---
title: "Is Instagram DM Automation Allowed? What Meta Actually Permits"
slug: what-meta-allows-for-dm-automation
author: "Leonardo Maldonado"
category: "Safety & Platform Limits"
articleType: how-to-guide
tags: ["what Meta allows for DM automation","Instagram Messaging API policy","24-hour messaging window"]
publishedAt: 2026-09-18T09:00:00.000Z
updatedAt: 2026-10-29T12:00:00.000Z
canonical: https://setluca.com/blog/what-meta-allows-for-dm-automation
---# Is Instagram DM Automation Allowed? What Meta Actually Permits

> Meta allows automated Instagram DM replies when they run on the official Instagram Messaging API and answer someone who messaged, commented or clicked first. So is Instagram DM automation allowed? Yes, inside limits: 24 hours after their last message, up to 7 days from a click-to-DM ad, 7 days for a human agent, and a 30-second bot reply bar. Password bots, cold outreach and spam are banned.

## Key takeaways

- Meta permits automated messaging through its official Instagram Messaging API, not through bots that log in with your password.
- You can message a person freely for 24 hours after their last message, comment, or click, or for up to 7 days from their first message after a click-to-DM ad.
- Meta retired most message tags in 2026. HUMAN_AGENT, which gives a real person 7 days, is the one that still matters.
- Automated bots must respond to any user input within 30 seconds, and a warned business gets 7 days to fix a violation.
- Cold DMs, password bots, and mass inauthentic messaging are prohibited, and GDPR and CCPA apply to the lead data you collect.

---

Meta allows DM automation through its official Instagram Messaging API. You can reply to people who messaged, commented or clicked first, within 24 hours of their last message. That stretches to 7 days when the chat started from a click-to-DM ad. A human can reply for up to 7 days, and password bots and cold DMs are banned. Meta spells out its business messaging automation policy in plain words on its own developer pages, and the rules are narrower than the rumors suggest.

For the risk view, read [is Instagram DM automation safe](/blog/is-instagram-dm-automation-safe). For a plain allowed-versus-banned checklist, see [Instagram DM automation rules 2026](/blog/instagram-dm-automation-rules-2026). If you've already been hit, see how to recover from an [Instagram shadowban](/blog/how-to-recover-from-instagram-shadowban). For whether a tool breaks Instagram's Terms of Use, see [is Instagram automation against terms of service](/blog/is-instagram-automation-against-terms-of-service). For sending pace, see the [Instagram DM rate limit per hour](/blog/instagram-dm-rate-limit-per-hour).

## What does Meta's business messaging automation policy actually permit?

You can automate replies to people who reached out to you first, through the approved API, as long as you're quick about it. Meta's Messenger and IG Messaging API policy treats automation as a way to answer fast. It says businesses "will have up to 24 hours to respond to a user." Anything you send inside that window may include promotional content.

## Is breaking Meta's terms the same as breaking the law?

No, and the difference matters when you're weighing up a tool. Meta's Platform Terms are a contract. Break them and Meta can suspend your app, pull your API access, or restrict your account. That's Meta acting on its own contract, not the police. Its terms say it may act "with or without notice to you," including while it's still looking into things.

The US Supreme Court drew that line in _Van Buren v. United States_ (2021). It read the Computer Fraud and Abuse Act narrowly and warned that a wider reading would turn "millions of otherwise law-abiding citizens" into criminals for ignoring a computer-use policy. Breaking a terms-of-service rule is usually a contract problem, not a federal crime.

So don't panic about handcuffs. Worry about losing the account your business runs on, because that's the penalty Meta actually applies. Contract law is also why the password-bot question is settled. Platform Terms section 6.a.iii says you "must not separately request or collect a Meta user's login credentials." A tool that asks for your password is asking you to break that clause.

