Best practices
Instagram DM automation rules, in plain language
By Michał Kołnierzak · Updated November 7, 2026
Automating Instagram DMs is allowed when it stays inside the platform’s messaging rules, and getting this right protects both your reach and your reputation. This guide explains, in plain language, what compliant automation looks like: you reply to people who interact with you first, you send what they asked for, and you respect the limits Instagram sets on how and when businesses can message.
Free plan · No credit card
Best practices
What this guide covers
Who can you message automatically on Instagram?
Compliant automation responds to an action someone takes — a comment, a story reply or a direct message with your keyword. You are answering a request, not reaching out to people who never signaled interest — that is the difference between a reply and unsolicited outreach.
How long can you reply after someone engages?
It depends on how the person interacted. A comment allows one private reply within 7 days of the comment. A message from the person — including a reply to your Story or to your private reply — opens a standard 24-hour messaging window from that message. Automated messages have to fit those limits; replying quickly is the simplest way to stay inside them.
How do you keep automated messages welcome?
Send what people actually asked for, avoid sending the same person messages they didn’t request, and make it easy to opt out. A clear way to stop and a sensible number of follow-ups keep conversations helpful rather than tiring.
What is a private reply, and how many can you send?
A private reply is the direct message a business sends to someone in response to their comment. Meta’s documentation is precise about it: the business can send one private reply per comment, and it has to go out within 7 days of the comment being made. It works for comments on posts, Reels, Stories and Live broadcasts, and for Live only while the broadcast is still running. That single message is the whole opening move — there is no second unsolicited message after it. This is why a comment-to-DM campaign puts everything that matters into the first DM: the link, the PDF, the coupon, or a clear question. If the first message is vague, there is no follow-up allowed to fix it unless the person writes back.
What can you send after the person replies?
Once the person answers your private reply, a normal conversation opens. Meta allows follow-up messages only after the recipient responds, and they must be sent within 24 hours of that response. Each new message from the person opens a fresh 24-hour standard messaging window. In practice this means automation can continue a conversation the person has chosen to have — send the download after they share an email, confirm a booking, answer a question — but if the person stops replying, automated follow-ups still have to fit within the window opened by their last message. CommentTap’s follow-ups are built around this: each one is checked again at the moment it is due, and it is skipped when the window since the person’s last message has closed, when they opted out, or when you have already replied to them yourself.
Are there limits on how many messages an account can send?
Yes. Meta publishes rate limits per Instagram professional account; for private replies to comments on posts and Reels the documented limit is 750 calls per hour per account, and other message types have their own per-second limits. Meta also reports how much of its API capacity an app and an account are using, and apps are expected to slow down as they approach the ceiling. CommentTap keeps its own caps below those numbers — 60 sends per minute and 700 DMs per hour per Instagram account — and reads Meta’s usage headers, when they are available, to slow down earlier when an account gets busy. Messages held back by these rate limits are queued and sent later rather than dropped, as long as Instagram’s reply window is still open, so a busy post spreads its replies out instead of skipping them. Your plan’s monthly contact limit still applies.
What does Instagram not allow?
The clearest line is unsolicited outreach: messaging people who never commented, replied or wrote to you. Don’t use follower lists or hashtag searches as a basis for sending messages. Tools that ask for your Instagram password instead of using Meta’s official login are another warning sign, because they automate the app rather than the API and put the account at risk. Message tags meant for human support, such as the Human Agent tag, may only be used for genuine manual help, not for marketing. And everything you send still has to follow Instagram’s community guidelines and commerce policies — automation does not change what is acceptable to say, only how quickly it reaches the people who asked for it.
Key takeaways
- Automate replies to engagement, never unsolicited outreach.
- Keep messages inside the platform’s messaging window.
- Honor opt-outs and send only what people asked for.
How it works
How comment-to-DM automation works
- 01
Choose a post and keyword
Pick a post or Reel and a word like “guide” or “price”.
- 02
Add your message and offer
Write the DM and attach a link, PDF, coupon or booking page.
- 03
CommentTap sends it — and tracks it
Every match gets a DM right away. Clicks and leads land in your stats.
FAQ
Questions, answered
- Is automating Instagram DMs allowed?
- Yes, when it runs through Meta’s official API, replies to people who interact first and stays within Meta’s limits. Your content and any further marketing also have to follow Instagram’s rules.
- What makes automation non-compliant?
- Examples include messaging people who never interacted, sending follow-ups without the required response, sending outside the permitted window, or ignoring an opt-out.
- How does CommentTap stay within the rules?
- It only replies to comments, story replies or messages that a person sends first, stops the same person from triggering the same campaign again for 24 hours, and handles opt-out requests automatically.
- Can I message everyone who commented on an old post?
- Only within limits. A private reply has to be sent within 7 days of the comment, and only one per comment. The 7 days run from the comment, not from when the post was published, so a new comment on an older post still qualifies.
- Does CommentTap use Meta’s official API?
- Yes. It connects through Instagram’s own login and the official Instagram API, never asks for your password, and applies messaging safeguards. These reduce specific risks but don’t guarantee delivery or prevent account restrictions; your content and use of the tool also have to follow Meta’s rules.