--- title: "Instagram DM Automation Rules: Allowed vs Banned in 2026" slug: instagram-dm-automation-rules-2026 author: "Leonardo Maldonado" category: "Safety & Platform Limits" articleType: listicle tags: ["Instagram automation rules","what's allowed Instagram DM automation","Instagram messaging policy"] publishedAt: 2026-08-20T09:00:00.000Z updatedAt: 2026-08-20T09:00:00.000Z canonical: https://setluca.com/blog/instagram-dm-automation-rules-2026 ---# Instagram DM Automation Rules: Allowed vs Banned in 2026 > Instagram DM automation is allowed when someone messages you first. You get 24 hours to reply, and the HUMAN_AGENT tag stretches that to 7 days for messages a person sends. A comment earns you exactly one private reply, within 7 days. Cold DMs, password-based tools, and machine-speed blasts are banned. ## Key takeaways - Someone has to message you first. Only after an Instagram user messages your professional account can your app message them back, and Meta's docs say so in as many words. - 24 hours to reply, 7 days with a human. The HUMAN_AGENT tag lets a business representative reply by hand inside a 7-day window. - Three message tags stopped working on April 27, 2026. CONFIRMED_EVENT_UPDATE, ACCOUNT_UPDATE, and POST_PURCHASE_UPDATE now return error code 100. - The rate limits are published, and they're not "200 an hour." Meta's Graph API docs list 100 calls per second per account for text sends, and 2 per second for the Conversations API. - Any tool that asks for your Instagram password breaks Platform Terms 6.a.iii. That clause bars developers from separately asking for or collecting a Meta user's login details. --- The Instagram DM automation rules in 2026 are stricter, and more specific, than most coaches think. They're spread across four Meta documents: the messaging policy, the Instagram Platform docs, the Platform Terms, and the Developer Policies. Put together, they say something simple. Reply to people who contacted you, at human speed, through the official API, without pretending to be someone you aren't. Two things changed this year that most guides still have wrong: three of the four message tags stopped working on April 27, 2026, and the EU started enforcing AI disclosure rules on August 2, 2026. Everything below is checked against Meta's own documentation. For the risk view, read [is Instagram DM automation safe](/blog/is-instagram-dm-automation-safe). ## Allowed vs banned: what's the quick breakdown? Most of the policy fits in one table. Everything in it comes from the messaging policy and the Platform Terms as they stood in August 2026. | Allowed | Banned | | --- | --- | | Auto-replying within 24 hours of a user's message or story reply | Cold-DMing people who never contacted you | | Promotional content inside the 24-hour window | Promo outside the window without an approved tag | | One private reply to a comment, within 7 days | A second unprompted DM to the same commenter | | A human sending under the HUMAN\_AGENT tag for up to 7 days | Auto-tagging every thread HUMAN\_AGENT to dodge the window | | Sending through the official API with Instagram or Facebook Login | Tools that log into your account with your password | | Staying under Meta's published call-rate limits | Replies that deny automation when a lead asks | The rest of this guide walks each line. ## Which automation types are actually safe? Automation isn't one thing, and Meta doesn't treat it as one. Five common patterns sit at very different risk levels, and the split comes down to one question: did the person act first? The Developer Policies put it directly -- don't contact people in Instagram Messaging unless you have legally sufficient consent, permission, or opt-in. | Automation type | Status | What governs it | | --- | --- | --- | | Comment keyword to DM | Safe, with limits | One private reply per comment, within 7 days of the comment | | Story reply auto-response | Safe | A story reply is a message, so it opens the 24-hour window | | FAQ auto-reply / Ice Breakers | Safe | Up to 4 questions via the Ice Breaker API; the user taps first | | Welcome / greeting flow | Safe | Fires on a user-initiated conversation, inside 24 hours | | Cold mass DM to non-followers | Banned | Nobody opted in, no window is open, and the Developer Policies call it spam | Comment-to-DM is the one people get wrong. A comment does not open a 24-hour chat window. It buys you one message, sent within 7 days of the comment, and that's the whole allowance (Meta's private replies documentation). The window only opens if they reply, which is why good [comment-to-DM automation](/blog/comment-to-dm-automation) puts the entire offer in message one. Story replies arrive as ordinary messages and start the clock, which makes [Instagram story reply automation](/blog/instagram-story-reply-automation) the sturdiest trigger of the lot. Cold mass DM has no version that works: no tag covers it, and no window ever opens. ## What is the 24-hour window, and why does it constrain you? Someone messages you, and from that moment you have a day to reply. That's the window. Meta says it twice: the messaging policy gives businesses up to 24 hours