--- title: "What Meta Actually Allows for DM Automation" slug: what-meta-allows-for-dm-automation author: "Leonardo Maldonado" category: "Safety & Platform Limits" articleType: how-to-guide tags: ["what Meta allows for DM automation","Instagram Messaging API policy","24-hour messaging window"] publishedAt: 2026-09-18T09:00:00.000Z updatedAt: 2026-09-18T09:00:00.000Z canonical: https://setluca.com/blog/what-meta-allows-for-dm-automation ---# What Meta Actually Allows for DM Automation > Meta allows automated replies through the official Instagram Messaging API, for 24 hours after someone messages, comments, or clicks. A human agent can reply for up to 7 days. Bots must answer user input within 30 seconds. Meta bans password bots, cold outreach, and spam. ## Key takeaways - Meta permits automated messaging through its official Instagram Messaging API, not through bots that log in with your password. - You can message a person freely for 24 hours after their last message, comment, or click. - Meta retired most message tags in 2026. HUMAN_AGENT, which gives a real person 7 days, is the one that still matters. - Automated bots must respond to any user input within 30 seconds, and a warned business gets 7 days to fix a violation. - Cold DMs, password bots, and mass inauthentic messaging are prohibited, and GDPR and CCPA apply to the lead data you collect. --- Most coaches guess at what Meta allows for DM automation. You don't have to. Meta spells out its business messaging automation policy in plain words on its own developer pages, and the rules are narrower than the rumors suggest. This guide walks through the actual policy text. What the official API permits, where the 24-hour window sits, how message tags and human handoff work after Meta's 2026 changes, and what's banned flat out. Every claim is checked against a page you can open yourself. For the risk view, read [is Instagram DM automation safe](/blog/is-instagram-dm-automation-safe). For a plain allowed-versus-banned checklist, see [Instagram DM automation rules for 2026](/blog/instagram-dm-automation-rules-2026). ## What does Meta's business messaging automation policy actually permit? You can automate replies to people who reached out to you first, through the approved API, as long as you're quick about it. Meta's Messenger and IG Messaging API policy treats automation as a way to answer fast, and it says businesses "will have up to 24 hours to respond to a user." Anything you send inside that window may include promotional content. That permission is real. It also comes with conditions, and Meta writes every one of them down. The rest of this guide is those conditions. ## Is breaking Meta's terms the same as breaking the law? No, and the difference matters when you're weighing up a tool. Meta's Platform Terms are a contract. Break them and Meta can suspend your app, pull your API access, or restrict your account. That's Meta acting on its own contract, not the police. Its terms say it may act "with or without notice to you," including while it's still looking into things. The US Supreme Court drew that line in *Van Buren v. United States* (2021). It read the Computer Fraud and Abuse Act narrowly and warned that a wider reading would turn "millions of otherwise law-abiding citizens" into criminals for ignoring a computer-use policy. Breaking a terms-of-service rule is usually a contract problem, not a federal crime. So don't panic about handcuffs. Worry about losing the account your business runs on, because that's the penalty Meta actually applies. Contract law is also why the password-bot question is settled. Platform Terms section 6.a.iii says you "must not separately request or collect a Meta user's login credentials." A tool that asks for your password is asking you to break that clause. ## Allowed vs. not allowed: what's the quick version? The short version: you may answer people who contacted you, and you may not chase people who didn't. The table sorts the common moves into permitted, permitted-with-rules, and banned, straight off Meta's policy pages.
What you want to doMeta's answer
Auto-reply to someone who messaged, commented, or clicked, within 24 hoursAllowed
Send a private reply to a comment on your post or reel, within 7 daysAllowed, with rules
Have a human reply past 24 hours using the HUMAN\_AGENT tagAllowed, up to 7 days
Hand a thread to a human agent through conversation routingAllowed
Disclose that replies may be automatedRequired
Reply to any user input within 30 secondsRequired
Automate through a bot that logs in with your passwordBanned
Cold-DM people who never contacted youBanned
Mass-message at inauthentic volumeBanned
## Which types of DM automation are safe, and which aren't? Sort tools by what they actually do under the hood, not by what their homepage claims. Meta's Platform Terms draw the line in two places: you must not collect a Meta login, and you must not contact people without "legally sufficient consent, permission, and/or opt-in." Every kind of automation falls on one side of those two sentences.