## Is Instagram DM automation allowed? The quick version

The short version: you may answer people who contacted you, and you may not chase people who didn't. The table sorts the common moves into permitted, permitted-with-rules, and banned, straight off Meta's policy pages.

| What you want to do | Meta's answer |
| --- | --- |
| Auto-reply to someone who messaged, commented, or clicked, within 24 hours | Allowed |
| Reply window, click-to-DM ad conversations | Allowed, up to 7 days from their first message after the ad click |
| Send a private reply to a comment on your post or reel, within 7 days | Allowed, with rules |
| Have a human reply past 24 hours using the HUMAN_AGENT tag | Allowed, up to 7 days |
| Hand a thread to a human agent through conversation routing | Allowed |
| Disclose that replies may be automated | Required |
| Reply to any user input within 30 seconds | Required |
| Automate through a bot that logs in with your password | Banned |
| Cold-DM people who never contacted you | Banned |
| Mass-message at inauthentic volume | Banned |

## Which types of DM automation are safe, and which aren't?

Sort tools by what they actually do under the hood, not by what their homepage claims. Meta's Platform Terms draw the line in two places. You must not collect a Meta login. And you must not contact people without "legally sufficient consent, permission, and/or opt-in." Every kind of automation falls on one side of those two sentences.

| Automation type | How it works | Status |
| --- | --- | --- |
| Inbound auto-reply | Webhook fires on a new DM, Send API replies | Safe, the designed use |
| Comment-to-DM | Private Replies API answers a comment on your post | Safe, within 7 days of the comment |
| Story-reply and mention handling | Webhook on story replies, normal window applies | Safe |
| Drafted reply with human approval | API drafts, a person sends | Safe, and the strongest position |
| Follow-up inside an open window | Send API while the 24 hours are still running | Safe |
| Follow-up after the window, written by a bot | Message tag misuse | Unsafe. Tags are non-promotional and HUMAN_AGENT means a human |
| Browser bot or mobile emulator | Logs in as you, clicks your inbox | Unsafe, breaks Platform Terms 6.a.iii |
| Scraped-list cold DM blasting | Messages people who never contacted you | Unsafe. No consent, treated as spam |
| Follow-then-DM growth loops | Automated follows plus templated openers | Unsafe, inauthentic behavior |

## Step 1: Use the official Instagram Messaging API, and know how it works

Everything else rests on this. Meta allows automated DMs through the Instagram Messaging API, open to professional accounts, and it connects through OAuth so you never hand over your password. A browser bot that logs in as you breaks Platform Terms instead, and no clever policy reading saves it. The [safest Instagram DM automation tool](/blog/safest-instagram-dm-automation-tool) is one built on the official connection.

Four stages, and every tool that plays by the rules runs all four. Meta's Instagram Platform docs describe two ways in: Instagram API with Business Login, and Instagram API with Facebook Login for accounts tied to a Page.

1. **OAuth.** This is the sign-in Meta hosts itself. You log in on Meta's own screen and approve a named permission such as `instagram_business_manage_messages`. The tool gets a token, never your password. The first token lasts an hour and is swapped for a longer one good for 60 days.
2. **App Review.** Any tool serving accounts it doesn't own needs Advanced Access, which means passing App Review and Business Verification. A tool stuck on Standard Access can only message its own testers.
3. **Webhook.** Meta pings the tool the moment a DM, comment, or story reply lands. Meta prefers this to the tool asking every few seconds, which eats your rate limit, the cap on how many calls you may make, for nothing.
4. **Send API.** The tool posts the reply with a `messaging_type` of RESPONSE, UPDATE, or MESSAGE_TAG. The caps are published: 2 calls per second per account on the Conversations API, 750 private replies an hour for comments on posts and reels.

Stage five never ends. You keep answering, keep disclosing, and honour every opt-out. Meta can also suspend access to any API your app hasn't used in 28 days, so a tool you stopped using goes dark without telling you.

## Step 2: Reply inside the 24-hour messaging window

The 24-hour window is the rule everything else hangs on. For most entry points, Meta's policy gives a business up to 24 hours to respond after a user starts a message, and promotional content is allowed inside it. Click-to-Messenger and Click-to-Direct ads are different. There, Meta says the window "may last up to 7 days" from the person's first message after the click. Miss the window and the Send API returns error code 10, subcode 2018278: "This message is sent outside of allowed window."

Think of it as a clock. It starts the moment someone acts: a DM, a comment reply, a tap on your link. Each new message from them resets it to 24 hours, so a live back-and-forth stays inside the window on its own. Ad conversations are the exception. Their 7-day period starts with the person's first message after the click. Every other entry point stays on 24 hours.