to respond to a user, and adds that messages sent inside that time may carry promotional content. The Instagram docs repeat it -- only after a user has messaged your professional account can your app message them. The clock starts on a message. A DM, a story reply, or a tap on one of your Ice Breaker questions all count. Watching your story, liking a post, or following you counts for nothing and gives you no right to message anyone. That one distinction is the whole thing for coaches. Answering people who contacted you is allowed; starting conversations with strangers is not, however warm the list looks. It's why "comment GUIDE" hooks work: they put permission on the record. Inside the window you can sell -- offer, price, booking link. What's limited is when you send after 24 hours, not what you say before then. ## What happened to message tags in April 2026? Three of the four stopped working. From April 27, 2026, any API request carrying CONFIRMED\_EVENT\_UPDATE, ACCOUNT\_UPDATE, or POST\_PURCHASE\_UPDATE comes back with error code 100 (Meta's Send Messages documentation). Any guide still listing those as ways to message someone after 24 hours is out of date. The one left is HUMAN\_AGENT. Meta describes it as the tag for cases that need a person to step in, letting a business representative manually respond within a 7-day period. The words that matter there are "business representative" and "manually." The tag exists so a human can finish a thread the automation couldn't. A tool that stamps HUMAN\_AGENT on every message going out is using an approved tag for a job it wasn't approved for, and Meta warns that can restrict your sending. A review queue fits the tag properly: when a person reads a draft and taps send, the human agent is real. ## Rate limits: what does Meta actually publish? Calls per second, not messages per hour, which is why the numbers you see quoted around the internet rarely match anything real. The Graph API rate-limiting documentation gives an app 100 calls per second per Instagram professional account for messages containing text, links, reactions, and stickers, 10 per second for audio or video, and 2 per second for the Conversations API. **Chart:** Meta publishes Instagram messaging rate limits as calls per second per professional account: 100 for text sends, 10 for audio or video sends, and 2 for the Conversations API. (Meta publishes Instagram messaging rate limits as calls per second per professional account: 100 for text sends, 10 for audio or video sends, and 2 for the Conversations API. See Sources.) Source: Meta for Developers, Graph API rate limiting documentation (retrieved 2026-08-13). Those ceilings are about what the software can do, not about what you're allowed to do. Meta also caps your overall Instagram Platform usage on a rolling basis: calls in 24 hours equal 4,800 times the impressions your account earned the day before. Small accounts get small allowances, which is one more reason a new profile shouldn't be running automation at volume. You'll see posts claiming a hard limit of "200 automated messages per hour." That figure isn't in Meta's documentation and we couldn't find it anywhere on Meta's site. Plan around human pace instead, and see [how many DMs you can send on Instagram per day](/blog/how-many-dms-can-you-send-on-instagram-per-day). ## Disclosure: do you have to say it's AI? In the EU, yes, since August 2, 2026. The European Commission started enforcing the AI Act's transparency rules that day, saying chatbots and other interactive AI systems will have to tell users they are dealing with AI, not a human. Article 50(1) requires people to be told they're dealing with an AI system, unless it's obvious to anyone paying normal attention. In California, hidden deceptive bots have been against the law since 2019 under SB 1001. Meta's own Developer Policies don't have a bot-disclosure clause as such. What they say is broader: don't confuse, deceive, defraud, mislead, spam or surprise anyone. Denying AI when a lead asks puts you on the wrong side of that sentence, and depending on where they live, of a law as well. Hiding it buys you less than you'd think, and the people who notice are the ones who'd have told you so anyway. One line covers it: "Replies here are AI-assisted, and I read every one before it sends." ## How do you verify a tool before you connect it? Run this before giving any tool access to your account. 1. **Password or OAuth?** If signing up asks for your Instagram username and password, stop there. Platform Terms 6.a.iii say developers must not separately request or collect a Meta user's login details. A tool that plays by the rules sends you to a Meta-hosted approval screen and never sees your password. 2. **Which permissions does it ask for?** Real messaging tools ask for `instagram_business_manage_messages` (Instagram Login) or `instagram_manage_messages` (Facebook Login). Anything unrelated to messaging, ask why. 3. **Has the app passed App Review?** For Advanced Access, an app has to get through App Review and Business Verification, which Meta's Instagram Platform overview spells out. Ask the seller in writing. 