Automation typeHow it worksStatus
Inbound auto-replyWebhook fires on a new DM, Send API repliesSafe -- the designed use
Comment-to-DMPrivate Replies API answers a comment on your postSafe, within 7 days of the comment
Story-reply and mention handlingWebhook on story replies, normal window appliesSafe
Drafted reply with human approvalAPI drafts, a person sendsSafe, and the strongest position
Follow-up inside an open windowSend API while the 24 hours are still runningSafe
Follow-up after the window, written by a botMessage tag misuseUnsafe -- tags are non-promotional and HUMAN\_AGENT means a human
Browser bot or mobile emulatorLogs in as you, clicks your inboxUnsafe -- breaks Platform Terms 6.a.iii
Scraped-list cold DM blastingMessages people who never contacted youUnsafe -- no consent, treated as spam
Follow-then-DM growth loopsAutomated follows plus templated openersUnsafe -- inauthentic behavior
## Step 1: Use the official Instagram Messaging API, and know how it works Everything else rests on this. Meta allows automated DMs through the Instagram Messaging API, open to professional accounts, and it connects through OAuth so you never hand over your password. A browser bot that logs in as you breaks Platform Terms instead, and no clever policy reading saves it. The [safest Instagram DM automation tool](/blog/safest-instagram-dm-automation-tool) is one built on the official connection. Four stages, and every tool that plays by the rules runs all four. Meta's Instagram Platform docs describe two ways in: Instagram API with Business Login, and Instagram API with Facebook Login for accounts tied to a Page. 1. **OAuth.** This is the sign-in Meta hosts itself. You log in on Meta's own screen and approve a named permission such as `instagram_business_manage_messages`. The tool gets a token, never your password. The first token lasts an hour and is swapped for a longer one good for 60 days. 2. **App Review.** Any tool serving accounts it doesn't own needs Advanced Access, which means passing App Review and Business Verification. A tool stuck on Standard Access can only message its own testers. 3. **Webhook.** Meta pings the tool the moment a DM, comment, or story reply lands. Meta prefers this to the tool asking every few seconds, which eats your rate limit -- the cap on how many calls you may make -- for nothing. 4. **Send API.** The tool posts the reply with a `messaging_type` of RESPONSE, UPDATE, or MESSAGE\_TAG. The caps are published: 2 calls per second per account on the Conversations API, 750 private replies an hour for comments on posts and reels. Stage five never ends. You keep answering, keep disclosing, and honour every opt-out. Meta can also suspend access to any API your app hasn't used in 28 days, so a tool you stopped using goes dark without telling you. ## Step 2: Reply inside the 24-hour messaging window The 24-hour window is the rule everything else hangs on. Meta's policy gives a business up to 24 hours to respond after a user starts a message, and promotional content is allowed inside it. Miss it and the Send API returns error code 10, subcode 2018278: "This message is sent outside of allowed window." Think of it as a clock. It starts the moment someone acts: a DM, a comment reply, a click on a Click-to-Messenger ad, a tap on your link. Each new message from them resets it to 24 hours, so a live back-and-forth stays inside the window on its own. That's why replying to inbound DMs is the safe lane. It's the exact job the API was built for. The same logic runs on WhatsApp, which is why the [WhatsApp 24-hour window](/blog/whatsapp-24-hour-window) looks so familiar. ## Step 3: Use message tags or a human handoff after 24 hours This is the part most guides still get wrong. Meta cut the message tag list right back in 2026. Its Send API reference says CONFIRMED\_EVENT\_UPDATE, ACCOUNT\_UPDATE, and POST\_PURCHASE\_UPDATE are gone, and any request carrying them fails. CUSTOMER\_FEEDBACK and HUMAN\_AGENT are what's left. HUMAN\_AGENT is the one that matters for coaching. It lets a real person answer an open question within 7 days of the lead's last message, and Meta lists it as required for the Instagram Messaging API. The tag says a human wrote the message. Putting a bot behind it is exactly the misuse Meta is watching for. There's also conversation