The rolling window is why replying to inbound DMs is the safe lane. Answering inbound messages is the exact job the API was built for. The same logic runs on WhatsApp, which is why the [WhatsApp 24-hour window](/blog/whatsapp-24-hour-window) looks so familiar.

## Step 3: Use message tags or a human handoff after 24 hours

Message tags are the part most guides still get wrong. Meta cut the message tag list right back in 2026. Its Send API reference says CONFIRMED_EVENT_UPDATE, ACCOUNT_UPDATE, and POST_PURCHASE_UPDATE are gone, and any request carrying them fails. CUSTOMER_FEEDBACK and HUMAN_AGENT are what's left.

HUMAN_AGENT is the one that matters for coaching. It lets a real person answer an open question within 7 days of the lead's last message, and Meta lists it as required for the Instagram Messaging API. The tag says a human wrote the message. Putting a bot behind it is exactly the misuse Meta is watching for.

There's also conversation routing. Meta dropped the older Handover Protocol for Instagram and moved everyone across. Routing lets several apps share one inbox, with one app owning a thread at a time. That's how an AI assistant can pass a conversation to a person halfway through. One-time notifications and sponsored messages are still around too, and both are either opt-in or paid.

## Step 4: Disclose the automated experience

Tell people when they're talking to software. You say it at the start of an automated chat, again after a long gap, and again when a thread moves from a person to a bot. You never pass a bot off as a human. Meta requires this, and two laws now back it up.

California's B.O.T. Act (SB 1001, in force since July 2019) makes it unlawful to use a bot to mislead someone "about its artificial identity" in order to "incentivize a purchase or sale of goods or services." The disclosure has to be "clear, conspicuous, and reasonably designed to inform." A DM selling a coaching program is plainly a sale.

The EU went further. Article 50 of the AI Act applies from 2 August 2026. It says people must be told they're dealing with an AI system "from the start of the first interaction in a clear and distinguishable manner," unless it's obvious. The European Commission says that "obvious" exception should be read narrowly. If you sell to anyone in the EU, assume you disclose.

New York City may add its own rule. On October 20, 2026, its Department of Consumer and Worker Protection proposed one on automated customer service. It would require businesses to disclose the automation at the beginning of an interaction and offer an easy way to reach a human. The rule is proposed, not in force. Public comments close on December 18, 2026, the same day as the public hearing (NYC Rules, checked October 27, 2026). That city proposal is separate from New York State's S.9051B, signed October 28, 2026, which from January 1, 2027 bars AI chatbots from presenting as human to users under 18 unless the company first confirms, with an age check, that the user is not a minor.

One line does all three jobs. "Replies here may be automated. I read everything" sits in the thread and costs you nothing.

## What do GDPR and CCPA require for lead data you collect in DMs?

A DM that collects a name, a goal, a budget, and an email is you handling someone's personal data, and Meta's policy doesn't cover that part. Meta's Developer Policies already ask for "legally sufficient consent, permission, and/or opt-in" before you contact people. They also say you must "immediately respect all requests" to block or opt out, on or off the platform. Privacy law then adds its own duties on top.

Under GDPR you need a lawful basis before you touch the data. The European Data Protection Board's SME guide lists six and points out that having a contract doesn't cover marketing, so you're leaning on consent or legitimate interest. Consent has to be "freely given, informed, specific and unambiguous." You also owe people a plain notice saying who you are, why you're holding their data, and how they take it back.

CCPA works differently. California's Attorney General says the law covers for-profit businesses that meet one of three tests. They make over $25 million in gross yearly revenue, or they buy, sell, or share the data of 100,000 or more Californians, or they make half their money selling personal information. Most solo coaches sit under all three lines. Your CRM vendor may not.

Three habits keep you clean either way. Say what you'll do with the answers before you ask the qualifying questions. Delete a lead's data when they ask, in the tool and in the CRM. And keep transcripts out of any system you can't wipe on request.

## Step 5: Keep responding to user input

There's a hard response bar here, and it's tighter than most coaches expect. Meta's responsiveness requirements say "automated bots must respond to user input within 30 seconds," and input means freeform text, quick replies, CTA buttons, and persistent menu clicks. Silence counts as a violation. So does a dead end.