4. **Are they in Meta's partner directory?** Meta lists checked messaging partners in its Business Partners directory. Being absent proves nothing; being listed is a real signal. 5. **Do they publish how they handle the window and the rate limits?** A seller who can tell you what happens at hour 25 built against the policy. One selling "unlimited DMs" didn't. 6. **Any mention of browser automation?** "Browser extension," "session cookie," "device farm," or "residential proxy" all mean the tool drives your account like a person instead of going through the API. If a seller won't answer items 1 and 3 in writing, that's your answer. More in [the safest Instagram DM automation tool](/blog/safest-instagram-dm-automation-tool). ## Device and IP hygiene API traffic doesn't come from your phone, so with a real integration most of these worries go away. They come straight back the moment a tool logs in as you. Password-based and extension-based tools leave an obvious trail: your account signing in from a data-centre IP in one country while your phone sits in another, at a rhythm no thumb produces. Keep logins on your own devices, don't hand session access to a contractor overseas, and don't run several accounts through one browser profile and proxy. On a brand new profile, build real activity first, which is what an [Instagram account warm up](/blog/instagram-account-warm-up) is for. ## How does Meta's enforcement ladder work, and how do you recover? It climbs five rungs, and the early ones are quiet enough that most people never notice them. Almost none of it starts with replying to leads. It starts with password-based tools, cold outreach, identical blasts, promotion sent outside the window, or a misused tag -- the full picture is in [can you get banned for Instagram automation](/blog/can-you-get-banned-for-instagram-automation). **Rung 1: the API slows you down.** Error 80002 means Instagram is throttling you, 80006 means Messenger is (Meta's Graph API docs). Your account is fine; your integration is calling too fast. **Rung 2: app, user, or page limits.** Error 4 is an app-level limit, 17 is user-level, 32 is page-level. They clear on their own, and they come back if the pattern does. **Rung 3: messaging restriction.** A Page stopped from sending messages for breaking the Developer Policies gets an explanation emailed to its Page Support Inbox. Read it, because it names the policy you broke. **Rung 4: app suspension.** Under Platform Terms 7.e.ii, Meta may suspend or permanently remove your app and account. With a third-party tool this rung lands on the seller, and takes your integration down with it. **Rung 5: action against your account.** The one coaches feel: action blocks, features switched off, or a disabled profile. Meta doesn't publish how long any of it lasts, and we won't invent numbers. See Instagram action blocked. **How to recover.** Disconnect the automation the same day, before you appeal. Arguing with a restriction while the cause is still running is how a temporary block becomes a permanent one. Fix the exact thing named in the error or the email. Use the account by hand for a week, check Account Status, and send one appeal, not five. Reconnect with a single trigger at low volume for two weeks. If a password-based tool caused it, revoke its access, change your password, and turn on two-factor first. ## A worked example: Priya's comment-to-DM funnel *Illustrative example, not a real client.* Priya coaches strength athletes and posts a Reel offering a free deload template, captioned "comment DELOAD and I'll send it." Here's how the rules land across one thread. **9:14 a.m.** A follower comments "DELOAD," which starts the 7-day private reply clock and gives Priya exactly one message. **9:14 a.m., private reply (one message only):** > "Here's the deload template -- [link]. Quick one so I send the right version: are you training 3 days a week or 5? (Replies here are AI-assisted, and I read them before they send.)" The thing she promised, one qualifying question, and the disclosure. There's no second message to add any of it in. **11:02 a.m.** She replies "5 days, powerlifting." That reply is a message, so the 24-hour window opens and Priya can ask more questions, talk price, and send a booking link. **11:03 a.m. to 4:40 p.m.** Four exchanges, all drafted by automation and approved by Priya before they send. **Next day, 12:30 p.m.** The lead has gone quiet and the window has closed, so there's no automated nudge available. Priya opens the thread, types a check-in herself, and it goes out under HUMAN\_AGENT: a business representative replying by hand, which is what the tag is for. **Day 8.** Nothing else can be sent until the lead messages again. One automated private reply, one window they opened, one message a human sent under the tag. That's the whole shape of it. ## Which edge cases do the rules not obviously cover? **The lead replies at 2 a.m.** The clock runs from their message, not from your working hours. A 2:07 a.m. reply runs out at 2:07 a.m. the next day, so a draft waiting until you wake up still has 18 hours on it. **The lead is in another timezone.