routing. Meta dropped the older Handover Protocol for Instagram and moved everyone across. Routing lets several apps share one inbox, with one of them owning a thread at a time, so an AI assistant can pass a conversation to a person halfway through. One-time notifications and sponsored messages are still around too, and both are either opt-in or paid. ## Step 4: Disclose the automated experience Tell people when they're talking to software. You say it at the start of an automated chat, again after a long gap, and again when a thread moves from a person to a bot. You never pass a bot off as a human. Meta requires this, and two laws now back it up. California's B.O.T. Act (SB 1001, in force since July 2019) makes it unlawful to use a bot to mislead someone "about its artificial identity" in order to "incentivize a purchase or sale of goods or services." The disclosure has to be "clear, conspicuous, and reasonably designed to inform." A DM selling a coaching program is plainly a sale. The EU went further. Article 50 of the AI Act applies from 2 August 2026 and says people must be told they're dealing with an AI system "from the start of the first interaction in a clear and distinguishable manner," unless it's obvious. The European Commission says that "obvious" exception should be read narrowly. If you sell to anyone in the EU, assume you disclose. One line does all three jobs. "Replies here may be automated -- I read everything" sits in the thread and costs you nothing. ## What do GDPR and CCPA require for lead data you collect in DMs? A DM that collects a name, a goal, a budget, and an email is you handling someone's personal data, and Meta's policy doesn't cover that part. Meta's Developer Policies already ask for "legally sufficient consent, permission, and/or opt-in" before you contact people, and that you "immediately respect all requests" to block or opt out, on or off the platform. Privacy law then adds its own duties on top. Under GDPR you need a lawful basis before you touch the data. The European Data Protection Board's SME guide lists six and points out that having a contract doesn't cover marketing, so you're leaning on consent or legitimate interest. Consent has to be "freely given, informed, specific and unambiguous." You also owe people a plain notice saying who you are, why you're holding their data, and how they take it back. CCPA works differently. California's Attorney General says the law applies to for-profit businesses over $25 million in gross yearly revenue, or ones that buy, sell, or share the data of 100,000 or more Californians, or that make half their money selling personal information. Most solo coaches sit under all three lines. Your CRM vendor may not. Three habits keep you clean either way. Say what you'll do with the answers before you ask the qualifying questions. Delete a lead's data when they ask, in the tool and in the CRM. And keep transcripts out of any system you can't wipe on request. ## Step 5: Keep responding to user input There's a hard response bar here, and it's tighter than most coaches expect. Meta's responsiveness requirements say "automated bots must respond to user input within 30 seconds," and input means freeform text, quick replies, CTA buttons, and persistent menu clicks. Silence counts as a violation. So does a dead end. Meta tells the Page through the support channel and gives 7 days to put it right, after which it "may limit your bot's ability to send messages." A menu branch with nothing on the other end is the most common way a well-meaning setup trips this. The person stays in control throughout. Meta's policy notes that users "have the option to block or mute a conversation with a business at any time." Message someone who blocked you and you'll get error code 551. A reply that stays inside these lines looks like this: > **Lead:** saw your reel on cutting no-shows -- do you work with newer coaches? >**Auto-reply (drafted, review-queued):** Yeah, a lot of them. Quick one so I point you right -- roughly how many calls are you booking a week right now? (Replies here may be automated.) That answers the person, moves the conversation, and discloses automation in one line. ## Step 6: Stay out of the prohibited column Some behaviour is banned no matter how you wire it. Meta's messaging policy bars unwanted sales