Instagram comment-to-DM rules that Meta actually enforces

Most problems with Instagram DM automation come from not knowing Meta's rules. A message that “didn't send”, a follow-up that silently failed, an account that got rate-limited: these are usually the rules working as designed.

These rules apply to every tool that uses Instagram's official messaging API: PhysioDesk Funnels, ManyChat, and anything else built on it. Here they are in plain language. The private-reply rules come from Meta’s Private Replies documentation.

Last checked against Meta’s documentation: 6 October 2026.

1. One private reply per comment

When someone comments on your post, your account may send them one direct message in reply to that comment. Meta calls it a private reply. You can't send two, and you can't send it again later.

That's why the first DM should be short and give one clear next step, usually a button.

2. The 7-day window for that reply

The private reply has to be sent within 7 days of the comment. After that, Instagram rejects it. In practice, automation answers within seconds, but this rule matters if you set up an automation on an old post: comments older than a week won't get a DM.

3. The private reply doesn't open a conversation

This one surprises people. Sending a private reply does not give you permission to keep messaging. If the person never responds, that one message is all you get.

The conversation opens when they do something: send a message, tap a quick reply or tap a button. That's why good comment-to-DM setups put a button in the first DM. Tapping it is the person saying “yes, continue”.

4. The 24-hour messaging window

Once the person has responded, you can send messages for 24 hours from their last message or tap. Each new response from them restarts the clock. After 24 hours of silence, automated messages stop being allowed until they write again.

So “follow up in three days with a discount” isn't something automation can do on Instagram. The follow-up has to come within the window, or wait for them.

5. Hourly sending limits

Meta rate-limits how many messages an account can send through its API, and the published limits change from time to time (see Meta’s rate-limiting documentation). A viral Reel can produce hundreds of matching comments an hour, so a careful tool paces itself instead of hammering the API. PhysioDesk Funnels deliberately caps automated DMs at 190 an hour per account, well inside Meta’s limits, and logs anything it skipped so you can see it happened.

6. Buttons and quick replies have short labels

Button and quick-reply labels can be at most 20 characters. “Send me the details” fits. “Click here to receive your free guide” doesn't, and Instagram rejects the whole message, not just the label.

There's also a practical difference between the two:

• Quick replies float above the keyboard and disappear as soon as the person types anything else.
• Button messages stay attached to the message in the chat, so people can tap them later.

7. Only reply to people who reached out

Automation may only message people who commented on your post or messaged you. Buying lists, messaging followers of other accounts, or “DM everyone who liked my post” isn't possible through the official API, and tools that do it by logging in as you break Instagram's terms.

8. Professional accounts only

The messaging API works with Instagram Business and Creator accounts. Personal accounts can't use it.

What gets accounts into trouble

Restrictions usually come from the same few habits:

• Identical public replies under hundreds of comments (rotate a few variations).
• Tools that ask for your Instagram password instead of using Instagram's login screen.
• Messaging people who didn't interact with you.
• Sending links that Instagram considers spammy, such as shortened links that hide the destination.

The short version

One DM per comment, within 7 days. Put a button in it. Once they tap, you have 24 hours. Pace your sending instead of blasting replies, and only message people who reached out first. Follow those rules and comment-to-DM automation is safe to run on any Business or Creator account.

Want to set this up? Here's the step-by-step guide.