Meta tells the Page through the support channel and gives 7 days to put it right, after which it "may limit your bot's ability to send messages." In our experience, a menu branch with nothing on the other end is the most common way a well-meaning setup trips the 30-second rule.

The person stays in control throughout. Meta's policy notes that users "have the option to block or mute a conversation with a business at any time." Message someone who blocked you and you'll get error code 551.

A reply that stays inside these lines looks like this:

> **Lead:** saw your reel on cutting no-shows, do you work with newer coaches? >**Auto-reply:** Yeah, a lot of them. Quick one so I point you right. Roughly how many calls are you booking a week right now? (Replies here may be automated.)

That answers the person, moves the conversation, and discloses automation in one line.

## Step 6: Stay out of the prohibited column

Some behaviour is banned no matter how you wire it. Meta's messaging policy bars unwanted sales DMs, so a cold message to someone who never contacted you sits outside the permission altogether. Its Community Standards ban spam and coordinated inauthentic behavior, which covers mass messaging and follow-then-DM growth loops.

Meta's Developer Policies add one data rule people miss. There's a data rule too. You must not use data about the people you reach in Messenger or Instagram Messaging "for any purpose other than as reasonably necessary to support the message." Scraping profiles out of your threads to build an ad audience is not that.

None of these sit in a grey area. For the volume math behind safe pacing, [how many DMs you can send on Instagram per day](/blog/how-many-dms-can-you-send-on-instagram-per-day) covers it.

## How do you verify any DM tool before you connect it?

Run this before you connect, not after. Six questions, all checkable in ten minutes on the vendor's own docs and signup screen.

1. **Does the signup screen ask for your Instagram password?** If yes, stop. Compliant tools bounce you to a Meta-hosted OAuth page.
2. **Which permission does it request?** You should see a named scope such as `instagram_business_manage_messages`. Vague or missing means unofficial wiring.
3. **Does it hold Advanced Access?** Ask directly. A tool without App Review and Business Verification can't legally serve accounts it doesn't own.
4. **What does it do after 24 hours?** "We keep following up" is the wrong answer. "HUMAN_AGENT, human-written, within 7 days" is the right one.
5. **Does it disclose automation in-thread?** Look for a configurable disclosure line, not a note buried in your bio.
6. **Can you delete a lead's data on request?** Ask for the delete path and the retention period, in writing.

A tool that dodges question one is the reason accounts get [action blocked](/blog/how-to-fix-an-action-block-on-instagram).

## A worked example: how did Marina's first week on the API go?

Marina coaches postpartum strength clients and posts three reels a week. This walkthrough is illustrative, not a customer case study, but the mechanics are exactly what the API does.

Monday, 11:42pm, a lead named Priya comments "how does this work for c-section recovery?" on a reel. Marina's tool holds a Private Replies API token, so it sends one private reply. That's allowed for 7 days after the comment, capped at 750 calls per hour.

> **Auto-reply:** Hey Priya, c-section recovery is most of what I do. Quick one so I answer properly: how many weeks postpartum are you? (Replies here may be automated.)

Priya answers at 11:58pm. That message opens a fresh 24-hour window and starts the 30-second clock. The tool sends a qualifying reply within seconds, Marina reads the thread Tuesday morning, and it runs to a booked call by that afternoon.

A second lead, Dana, replies once on Monday and then goes quiet. By Wednesday the window is closed, so Marina can't have a bot nudge her. She writes one message herself under HUMAN_AGENT, inside the 7 days, and sends it. That's the whole difference between a compliant follow-up and a violation: who wrote it, and when.

## Which edge cases do the policy pages not spell out?

**The lead replies at 2am from another timezone.** The window is a rolling 24 hours from their last message, not your business hours. Your bot still owes a reply within 30 seconds whenever they write, which is the strongest practical argument against "I'll answer in the morning."

**They comment but never DM.** Comments run on a separate lane. A private reply is allowed within 7 days of the comment, one per comment, at 750 calls per hour. It doesn't open a 24-hour window on its own. Their reply does that.