** The window ignores timezones; people don't. A perfectly legal reply landing at 3 a.m. their time still reads as a bot. Hold anything that isn't urgent until their morning. **They're already a client.** A client messaging about their programme is a support conversation, which is exactly what HUMAN\_AGENT was built for. Reply as yourself inside 7 days, and don't push them through a qualifying flow. **They comment during a live broadcast.** The rule here is exact: private replies to Instagram Live comments can only be sent while the broadcast is running. **They DM you from the EU.** Article 50 disclosure applies from the first message, so keep the AI-assisted line in your opener. ## Troubleshooting: why did your automation stop working? | Symptom | Likely cause | Fix | | --- | --- | --- | | An automated reply won't send on a thread that worked yesterday | The 24-hour window closed | Send it yourself under HUMAN\_AGENT if you're inside 7 days; otherwise wait for them to message again | | Sends stop mid-day, error 80002 or 80006 | You're being throttled for bursts of calls per second | Space the sends out, and stop batching a day's replies into one run | | Error code 100 on a scheduled follow-up | The tool is still using a tag that stopped working on April 27, 2026 | Move to HUMAN\_AGENT, with a person sending | | Comment-to-DM fires on new posts, silent on older ones | The comment is more than 7 days old | Reply in public and invite them to DM you instead | | "Action Blocked" in the app, but the API looks fine | Action against your account, usually caused by browser automation | Disconnect the tools, use the account by hand for a week, appeal once | | The tool asks for your password again after you change it | It's a password-based tool, not an API integration | Revoke its access, change your password, turn on 2FA, and move | ## Common mistakes **Treating a comment like a DM.** People build three-step comment flows, then wonder why steps two and three never arrive. It's one private reply per comment, and that's it. **Sticking HUMAN\_AGENT on everything.** It looks like a tidy way to buy yourself seven days. It's an approved tag used for something it wasn't approved for, and Meta says that can cost you your messaging. **Letting the bot deny it's a bot.** Some tools sell this as a feature. It breaks Meta's anti-deception rule, EU Article 50, and SB 1001 in a single message. **Buying on "unlimited DMs."** No tool playing by the rules can offer that. The per-second call limits and the daily impressions sum are both published. **Running automation on a week-old account.** Your daily allowance grows with your impressions, so a new profile has almost no room. **Sending everyone the same opener.** Identical text sent fast is the exact pattern spam detection was built to catch. ## Should you automate at all? **Automate replies with a human review queue if** you get more than a handful of DMs a day and you're losing leads because you reply late. That's the right default for most coaches. **Automate comment-to-DM only if** your volume is low but your lead magnets pull well. Sending the template automatically and handling the conversation yourself carries almost no risk. **Turn auto-send on only if** your account is settled and the drafts have been right for weeks. It's something you earn, not a starting setting. **Don't automate if** your leads come from cold outreach, your account is under 30 days old, or you're already under a restriction. **Hire a human setter instead if** your offer sits above roughly $10,000 and your sales conversations run long. Automation gets more replies out; it doesn't replace judgment in a complicated sale. ## One honest limit Following these rules won't make you ban-proof. Meta changes limits without much warning, and three message tags vanished in April 2026. Enforcement is uneven, and no well-behaved tool will stop you writing spammy copy or buying junk leads. The rules lower your risk a lot. They don't remove it. A zero-risk guarantee promises something Meta itself doesn't offer. There's a second limit worth naming. Automation is genuinely worse than you in certain moments: a grieving client, a serious objection, a lead who got burned last time. Build the handoff to yourself before you need it, and take the thread over the moment the conversation turns. ## How does Luca stay inside the rules? Luca is an AI DM setter that reads and replies to Instagram, WhatsApp, Telegram, and Facebook Messenger DMs in your voice, built to sit inside these lines rather than work around them. Every reply goes to a human review queue, and auto-send stays off until you turn it on, so a person does the sending. It only answers people who contacted you, and it doesn't deny AI is involved when a lead asks. Coaches use Luca to qualify leads, run follow-ups, and book calls without hiring a setter. For the setup, see [Instagram DM automation for coaches](/blog/instagram-dm-automation-for-coaches), and check [Luca's pricing](/pricing) when you're ready. ## FAQ ### Is Instagram DM automation against the rules in 2026? No, not when it's done right. Automated replies through the official API are allowed once a user