ReachleeInstagram automation rules in 2026:
what's allowed, what gets you restricted
Automation on Instagram isn't a grey area — Meta builds the API for it and publishes the rules in its developer documentation. This page collects those rules in one place, with the source for each, and separates them from the unofficial automation that actually gets accounts restricted.
The answer, in 100 words
Instagram automation is allowed. Meta builds and documents an official Instagram API for exactly this, and publishes the rules that govern it. What gets accounts restricted is the other kind of automation: unofficial tools that take your password, log in as you, and script the app — auto-follow, auto-like, mass cold DMs. On the official API, four rules bind you: you can never message someone first; free-form DMs only inside 24 hours of that person's last message to you; exactly one private reply per comment, within 7 days; and documented rate limits (750 private replies per hour per account). Stay inside those and there is nothing to be banned for.
Rule 1 — you can never make first contact
This is the rule that defines the whole category, and it's the one most people don't know exists. Meta's Instagram messaging documentation states that conversations only begin when an Instagram user sends a message to the business — through a DM, a story reply, a story reaction, or a story mention. An app acting for a business cannot open a thread with someone who hasn't reached out. This isn't a setting a tool can toggle; it's how the API is built, so a compliant tool physically cannot cold-DM a stranger. The single earned exception is the private reply: if someone comments on your post or reel, you may DM them once in response (Rule 3). Every legitimate Instagram automation funnel is therefore reactive by construction — the user always acts first.
- Actions by the user that open a conversation: a DM to the business, a story reply, a story reaction, a story mention
- Actions that do NOT open a conversation: a comment on your post by itself, a like, a follow, or a tap on a web link
- There is no 'warm-up', 'volume ramp' or 'sending schedule' that makes cold DMs compliant — the constraint is permission, not pace
- Any product advertising cold outreach to non-engaged users on Instagram is not running on the official Messaging API
Rule 2 — the 24-hour messaging window (and the 7-day exception)
Meta's documentation puts it plainly: 'Your app has 24 hours to respond to any message sent from an Instagram user to your app user.' Once a user takes a messageable action, the business may send free-form messages — text, links, media it owns — for 24 hours. Each new user message, story reply, story reaction, or story mention resets the clock. Outside the window, promotional content is not allowed at all, and the only sanctioned path is the HUMAN_AGENT message tag, which extends the response window to 7 days. Two things about that exception get misrepresented constantly: it requires explicit approval through Meta App Review, and it exists for human escalation of a support conversation — not for running automated campaigns at people whose window closed.
- 24 hours runs from the user's last messageable action, not from your last send
- The HUMAN_AGENT tag extends to 7 days, needs Meta App Review approval, and is intended for a human replying — not an automation
- A private reply to a comment does not open a 24-hour window; it's a one-shot (see Rule 3)
- Other content constraints from the same doc: 1,000 bytes of UTF-8 maximum per text message, no group messaging, and media you send must be owned by the business account
- The compliant way to keep talking to someone past 24 hours is to capture a channel you own — an email or phone number — inside the window
Rule 3 — one private reply per comment, within 7 days
Private replies are the mechanism behind every 'comment a keyword and I'll DM you' funnel: the API lets a business DM someone who commented on its post or reel. Meta's rules here are narrow and absolute. You get exactly one private reply per comment — ever. It must be sent within 7 days of the comment's creation for posts and reels; for comments on a live broadcast, replies are only possible while the broadcast is live. And the cap is 750 private replies per hour per Instagram professional account. This is why a well-built tool refuses to DM the same comment twice, and why comments older than a week silently stop converting — that isn't a bug, it's compliance. Reachlee claims each comment ID in a durable registry before every send and runs an internal ceiling of 600 replies/hour under Meta's 750 to keep headroom.
