it), and the version of the consent wording that was shown. If you change your consent text, keep the old versions dated so you can say which one a given subscriber saw.

This is usually simpler than it sounds. A lead export with columns for timestamp, source and consent version covers it. What you want to avoid is a pile of email addresses copied from DM threads into a spreadsheet with no context, because six months later you will not be able to say which of those people agreed to what. Keep the record with the lead, not in a separate place you will forget to update.

GDPR basics at a high level

If you or the people you message are in the EU or UK, the GDPR and UK GDPR frameworks are the ones to understand. They apply to any personal data, and an email address is personal data. This is a high-level sketch, not a complete summary, and you should confirm the details with an advisor.

The core idea is that you need a lawful basis for processing someone's data. For marketing emails to individuals, that basis is usually consent, and the bar for consent is high: it has to be freely given, specific, informed and unambiguous, and it has to be a clear affirmative action. Pre-ticked boxes, silence, and consent buried in terms are generally not accepted. A person typing their email after reading a clear statement of what they are agreeing to is the kind of affirmative action the rules have in mind; a person who merely commented on your Reel is not.

• Lawful basis: for marketing to individuals, this is normally explicit consent, which you must be able to show.
• Right of access: people can ask what data you hold about them, and you need to be able to answer.
• Right of erasure: people can ask you to delete their data, and you need a way to do it across every tool that holds it.
• Data minimisation: collect only what you need. If you only need an email, do not also ask for a phone number and birthday.
• Storage limitation: keep data no longer than you need it. Leads who never engaged for a long time should be removed, not kept forever.

CAN-SPAM style basics for the US

US commercial email is governed mainly by CAN-SPAM, which takes a different approach from GDPR. It focuses less on prior consent and more on how each message behaves. The practical requirements are that the sender information and subject line are accurate, that the email includes a real physical postal address for your business, that recipients can opt out with a working mechanism, and that opt-outs are honoured promptly.

Even though CAN-SPAM does not require the same consent standard, sending marketing to people who never asked for it is a fast route to spam complaints, and spam complaints are what actually hurt small senders. Email providers throttle or block domains with high complaint rates regardless of what the law technically permits. So the consent-first approach described above is the sensible default even for a US-only audience, and it also protects you if some of your subscribers turn out to be elsewhere.

Other jurisdictions, such as Canada with CASL and Australia with the Spam Act, have their own rules, some stricter than the US. If you have a meaningful audience in a particular country, look up that country's rules specifically.

How should you store and export leads?

Keep leads in as few places as possible. The ideal flow is that the DM automation captures the email and the consent record, you export that to your email tool, and the email tool becomes the single source of truth for subscription status. Spreadsheets on a laptop, screenshots of DM threads and half-updated CSVs are all places where an unsubscribed person can accidentally live on.

When you export, carry the consent fields with the email so your email tool knows the source and date. Most email platforms have custom fields for exactly this. If you offer subscribers different things, such as a newsletter and a launch list, tag them by what they agreed to, and only send each tag what it agreed to receive. DMPilot stores each captured email with the consent text the person saw; email capture is on Pro, at $9/month flat.

What should you never do?

A few practices cause most of the trouble. Buying or renting email lists is the clearest one: nobody on that list agreed to hear from you, and deliverability and complaint rates will show it immediately. Importing everyone who ever DMed you into a cold sequence is the Instagram-specific version of the same mistake. A DM conversation about a product question is not consent to a five-email sales sequence.

Hiding the ask is the subtler failure. Asking for an email "to send the guide" and then adding the person to a marketing list without saying so is exactly the bundling that consent rules are designed to catch, and it also erodes trust with the people you most want to keep. Equally, do not pretend an unsubscribe is harder than it is, and do not keep emailing someone who replied STOP in the DM thread just because they did not click the link in an email.

• Do not buy, rent or scrape email lists.
• Do not add DM contacts to sequences they did not agree to.
• Do not bury the marketing ask inside the resource delivery.
• Do not ignore an unsubscribe because it arrived through a different channel.
• Do not collect more than you need or keep it longer than you need.

Frequently asked questions