DMs, so a cold message to someone who never contacted you sits outside the permission altogether. Its Community Standards ban spam and coordinated inauthentic behavior, which covers mass messaging and follow-then-DM growth loops. Meta's Developer Policies add one data rule people miss. Beyond the content of the thread itself, you must not use data about the people you reach in Messenger or Instagram Messaging "for any purpose other than as reasonably necessary to support the message." Scraping profiles out of your threads to build an ad audience is not that. None of these sit in a grey area. For the volume math behind safe pacing, [how many DMs you can send on Instagram per day](/blog/how-many-dms-can-you-send-on-instagram-per-day) covers it. ## How do you verify any DM tool before you connect it? Run this before you connect, not after. Six questions, all checkable in ten minutes on the vendor's own docs and signup screen. 1. **Does the signup screen ask for your Instagram password?** If yes, stop. Compliant tools bounce you to a Meta-hosted OAuth page. 2. **Which permission does it request?** You should see a named scope such as `instagram_business_manage_messages`. Vague or missing means unofficial wiring. 3. **Does it hold Advanced Access?** Ask directly. A tool without App Review and Business Verification can't legally serve accounts it doesn't own. 4. **What does it do after 24 hours?** "We keep following up" is the wrong answer. "HUMAN\_AGENT, human-written, within 7 days" is the right one. 5. **Does it disclose automation in-thread?** Look for a configurable disclosure line, not a note buried in your bio. 6. **Can you delete a lead's data on request?** Ask for the delete path and the retention period, in writing. A tool that dodges question one is the reason accounts get action blocked. ## A worked example: how did Marina's first week on the API go? Marina coaches postpartum strength clients and posts three reels a week. This walkthrough is illustrative, not a customer case study, but the mechanics are exactly what the API does. Monday, 11:42pm, a lead named Priya comments "how does this work for c-section recovery?" on a reel. Marina's tool holds a Private Replies API token, so it sends one private reply, allowed for 7 days after the comment and capped at 750 calls per hour. > **Auto-reply:** Hey Priya -- c-section recovery is most of what I do. Quick one so I answer properly: how many weeks postpartum are you? (Replies here may be automated.) Priya answers at 11:58pm. That message opens a fresh 24-hour window and starts the 30-second clock. The tool drafts a qualifying reply, Marina approves it Tuesday morning, and the thread runs to a booked call by that afternoon. A second lead, Dana, replies once on Monday and then goes quiet. By Wednesday the window is closed, so Marina can't have a bot nudge her. She writes one message herself under HUMAN\_AGENT, inside the 7 days, and sends it. That's the whole difference between a compliant follow-up and a violation: who wrote it, and when. ## Which edge cases do the policy pages not spell out? **The lead replies at 2am from another timezone.** The window is a rolling 24 hours from their last message, not your business hours. Your bot still owes a reply within 30 seconds whenever they write, which is the strongest practical argument against "I'll answer in the morning." **They comment but never DM.** Comments run on a separate lane. A private reply is allowed within 7 days of the comment, one per comment, at 750 calls per hour. It doesn't open a 24-hour window on its own. Their reply does that. **They already bought.** POST\_PURCHASE\_UPDATE was retired in 2026, so there's no tag for order updates. Use the open window if they messaged, or move onboarding to email where you have consent. **They ask "is this a bot?"** Answer yes, plainly, in the same thread. Denying it fails Meta's policy, SB 1001, and AI Act Article 50 in one sentence. **They ask you to delete everything.** Honor it in the tool, the CRM, and any export. Meta requires you to immediately respect opt-out requests made on or off the platform. **Your integration sat idle for a month.** Meta may suspend access to any API your app hasn't used in 28 days. Re-authorize before you assume it's broken. ## Troubleshooting: what do the errors actually mean?