- One private reply per comment, ever — a Meta rule, not a tool limitation
- 7 days from comment creation for posts and reels; live-broadcast comments only during the broadcast
- 750 private replies per hour per Instagram professional account (Meta's documented cap)
- Deleting and re-posting your own comment does not reset anything on your side — the reply is spent against that comment ID
- Any tool claiming it can re-DM the same commenter or reach month-old comments is either mistaken or not using the official API
Rule 4 — the rate limits, and what a soft clamp looks like
| Limit or signal | Documented value | What it looks like in practice |
|---|---|---|
| Send API — text, links, reactions, stickers | Up to 300 calls/second per Instagram professional account (some Meta doc tables list 100/sec — treat 100 as the conservative reading) | Never the binding constraint. Policy rules cap who you may message long before throughput does. |
| Send API — audio / video messages | 10 calls/second per Instagram professional account | Rich-media sequences pace slower than text; a good tool queues rather than fails. |
| Private replies (post / reel comments) | 750 calls/hour per Instagram professional account | The real ceiling on a viral post. Reachlee holds live sends to 600/hour for headroom. |
| Private replies (live comments) | 100 calls/second, during the broadcast only | Ends the moment the stream ends — no catching up afterwards. |
| Conversations API (reading threads) | 2 calls/second per Instagram professional account | Why inbox sync in any tool is polled and batched, not instant. |
| Instagram platform total (Business Use Case) | Calls within 24 hours = 4,800 × number of impressions (impressions floor of 10) | Small accounts have small budgets — the same automation is safer on a bigger account. |
| Per-app platform tier | Calls within one hour = 200 × number of daily active users of the app | A shared budget across the tool's whole customer base — your tool's engineering matters. |
| Throttle signals in every response | X-App-Usage (percentages, throttling at 100) and X-Business-Use-Case-Usage (includes estimated_time_to_regain_access, in minutes) | Compliant tools read these on every call and pause before they get pushed. |
| Documented rate-limit errors | Codes 4 (app), 17 (user token), 32 (Pages), 613 (custom), 80002 (Instagram BUC), 80006 (Messenger BUC) | A recoverable stop: wait out the estimate, then resume. |
| The soft clamp (undocumented) | Error 368 / subcode 1404169 (policy block) and subcode 1772111 ('too spammy' comment replies) — no recovery estimate published | The real ceiling. No header tells you when it lifts; retrying makes it worse. Reachlee pauses the account 24 hours on a policy block. |
Documented values as of August 2026, from Meta's Graph API rate-limiting reference (linked in Sources) — Meta can change them at any time. Notice what's absent: there is no "DMs per day" row, because Meta doesn't define one. Daily-cap figures you see elsewhere are inferred, self-imposed by tools, or describe manual sending. The bottom two rows are the ones no vendor marketing mentions.
The fifth rule most tools quietly skip: bot disclosure
Meta's policy for automated experiences asks businesses to disclose the non-human nature of the conversation — at the beginning of a thread, after a significant lapse of time, or when a chat moves from a human to an automated experience — with special attention called out for users in California and Germany. Enforcement is uneven and most tools in this category do not prepend a disclosure by default, which is why you'll rarely see it discussed. We're stating it anyway, because the honest version of a compliance page includes the rule you might be breaking without knowing. If you operate in a jurisdiction with chatbot-disclosure law, or you're about to submit an app for Meta App Review, treat disclosure as a requirement rather than a nicety, and check whether your tool can add it.
What actually gets Instagram accounts restricted
Password-based tools that log in as you
The single biggest cause of automation bans. These tools ask for your Instagram username and password (not an OAuth authorization) and drive the app or a private endpoint as if they were you. Because they aren't going through the official API, they aren't subject to API rate limits — they're subject to Instagram's anti-bot systems instead, which respond with checkpoints, action blocks, and account bans. The risk lands on your account, not the vendor's.
Auto-follow, auto-unfollow, auto-like, auto-comment
None of these exist in the official Instagram API for a business acting on itself. If a tool offers mass follow/unfollow cycles, automated liking, or automated commenting on other people's posts, it is by definition doing it unofficially — scripted browser sessions or reverse-engineered endpoints. This is engagement-farming behaviour Meta's Community Standards treat as inauthentic, and it's the classic path to an action block.
Cold DM blasts and off-window promotion
Messaging people who never contacted you is not possible on the official API and not permitted by policy. Sending promotional content outside the 24-hour window without an applicable message tag is explicitly not allowed. On the official API these attempts fail as errors; off the official API they succeed for a while and then cost you the account.
Bought engagement, fake followers, and scraped audiences
Purchased followers, likes, or comment engagement, and DM lists built by scraping profiles, sit under Meta's inauthentic-behaviour policies rather than the API rules — but they end the same way. They also poison the one metric that governs your API budget: the Instagram platform limit is a function of your real impressions, so fake reach buys you no headroom.
How to tell whether a tool is compliant — the six-point check
You don't need to read Meta's docs to vet a tool; you need to check six things, and every one of them is visible before you pay. A tool that passes all six cannot put your account at risk through the automation itself, because the API won't let it. A tool that fails even one — especially the first two — is asking you to bet your account on their marketing copy.
- 1. Official API, stated plainly: the vendor names Meta's Instagram API / Instagram Messaging API. Vague 'we automate Instagram' with no API mention is a red flag.
- 2. OAuth via Instagram Business Login — you authorize on Instagram's own login page and can revoke access from your Instagram settings. If it asks for your password, stop.
- 3. It cannot first-contact by design: ask the vendor directly whether the tool can DM someone who never engaged. 'Yes' means it isn't on the official API.
- 4. Meta app verification: Business Verification, Tech Provider access verification, and App Review approval for each permission used. Ask which of the three they hold. (Reachlee holds all three.)
- 5. It talks about limits without flinching: one reply per comment, the 7-day comment window, the 24-hour messaging window, backoff on rate limits. Tools that market 'unlimited DMs' with no mention of policy limits are describing something else.
- 6. Pauses are visible and explained: a compliant tool sometimes defers sends and tells you why. Silence plus perfect throughput means nobody is reading Meta's usage headers.
