Instagram automation rules: what Meta actually allows
Instagram permits automated private replies to comments within twenty-four hours, and automated replies inside an open DM conversation for the same period. It does not permit messaging people who never contacted you. Breaking the pattern rules, rather than the technical ones, is what usually gets accounts limited.
- Everything hinges on the customer acting first: a comment or a message.
- The 24-hour window applies to comments and to conversations separately.
- Human agent handover extends the window to seven days for genuine support.
- Volume and repetition patterns matter as much as individual permissions.
The principle behind all of it
Meta's messaging rules across WhatsApp, Messenger and Instagram all rest on one idea: the person has to start the interaction. Everything else follows from it.
On Instagram that means a comment or a direct message from the user opens a window in which you may reply automatically. Outside that window, or without that action, you have no permission to message anybody, no matter how many followers you have or how interested they seem.
Understanding this saves a great deal of time evaluating tools. Any product promising to message your followers, message people who liked a post, or message an audience you uploaded is describing something the platform does not allow. It may work briefly. It ends with a restricted account.
It also explains why the rules change less often than people fear. The underlying principle has been stable for years across all three of Meta's messaging platforms, and the changes that do arrive are usually adjustments to windows and pricing rather than reversals of the principle itself.
What is permitted
| Action | Allowed | Window |
|---|---|---|
| Private reply to a comment | Yes | 24 hours from the comment |
| Public reply to a comment | Yes | No fixed limit |
| Reply inside an open DM thread | Yes | 24 hours from their last message |
| Human agent follow-up | Yes | 7 days, for genuine support |
| Message a follower who never wrote | No | Not available |
| Message an uploaded list | No | Not available |
The human agent allowance is the one most teams do not know about. It exists so that a real support issue needing investigation can be answered after the day has passed, and it is intended for genuine responses rather than marketing.
Note that the public reply and the private reply are separate permissions. Replying publicly under a comment has no fixed window and is simply ordinary account activity. The private reply is the part that is time-bound, and confusing the two leads teams to assume they have longer than they do.
Story mentions and story replies count as the user contacting you, which surprises people. If your audience replies to stories often, that is a permitted messaging opportunity most brands ignore entirely.
What gets accounts restricted
Almost never a single permitted action. Restrictions come from patterns.
- Identical messages at scale. Two thousand people receiving the same sentence within an hour looks exactly like spam, because it usually is.
- High block and report rates. Meta watches what recipients do far more closely than what senders intend.
- Messaging people who plainly did not opt in, for example triggering a catch-all rule on ordinary compliments.
- Link-heavy first messages to accounts with no prior relationship.
The practical defence is to behave like a business rather than a broadcaster. Vary your copy. Trigger on a keyword the person deliberately typed. Deliver what you promised rather than opening with a sales pitch.
Watch your own numbers rather than waiting for a warning. A sudden rise in blocks after a campaign is the earliest signal that a rule is matching people who never asked for anything, and it is far cheaper to fix a keyword than to recover a restricted account.
How Convo360 stays inside the rules
Convo360 only sends a private reply in response to an actual comment, and only within the window Meta allows. There is no mechanism to message followers or upload a list, which is deliberate rather than a missing feature.
Rules are built around keywords the customer chose to type, and a rule for a specific post takes precedence over a catch-all, so a campaign message does not go out to people commenting on an unrelated photograph. Each comment is claimed once, so an enthusiastic commenter is not messaged repeatedly.
Inbound webhooks from Meta are verified against a signature before anything is processed, so a forged request cannot make your account send messages it never received a reason to send. That is a security control rather than a policy one, and it matters for the same reason.
There is one more control worth understanding. Because rules are tied to specific posts, a campaign that ends does not keep messaging people indefinitely. Deactivating the rule stops it immediately, and that is the right thing to do once a promotion has closed rather than leaving old rules running quietly for months.
Practical limits worth planning around
Beyond policy there are rate limits, and they bite during exactly the moment you care about: a post going viral.
Plan for a reel that performs ten times better than expected. A sensible queue, varied copy and a first message that does not depend on being instant for everybody will survive a spike. A design that assumes every comment is answered within one second will not.
It is also worth deciding in advance what happens when the window closes. If somebody comments and you cannot reply within twenty-four hours, that person is gone, and the right response is to improve the automation rather than to look for a way around the rule.
Where WhatsApp differs
Teams often assume the two behave the same way. They do not, in one important respect.
WhatsApp allows you to start a conversation with an approved template message to somebody who has opted in, which Instagram has no equivalent of. That is why most Indian businesses use Instagram to capture interest and WhatsApp to maintain the relationship.
The pattern that follows is the one most brands settle on: Instagram comment automation converts attention into a DM, the DM captures a WhatsApp number with consent, and everything ongoing happens on WhatsApp where you can message again later. The WhatsApp docs cover that side, and Meta's own business messaging policies are the authority on both.
For teams running both channels, keep the messaging consistent. A customer who asked about a product on Instagram and then receives a differently worded WhatsApp message from what appears to be a different brand voice will simply disengage. One knowledge base and one agent personality across both is easier to maintain than two.
Automate Instagram without risking the account
Start free in minutes — no code, no credit card. Bring your own AI keys and pay no per-message markup.
Frequently asked questions
Can I automate replies to Instagram Story mentions?
Yes. A story mention or a reply to your story counts as the user contacting you, which opens the same twenty-four hour window as a direct message. The rules are identical from there.
What is the human agent window for?
It extends the reply window to seven days so a genuine support issue needing investigation can still be answered. It is intended for real responses to real questions, not for marketing follow-ups.
Does a like count as contacting me?
No. Only a comment, a direct message, a story reply or a story mention opens a window. A like gives you no permission to message that person at all.
Are third-party tools that message followers safe?
No. They operate outside the official API, usually by automating the app itself, and accounts using them are regularly restricted. The risk sits with your account rather than with the tool vendor.
How many DMs can I send in a day?
There is no single published number, and rate limits vary with account standing. In practice, sending in response to genuine comments with varied copy stays well within limits even on a reel that performs unusually well.
Related reading
Available across India — see WhatsApp & AI calling automation by state and city.