**They already bought.** POST_PURCHASE_UPDATE was retired in 2026, so there's no tag for order updates. Use the open window if they messaged, or move onboarding to email where you have consent.

**They ask "is this a bot?"** Answer yes, plainly, in the same thread. Denying it fails Meta's policy, SB 1001, and AI Act Article 50 in one sentence.

**They ask you to delete everything.** Honor it in the tool, the CRM, and any export. Meta requires you to immediately respect opt-out requests made on or off the platform.

**Your integration sat idle for a month.** Meta may suspend access to any API your app hasn't used in 28 days. Re-authorize before you assume it's broken.

## Troubleshooting: what do the errors actually mean?

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| Error 10, subcode 2018278, "sent outside of allowed window" | The 24 hours since their last message expired | Wait for them to write, or send a human-written HUMAN_AGENT message inside 7 days |
| Error 100 on a tagged send | You're using a tag Meta retired in 2026 | Drop ACCOUNT_UPDATE, CONFIRMED_EVENT_UPDATE, and POST_PURCHASE_UPDATE; use HUMAN_AGENT |
| Error 200, "cannot message users who are not admins, developers or testers" | App is still on Standard Access | Complete App Review and Business Verification to get Advanced Access |
| Error 613 / "calls to this api have exceeded the rate limit" | Over the Send, Conversations, or Private Replies ceiling | Queue and throttle: 2 calls/sec per account on Conversations, 750 private replies/hour |
| Error 551, "this person isn't receiving messages from you right now" | The lead blocked or muted you | Stop sending. Retrying is the behavior Meta polices |
| Replies stop after about two months | Long-lived access token expired | Refresh the 60-day token before expiry, or re-run OAuth |
| Warning in the Page Support Inbox | Bot missed the 30-second response bar | Add a fallback reply to every dead-end path within 7 days |

## Which mistakes get coaches restricted?

**Treating a follow as an open window.** A new follower, a like, or a profile view opens nothing. Only a message, comment, or click starts the clock, and only their message resets it.

**Sending bot copy under HUMAN_AGENT.** The tag exists so a person can resolve what a bot couldn't. Automating behind it is tag misuse, the kind of pattern that costs API access rather than earning a warning.

**Putting the disclosure in your bio.** Meta wants it in the conversation, at the start and after a long gap. A bio line never reaches someone who arrived from a comment.

**Building menus with dead ends.** Every quick reply and button counts as user input, and each needs a response inside 30 seconds. A branch with no fallback is a documented violation waiting to be reported.

**Connecting a tool that wants your password.** It breaks Platform Terms 6.a.iii and hands your credentials to a third party. When it gets flagged, the account is yours, not theirs.

**Keeping DM data forever.** Meta limits what you can do with message data, and GDPR gives EU leads a right to erasure. An archive you can't purge is a liability in both systems.

## Should you automate, hand off, or do both?

Pick based on where the conversation is, not on how busy you feel.

**Automate the first reply if** the lead just messaged, commented, or clicked, and the answer is factual: what you do, who you work with, what happens next. A 30-second reply is a policy requirement anyway.

**Hand off to yourself if** the thread turns to price, a health condition, or a refund. Meta's conversation routing is built for this, and buyers can tell. Once the window closes, handoff stops being a preference: HUMAN_AGENT requires a human.

**Do both if** you're the only person in the business, which is most coaches reading this. Automation answers the first factual questions, and you take the threads that turn personal, all in one inbox. That meets the 30-second bar and keeps a human on every conversation that needs one.

## What happens if you break Meta's rules?

You get a warning first, then it escalates, and the whole ladder is published. A business that drops below the response bar is told through the support channel and gets 7 days, after which Meta "may limit your bot's ability to send messages."

1. **Notice.** An explanation of the policy violation arrives in the Page Support Inbox.
2. **Grace period.** Seven days to reach compliance.
3. **Messaging restriction.** Meta limits your ability to send messages.
4. **App-level action.** Under Platform Terms 7.e.ii, Meta may suspend or permanently remove your app and account, and remove Platform access, "at any time, including while we investigate," with or without notice.
5. **Account action.** Serious or repeated breaches reach the Instagram account itself.