SymptomLikely causeFix
Error 10, subcode 2018278 -- "sent outside of allowed window"The 24 hours since their last message expiredWait for them to write, or send a human-written HUMAN\_AGENT message inside 7 days
Error 100 on a tagged sendYou're using a tag Meta retired in 2026Drop ACCOUNT\_UPDATE, CONFIRMED\_EVENT\_UPDATE, and POST\_PURCHASE\_UPDATE; use HUMAN\_AGENT
Error 200 -- "cannot message users who are not admins, developers or testers"App is still on Standard AccessComplete App Review and Business Verification to get Advanced Access
Error 613 / "calls to this api have exceeded the rate limit"Over the Send, Conversations, or Private Replies ceilingQueue and throttle: 2 calls/sec per account on Conversations, 750 private replies/hour
Error 551 -- "this person isn't receiving messages from you right now"The lead blocked or muted youStop sending. Retrying is the behavior Meta polices
Replies stop after about two monthsLong-lived access token expiredRefresh the 60-day token before expiry, or re-run OAuth
Warning in the Page Support InboxBot missed the 30-second response barAdd a fallback reply to every dead-end path within 7 days
## Which mistakes get coaches restricted? **Treating a follow as an open window.** A new follower, a like, or a profile view opens nothing. Only a message, comment, or click starts the clock, and only their message resets it. **Sending bot copy under HUMAN\_AGENT.** The tag exists so a person can resolve what a bot couldn't. Automating behind it is tag misuse, the kind of pattern that costs API access rather than earning a warning. **Putting the disclosure in your bio.** Meta wants it in the conversation, at the start and after a long gap. A bio line never reaches someone who arrived from a comment. **Building menus with dead ends.** Every quick reply and button counts as user input, and each needs a response inside 30 seconds. A branch with no fallback is a documented violation waiting to be reported. **Connecting a tool that wants your password.** It breaks Platform Terms 6.a.iii and hands your credentials to a third party. When it gets flagged, the account is yours, not theirs. **Keeping DM data forever.** Meta limits what you can do with message data, and GDPR gives EU leads a right to erasure. An archive you can't purge is a liability in both systems. ## Should you automate, hand off, or do both? Pick based on where the conversation is, not on how busy you feel. **Automate the first reply if** the lead just messaged, commented, or clicked, and the answer is factual: what you do, who you work with, what happens next. A 30-second reply is a policy requirement anyway. **Hand off to yourself if** the thread turns to price, a health condition, or a refund. Meta's conversation routing is built for this, and buyers can tell. Once the window closes, handoff stops being a preference: HUMAN\_AGENT requires a human. **Do both if** you're the only person in the business, which is most coaches reading this. Automation drafts, you approve, one thread. That satisfies the 30-second bar and keeps a human on every message that leaves your account. ## What happens if you break Meta's rules? You get a warning first, then it escalates, and the whole ladder is published. A business that drops below the response bar is told through the support channel and gets 7 days, after which Meta "may limit your bot's ability to send messages." 1. **Notice.** An explanation of the policy violation arrives in the Page Support Inbox. 2. **Grace period.** Seven days to reach compliance. 3. **Messaging restriction.** Meta limits your ability to send messages. 4. **App-level action.** Under Platform Terms 7.e.ii, Meta may suspend or permanently remove your app and account, and remove Platform access, "at any time, including while we investigate," with or without notice. 5. **Account action.** Serious or repeated breaches reach the Instagram account itself. Meta guards this hard for an obvious reason. Messaging is the last place on its platforms people still trust, and spam kills that trust faster than anything else it hosts. **If you get restricted, run this in order.** Read the notice and find the named policy, rather than guessing. Switch off auto-send everywhere while you diagnose. Fix the specific behavior, whether that's a dead-end menu, a tag misuse, or a tool holding your password. Reply through the appeal link with what changed, in one paragraph. Then resume at half your previous pace for a week. Fix suspected automated behavior on Instagram walks the account-level version. The honest limit is this. Following Meta's policy lowers your risk, but no tool can promise zero risk, and Meta can review any account at any time, and its own terms say so. Automated systems misfire, and a clean account sometimes gets caught in a sweep it had nothing to do with. Anyone who guarantees you can't be flagged is overselling. What you control is whether the review finds anything. ## How does Luca operate inside Meta's policy? Luca sits in the permitted lane by design. It replies to people who messaged you first, drafts in your voice, and sends every draft to a human review queue. Auto-send stays off unless you switch it on, so you approve replies before they go out. That maps to the policy point for point. Inbound chats keep the 24-hour window open, the review queue keeps a human on the message, and Luca answers your DMs