'Is Instagram automation allowed?' is the wrong question, and it's why the answers online contradict each other. Meta publishes an official Instagram API, documents the rules for automated messaging, and reviews the apps that use it — so automation on that API is not merely tolerated, it's specified. The behaviour that gets accounts restricted is unofficial automation: password-based logins, auto-follow and auto-like bots, cold DM blasts, bought engagement. The four binding rules are narrow but knowable — never first contact, 24-hour window, one private reply per comment within 7 days, documented rate limits with an undocumented soft clamp behind them. Pick a tool that can recite all four back to you and the ban question stops being a question.
Instagram automation rules — FAQ
Is Instagram automation against Instagram's terms of service?
Not when it runs on Meta's official Instagram API. Meta publishes the API, the permissions, the messaging rules, and the rate limits, and reviews each app before granting messaging access — automation built that way is doing exactly what the platform documents. What does violate the terms is unauthorized automated access: tools that take your password and log in as you, scripted browser sessions, scraped data, and reverse-engineered private endpoints. So the answer depends entirely on which kind of tool you're using, which is why the internet disagrees about it.
Can I get banned for automating Instagram DMs?
Through an official-API tool, the automation itself cannot get you banned — the API refuses the actions that break the rules. It won't let you message someone who never contacted you, won't let you send free-form DMs outside the 24-hour window, and won't let you reply to the same comment twice. The bans people describe online come from unofficial tools: password-based bots that Instagram's anti-spam systems detect and answer with checkpoints, action blocks, or account removal. Your content can still get you in trouble on any tool — spammy, misleading, or policy-violating messages are your responsibility regardless of the pipe.
What Instagram automation is allowed in 2026, exactly?
Replying, not reaching out. Allowed on the official API: DMing someone who commented on your post or reel (one private reply per comment, within 7 days), replying to inbound DMs, replying to story replies, story reactions and story mentions, sending free-form messages within 24 hours of the user's last message, and using approved message tags such as HUMAN_AGENT (7 days, App Review required) for human escalation. Not available: cold DMs to people who haven't engaged, auto-follow or auto-unfollow, auto-liking, auto-commenting on other accounts' posts, and promotional messages outside the 24-hour window without a tag.
Is auto-following, auto-liking, or auto-commenting allowed?
No, and it isn't a policy judgement call — those actions don't exist in the official Instagram API for a business automating its own account. Any tool that offers mass follow/unfollow cycles, automated likes, or automated comments on other people's content is doing it through unofficial means, which is precisely the behaviour Instagram's anti-spam systems and Meta's inauthentic-behaviour policies target. Practical consequence: the feature list is the tell. A tool advertising auto-follow alongside DM automation is not an official-API tool, whatever its homepage says.
Can automation DM someone who never messaged me first?
No. Meta's messaging documentation states that conversations only begin when the Instagram user messages the business — via a DM, story reply, story reaction, or story mention. A business cannot initiate. The one earned exception is the private reply: someone comments on your post or reel and you may send them exactly one DM in response, within 7 days of the comment. That single reply doesn't open a 24-hour conversation window either — if you want to keep talking, they have to reply to you. Every compliant Instagram funnel is built on that sequence.
Do I need Meta App Review to automate my own Instagram account?
You don't — your tool's developer does. App Review approves the Instagram permissions an app uses (messaging, comment management, and so on) before it can act for any business, and specific capabilities like the HUMAN_AGENT message tag need their own approval. As a customer, your job is to check that the tool has been through it: ask whether the vendor holds Meta Business Verification, Tech Provider access verification, and App Review approval for the permissions it uses. Your own side of the connection is an OAuth authorization through Instagram Business Login, revocable from your Instagram settings at any time.
Do I have to disclose that a DM is automated?
Meta's policy for automated experiences asks you to disclose the non-human nature of the conversation — at the start of a thread, after a significant lapse of time, or when a conversation moves from a human to an automated experience — and calls out California and Germany for special attention. Enforcement is uneven and most tools in this category don't prepend a disclosure by default, so in practice it's the most-ignored rule on this page. If you're in a jurisdiction with chatbot-disclosure law, or preparing for App Review, treat it as required: add a line like 'automated reply' to your first message and keep the option available in your tool.
What happens when a tool breaks one of these rules?
There's a ladder. First, documented rate limiting: usage headers climb, then Meta returns errors (codes 4, 17, 32, 613, 80002, 80006) with estimated_time_to_regain_access in minutes — a compliant tool pauses and waits it out. Push past that and you reach the soft clamp: policy blocks such as error 368 with subcode 1404169, or subcode 1772111 for comment replies Meta considers too spammy, both arriving with no recovery estimate at all. Sustained violations put the tool's own app at risk with Meta, which is why serious vendors ship circuit breakers. For unofficial tools there's no ladder — the consequence lands directly on your Instagram account.
Automation that can't break the rules
Reachlee runs entirely on Meta's official Instagram API as a Meta-verified Tech Provider: no password sharing, no first contact, one reply per comment enforced durably, 24-hour window checked before every send, and automatic backoff when Meta's usage headers climb. Free plan includes 1,000 DMs a month; Pro is $9/mo flat.
Start free
Instagram