**If you get restricted, run this in order.** Read the notice and find the named policy, rather than guessing. Switch off auto-send everywhere while you diagnose. Fix the specific behavior, whether that's a dead-end menu, a tag misuse, or a tool holding your password. Reply through the appeal link with what changed, in one paragraph. Then resume at half your previous pace for a week. [Fix suspected automated behavior on Instagram](/blog/how-to-fix-an-action-block-on-instagram) walks the account-level version.

The honest limit is this. Following Meta's policy lowers your risk, but no tool can promise zero risk. Meta can review any account at any time, and its own terms say so. Automated systems misfire, and a clean account sometimes gets caught in a sweep it had nothing to do with. Anyone who guarantees you can't be flagged is overselling. What you control is whether the review finds anything.

## How does SetLuca stay inside Meta's rules?

SetLuca sits in the permitted lane by design. It replies only to people who messaged you first, and it writes each reply the way you write. Auto-send is on by default on every channel, and you can switch any channel to review.

So, is Instagram DM automation allowed? Yes, on the official API, inside the windows, with disclosure and a human on hand.

SetLuca's design maps to the policy point for point. Inbound chats keep the 24-hour window open, and SetLuca answers your DMs instead of cold-messaging strangers. It also solves the awkward part of Step 3. Once the window has closed, SetLuca hands that follow-up to you instead of sending it. HUMAN_AGENT requires that a human wrote it.

Warming a newer account still helps your behavior look human. Read [Instagram account warm-up](/blog/instagram-account-warm-up) for the pacing, and [can you get banned for Instagram automation](/blog/can-you-get-banned-for-instagram-automation) for the honest risk picture. When you're ready to run it inside these limits, see [SetLuca's pricing](/pricing).


## FAQ

### Is Instagram DM automation allowed?

Yes. Meta permits automated Instagram DMs through its official Instagram Messaging API, available to professional accounts. The Meta business messaging automation policy frames automation as a tool for timely replies to people who contacted you. It bans unofficial bots that log in with your password and cold outreach to strangers.

### Can Instagram accounts send automated messages?

Yes, professional accounts can. Meta opens the Instagram Messaging API to business and creator accounts, and automated replies may answer anyone who messaged, commented or clicked first, inside the 24-hour window (developers.facebook.com). Personal accounts get no API access, and bots that log in with your password break Meta's Platform Terms.

### Is ManyChat allowed on Instagram?

Yes. ManyChat describes itself as an Official Meta Business Partner (manychat.com, checked October 26, 2026), so it works through Meta's approved API rather than your password. The same limits still apply: replies only to people who messaged, commented or clicked first, inside the window, with disclosure. Your flows decide whether you stay inside them.

### Does Instagram automation still work in 2026?

Yes. The Instagram Messaging API is live in 2026, and Meta's developer docs still allow automated replies inside the 24-hour window, private replies to comments for 7 days, and the HUMAN_AGENT tag. What changed is message tags: Meta retired most of them, so a bot follow-up after the window closes has no route (developers.facebook.com).

### What is the 24-hour messaging window?

The 24-hour messaging window is Meta's standard rule for most entry points. A business has up to 24 hours to respond to a user-initiated message, including with promotional content. Chats that start from a click-to-DM ad get up to 7 days from the first message. After the window closes, the API returns error code 10, subcode 2018278.

### Can I message someone after the 24-hour window closes?

Yes, through documented channels only. Meta retired most message tags in 2026, leaving HUMAN_AGENT, which lets a real person reply within 7 days, plus CUSTOMER_FEEDBACK. One-time notifications and sponsored messages also remain. What you cannot do is have a bot send promotional follow-ups after the window closes.

### How fast does an automated bot have to reply?

Within 30 seconds. Meta's responsiveness rules say automated bots must respond to any user input within 30 seconds. Input means freeform text, quick replies, CTA buttons, and persistent menu clicks. Miss the bar and Meta notifies the Page and gives 7 days to fix it.

### Do I have to tell people they're talking to automation?

Yes, and three rulebooks say so. Meta requires disclosure at the start of a conversation, after a significant gap, or when a chat moves from a human to a bot. California's SB 1001 requires a "clear, conspicuous" bot disclosure in commercial contexts, and EU AI Act Article 50 applies from 2 August 2026.