has messaged you, inside the 24-hour window. What's banned: cold-DMing strangers, tools that collect your password in breach of Platform Terms 6.a.iii, and promotional messages sent outside the window without an approved tag. ### What is the 24-hour rule for Instagram DMs? Once someone messages you, you have a day to answer, and anything you send inside that day is allowed to be promotional. The clock only starts on a real message: a DM, a story reply, or a tap on an Ice Breaker question. Views, likes, and follows open nothing at all. ### Which message tags still work in 2026? Only HUMAN_AGENT. It lets a business representative reply by hand within a 7-day period, which means a person has to do the sending. The other three stopped working on April 27, 2026: requests carrying CONFIRMED_EVENT_UPDATE, ACCOUNT_UPDATE, or POST_PURCHASE_UPDATE now come back with error code 100. ### Do I have to tell people they're talking to a bot? In the EU, yes, since August 2, 2026, when the Commission started enforcing AI Act transparency rules requiring interactive AI systems to tell users they're dealing with AI. California's SB 1001 bars hidden deceptive bots in commercial exchanges. Meta's Developer Policies add their own line: don't confuse, deceive, or mislead anyone. ### How many automated DMs can I send per hour? There's no published per-hour number, because the limits are set in calls per second: 100 per second per Instagram professional account for text sends, 10 for audio or video, and 2 for the Conversations API. Your overall Instagram Platform usage is capped at 4,800 times your daily impressions. ### How does comment-to-DM automation work under the rules? A comment earns you exactly one private reply, and it has to go out within 7 days of the comment being made. That's one message to the person who commented, full stop. If they reply, the standard 24-hour messaging window opens and you can carry on normally. ### How do I know if a DM tool is compliant? Check three things. It should never ask for your Instagram password, since Platform Terms 6.a.iii bars developers from collecting Meta login details. It should hold Advanced Access, granted through Meta App Review. And it should tell you how it handles the 24-hour window rather than promising unlimited sending. ### Will following these rules stop me from ever getting banned? No tool can promise that. Staying inside the policy lowers your risk a lot without getting rid of it, because enforcement is uneven and no rule fixes spammy copy or a bad lead source. Three message tags disappeared in April 2026 with little warning, which tells you how fast the ground moves. Treat any zero-risk guarantee as a red flag. ## Sources 1. [Meta for Developers -- Messenger Platform and IG Messaging API policy (24-hour window, human-agent tag, tag misuse restrictions, Page Support Inbox notice)](https://developers.facebook.com/documentation/business-messaging/messenger-platform/policy) 2. [Meta for Developers -- Send Messages (April 27, 2026 deprecation of CONFIRMED_EVENT_UPDATE, ACCOUNT_UPDATE, POST_PURCHASE_UPDATE; HUMAN_AGENT 7-day period)](https://developers.facebook.com/documentation/business-messaging/messenger-platform/send-messages) 3. [Meta for Developers -- Instagram API with Instagram Login: Messaging (user must message first; 24-hour response window; HUMAN_AGENT tag)](https://developers.facebook.com/docs/instagram-platform/instagram-api-with-instagram-login/messaging-api/) 4. [Meta for Developers -- Graph API Rate Limits (100 calls/sec text sends, 10 calls/sec audio-video, 2 calls/sec Conversations API, 4,800 x impressions per 24 hours, error codes 4/17/32/80002/80006)](https://developers.facebook.com/docs/graph-api/overview/rate-limiting/) 5. [Meta for Developers -- Instagram Private Replies (7 days from comment creation, one message per commenter, Live broadcast restriction)](https://developers.facebook.com/docs/messenger-platform/instagram/features/private-replies/) 6. [Meta for Developers -- Instagram Ice Breakers (maximum of 4 questions)](https://developers.facebook.com/docs/messenger-platform/instagram/features/ice-breakers/) 7. [Meta Platform Terms (section 6.a.iii on login credentials; section 7.e.ii on suspension and removal)](https://developers.facebook.com/terms/) 8. [Meta Developer Policies (consent and opt-in for Instagram Messaging; spam and high-frequency bot behavior; do not deceive or mislead)](https://developers.facebook.com/devpolicy/) 9. [Meta for Developers -- Instagram Platform Overview (messaging permissions, App Review, Advanced Access, Business Verification)](https://developers.facebook.com/docs/instagram-platform/overview/) 10. [European Commission -- Commission starts enforcing AI Act rules and new transparency requirements on 2 August](https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august) 11. [EUR-Lex -- Regulation (EU) 2024/1689 (AI Act), Article 50 transparency obligations](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) 12. [California Legislative Information -- SB 1001 (Bots: disclosure)](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1001) --- Published by SetLuca, the company behind Luca.