BlogPlatform rules and limits
Is Instagram DM automation allowed? What Meta's rules say
Yes, if it runs through Meta's official API. The tools that get accounts limited are the ones that log in with your password and act like a person, very fast.
The short answer
Instagram DM automation is allowed when it runs through Meta's official Instagram API: Meta built private replies so a business can DM someone who commented, and its Developer Policies cover the Instagram Messaging API. What Instagram forbids is automated access "without our express permission", which is what tools that take your password do. Inside the API, the rules are: only message people who reached out first, stop when they ask, and do not spam.
Facts as of November 2, 2026
Two kinds of automation
| Official API (comment to DM, auto-replies) | Password or browser bots | |
|---|---|---|
| How it connects | You sign in with Instagram and approve the app | You hand over your username and password |
| Who it can DM | People who commented, messaged or replied to a story | Anyone, including people who never reached out |
| Meta's position | Covered by the Meta Platform Terms and Developer Policies | "you shouldn't use these apps" |
| What Meta warns | The same spam rules as any account: no very high frequency, no repeated content | Parts of the account limited, or the account disabled |
SourcesInstagram Terms of UseInstagram Help Center: apps that ask for your login
What Instagram's terms say
The Terms of Use rule out automated access "This includes creating accounts or accessing or collecting information in an automated way without our express permission". The official API is that permission: "your use of our API is subject to our Meta Platform Terms and Developer Policies."
About password tools, Instagram's Help Center is blunt: "If you give these apps your login information, whether with an access token or by giving them your username and password, they can gain complete access to your account." And: "Accounts that continue to use non-Instagram apps to get more followers may notice that certain parts of their Instagram account are limited."
SourcesInstagram Terms of UseInstagram Help Center: apps that ask for your login
The rules for automated DMs
"Our Developer Policies apply to Messenger Platform and Instagram Messaging API". These are the ones a comment-to-DM tool lives by:
- People reach out first. "Conversations only begin when an Instagram user sends a message to your app user through your app user's Instagram Feed, posts, story mentions, and other channels." A comment with your keyword counts; a cold DM does not.
- Consent: "Don't contact people in Messenger or Instagram Messaging unless you, or the party to whom you are operating as a Service Provider, have obtained legally sufficient consent, permission, and/or opt-in".
- Opt-out: "Immediately respect all requests (on or off Messenger and Instagram Messaging) by people to block, discontinue, or otherwise opt out of the messaging functionality."
- No tricks: "Don't confuse, deceive, defraud, mislead, spam or surprise anyone."
- One DM per comment, within 7 days, and the next one only after they answer.
SourcesMeta for Developers: Messenger Platform policy overviewMeta Developer PoliciesMeta for Developers: Instagram Messaging API
Do you have to say it is a bot?
Where the law asks for it, yes: "When required by applicable law, automated chat experiences must disclose that a person is interacting with an automated service", at the start of the conversation. Meta names California and Germany. Everywhere else it is advice: "Even where not legally required, we recommend informing users when they're interacting with an automated chat as best practice".
A short line works: "Automated reply from @yourbrand. Reply HUMAN to reach the team."
SourcesMeta for Developers: Messenger Platform policy overview
What gets accounts limited
Meta's spam rules are about speed and sameness, not about automation itself. They forbid "Posting, sharing, engaging with content or creating accounts, Groups, Pages, Events or other assets, either manually or automatically, at very high frequencies." They also allow limits at lower speeds when other signs of spam show up, such as the same content again and again.
So a comment-to-DM reply to someone who asked for it is fine. Blasting the same link at hundreds of strangers, by hand or by bot, is not.
How Postkey stays inside the rules
- It connects through Meta's official Instagram API. You sign in with Instagram; Postkey never sees your password.
- It only messages people who commented, messaged or replied to a story, and only as often as Meta allows.
- It is the most agentic DM automation tool, and the agent works inside the same rules: switching on an automation waits for your yes.
Questions
Is ManyChat-style comment to DM against Instagram's rules?
No. Meta's API has private replies for exactly this: one DM to someone who commented, within 7 days. Tools that use the official API are following Meta's rules.
Can Instagram ban you for using DM automation?
Using the official API within its rules is what Meta built it for. Instagram warns that accounts using apps that take your login may be limited or disabled, and its spam rules apply to anyone acting at very high frequency.
Can I automate DMs to people who never messaged me?
Not on the official API. Conversations start with the person: a DM, a comment, a story reply or an ad click.
Do I need to tell people the DM is automated?
Where the law requires it, yes, at the start of the conversation. Meta recommends it everywhere.
Is Postkey allowed by Instagram?
Yes. Postkey connects through Meta's official Instagram API: you sign in with Instagram, it never sees your password, and it only messages people who commented, messaged or replied to a story.