### Does GDPR apply to leads I qualify in the DMs?

Yes, if any lead is in the EU or UK. Qualifying answers are personal data, so you need a lawful basis. The European Data Protection Board notes that contract doesn't cover marketing, leaving consent or legitimate interest, and consent must be "freely given, informed, specific and unambiguous."


## Sources

1. [Messenger Platform and IG Messaging API Policy Overview, Meta for Developers](https://developers.facebook.com/docs/messenger-platform/policy/policy-overview/)
2. [Responsiveness Requirements, Meta for Developers](https://developers.facebook.com/docs/messenger-platform/policy/responsiveness/)
3. [Send API Reference (message tags and messaging types), Meta for Developers](https://developers.facebook.com/docs/messenger-platform/reference/send-api/)
4. [Instagram Platform Overview (login options, permissions, Advanced Access, tokens), Meta for Developers](https://developers.facebook.com/docs/instagram-platform/overview/)
5. [Graph API Rate Limiting (Instagram messaging limits), Meta for Developers](https://developers.facebook.com/docs/graph-api/overview/rate-limiting/)
6. [Common Error Codes, Meta for Developers](https://developers.facebook.com/documentation/business-messaging/messenger-platform/error-codes)
7. [Conversation Routing for Instagram, Meta for Developers](https://developers.facebook.com/docs/messenger-platform/instagram/features/conversation-routing)
8. [Meta Platform Terms](https://developers.facebook.com/terms/)
9. [Meta Developer Policies](https://developers.facebook.com/devpolicy/)
10. [Van Buren v. United States, 593 U.S. ___ (2021), Supreme Court of the United States](https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf)
11. [Transparency obligations under Article 50 of the AI Act, European Commission. Retrieved October 17, 2026.](https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act)
12. [California SB 1001 (Bots: disclosure), Business and Professions Code §17941](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1001)
13. [Process personal data lawfully, European Data Protection Board SME Guide. Retrieved October 17, 2026.](https://www.edpb.europa.eu/sme-data-protection-guide/process-personal-data-lawfully_en)
14. [California Consumer Privacy Act (CCPA), California Attorney General. Retrieved October 17, 2026.](https://oag.ca.gov/privacy/ccpa)
15. [NYC Department of Consumer and Worker Protection: "Mamdani Administration Proposes Ban on AI Customer Service Doom Loops" (October 20, 2026; proposed rule on automated customer service systems, not in force). Retrieved October 22, 2026.](https://www.nyc.gov/site/dca/news/072-26/mamdani-administration-proposes-ban-ai-customer-service-doom-loops)
16. [NYC DCWP: Notice of Public Hearing and Opportunity to Comment on Proposed Rules Regarding Automated Customer Service Systems (proposed 6 RCNY 5-312(a): disclosure at the beginning of a covered interaction). Retrieved October 22, 2026.](https://rules.cityofnewyork.us/wp-content/uploads/2026/10/DCWP-NOH-Proposed-Rules-Regarding-Automated-Customer-Service-Systems.pdf)
17. [NYC Rules: Automated Customer Service Systems (proposed rule; comment by date and hearing December 18, 2026). Retrieved October 27, 2026.](https://rules.cityofnewyork.us/rule/automated-customer-service-systems/)
18. [New York State Governor: "Governor Hochul Signs Nation-Leading Legislation to Protect Kids From AI Chatbots and to Ensure Baby Monitor Safety" (October 28, 2026; S.9051B/A.10379C). Retrieved October 29, 2026.](https://www.governor.ny.gov/news/governor-hochul-signs-nation-leading-legislation-protect-kids-ai-chatbots-and-ensure-baby)
19. [New York State Legislature: bill text of A.10379C, same as S.9051B (General Business Law Article 48; section 3 sets the effective date of January 1, 2027). Retrieved October 29, 2026.](https://legislation.nysenate.gov/pdf/bills/2025/A10379C)
20. [New York State Assembly: A10379/S09051 bill actions (signed October 28, 2026, Chapter 368). Retrieved October 29, 2026.](https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=A10379&term=2025&Summary=Y&Actions=Y)

---

Published by SetLuca.