instead of cold-messaging strangers. The queue also solves the awkward part of Step 3: when the window has closed, the follow-up is human-written because a human wrote it. Warming a newer account still helps your behavior look human. Read [Instagram account warm-up](/blog/instagram-account-warm-up) for the pacing, and [can you get banned for Instagram automation](/blog/can-you-get-banned-for-instagram-automation) for the honest risk picture. When you're ready to run it inside these limits, see [Luca's pricing](/pricing). ## FAQ ### Does Meta allow automated Instagram DMs at all? Yes. Meta permits automated Instagram DMs through its official Instagram Messaging API, available to professional accounts. The Meta business messaging automation policy frames automation as a tool for timely replies to people who contacted you. It bans unofficial bots that log in with your password and cold outreach to strangers. ### What is the 24-hour messaging window? The 24-hour messaging window is Meta's standard messaging rule. A business has up to 24 hours to respond to a user-initiated message, and can reply freely inside that window, including with promotional content. Send after it closes and the API returns error code 10, subcode 2018278. ### Can I message someone after the 24-hour window closes? Yes, through documented channels only. Meta retired most message tags in 2026, leaving HUMAN_AGENT, which lets a real person reply within 7 days, plus CUSTOMER_FEEDBACK. One-time notifications and sponsored messages also remain. What you cannot do is have a bot send promotional follow-ups after the window closes. ### How fast does an automated bot have to reply? Within 30 seconds. Meta's responsiveness requirements state that automated bots must respond to any user input within 30 seconds, where input means freeform text, quick replies, CTA buttons, and persistent menu clicks. Miss the bar and Meta notifies the Page and gives 7 days to fix it. ### Do I have to tell people they're talking to automation? Yes, and three rulebooks say so. Meta requires disclosure at the start of a conversation, after a significant gap, or when a chat moves from a human to a bot. California's SB 1001 requires a "clear, conspicuous" bot disclosure in commercial contexts, and EU AI Act Article 50 applies from 2 August 2026. ### Does GDPR apply to leads I qualify in the DMs? Yes, if any lead is in the EU or UK. Qualifying answers are personal data, so you need a lawful basis. The European Data Protection Board notes that contract doesn't cover marketing, leaving consent or legitimate interest, and consent must be "freely given, informed, specific and unambiguous." ### What DM automation does Meta prohibit? Meta prohibits bots that log in with your password, which its Platform Terms bar outright at section 6.a.iii, plus unsolicited cold DMs and mass inauthentic messaging its Community Standards treat as spam. It also restricts reusing message data for anything beyond supporting the conversation. ### Does following Meta's policy guarantee my account is safe? No. Following the Meta business messaging automation policy lowers your risk substantially, but no tool can promise zero risk. Meta's Platform Terms let it act "at any time, including while we investigate," with or without notice. Use the official API, reply inside the window, disclose automation, and keep a human in the loop. ## Sources 1. [Messenger Platform and IG Messaging API Policy Overview -- Meta for Developers](https://developers.facebook.com/docs/messenger-platform/policy/policy-overview/) 2. [Responsiveness Requirements -- Meta for Developers](https://developers.facebook.com/docs/messenger-platform/policy/responsiveness/) 3. [Send API Reference (message tags and messaging types) -- Meta for Developers](https://developers.facebook.com/docs/messenger-platform/reference/send-api/) 4. [Instagram Platform Overview (login options, permissions, Advanced Access, tokens) -- Meta for Developers](https://developers.facebook.com/docs/instagram-platform/overview/) 5. [Graph API Rate Limiting (Instagram messaging limits) -- Meta for Developers](https://developers.facebook.com/docs/graph-api/overview/rate-limiting/) 6. [Common Error Codes -- Meta for Developers](https://developers.facebook.com/documentation/business-messaging/messenger-platform/error-codes) 7. [Conversation Routing for Instagram -- Meta for Developers](https://developers.facebook.com/docs/messenger-platform/instagram/features/conversation-routing) 8. [Meta Platform Terms](https://developers.facebook.com/terms/) 9. [Meta Developer Policies](https://developers.facebook.com/devpolicy/) 10. [Van Buren v. United States, 593 U.S. ___ (2021) -- Supreme Court of the United States](https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf) 11. [Transparency obligations under Article 50 of the AI Act -- European Commission](https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act) 12. [California SB 1001 (Bots: disclosure), Business and Professions Code ยง17941](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1001) 13. [Process personal data lawfully -- European Data Protection Board SME Guide](https://www.edpb.europa.eu/sme-data-protection-guide/process-personal-data-lawfully_en) 14. [California Consumer Privacy Act (CCPA) -- California Attorney General](https://oag.ca.gov/privacy/ccpa) --- Published by SetLuca, the company behind Luca.