What Instagram actually allows a comment-to-DM tool to do
In short
Comment-to-DM automation is four Meta primitives with hard limits: one private reply per comment, sendable within seven days of it, a 24-hour window for anything after that, and a follow-status field that errors until the person has interacted with the account. Every tool in this category is built on the same four, whatever their pricing pages say.
“Comment the word and I’ll DM you the link” is now a format rather than a tactic, and there are a dozen tools that will run it for you. They all sit on the same four Meta primitives, and those primitives have limits that decide what any of them can and cannot do.
How does comment-to-DM actually work?
| Step | What happens |
|---|---|
| Detect the comment | A comments webhook fires with the comment id, its text, who wrote it and which media it was on |
| Send the DM | A private reply: a message addressed to the comment id rather than to a person |
| Reply in public | An ordinary comment reply — the “check your DMs” line under the post |
| Check the follow | A user-profile field, is_user_follow_business, that says whether they follow the account |
The private reply is the whole mechanism. It is the one message Instagram lets a business send to somebody who has never messaged it, and the permission to send it is granted by the fact that they commented — which is also why there is exactly one of them.
Is Instagram DM automation allowed?
Yes, through the official API, with the permissions Meta grants for it after review. What is not allowed is the other kind of automation — a tool that logs into the account and taps the interface on your behalf. The first is a documented product surface; the second is a way to lose the account.
Meta’s private replies documentation names the permissions for the Facebook Login path — instagram_manage_comments and pages_messaging. The newer Instagram Login path uses its own pair, instagram_business_manage_comments and instagram_business_manage_messages. Same feature, different authentication story, and a tool has to hold one pair or the other.
How many DMs can a tool send per comment?
One, and it must be sent within seven days of the comment. Meta’s documentation is explicit: “Only one message can be sent to the Instagram user who commented.” There is no second nudge, no follow-up sequence, and no retry a week later.
Anything after that first message depends on the person answering it — which is what the next limit is about.
| Limit | Value | What it means in practice |
|---|---|---|
| Private replies per comment | 1 | One shot at the link |
| Time to send it | 7 days from the comment | Late automation is no automation |
| Messaging window after their last interaction | 24 hours | A flow that needs three messages needs three interactions |
| Private replies per account | 750 per hour | A reel that takes off will hit this, so the queue has to throttle |
Can a tool tell whether somebody followed you?
Only after they have interacted with the account. is_user_follow_business returns an error until the person has messaged the business, tapped a button, or used the persistent menu. A commenter who never touches the DM is invisible: there is no way to know whether they followed, and no way to find out by asking Instagram.
This is the constraint that shapes every “follow me first” flow. The follow cannot be checked before the first message, because the check needs consent that the first message is what earns. So the gate has to be a tap inside the DM, and the tap is what unlocks both the check and the 24-hour window.
The flag also lags the follow itself by a few seconds. In a live thread captured on 20 September 2026, the first check returned false for somebody who had already followed. A flow that fails a person on one reading is a flow that will accuse real followers of lying to it.
Can a private reply carry a button?
Meta’s documentation shows only a text body, which reads as though it cannot. Observed behaviour says otherwise: a live private-reply thread — the one that opens with “messaged you about a comment you made on their post” — carried a button in its very first bubble, as a button template rather than quick replies.
The distinction matters. Quick replies are dismissed the moment they are tapped; template buttons stay in the thread afterwards, so a person can come back to the message and the link is still there. And a tapped button is a documented interaction, which is exactly what the follow check needs.
What this means if you are choosing a tool
- Ask what happens when somebody comments on day eight. The private reply is no longer available. A tool that silently drops those is losing leads; one that tells you is worth more.
- Ask how the follow gate behaves when the flag says no. If it refuses the link outright, it will refuse real followers, because the flag lags.
- Ask what happens on a reel that takes off. At 750 private replies an hour per account, a viral post is a queue, and how it is drained is a product decision rather than an accident.
- Ask whether it uses the official API. Anything that needs your password is not using it.
- Ask what it does with the comment text. A keyword rule that matches inside other words will answer a comment that was not asking for anything.
Pullsy’s version of this is built against the same four primitives and is waiting on App Review. In the meantime, the account data behind it — every comment’s post, its reach, and what the people who arrived actually did — is what the Instagram connector already collects.
Questions people ask
Is Instagram comment-to-DM automation against the rules?
Not through the official API. Meta provides private replies for exactly this and grants the permissions after review. Automation that drives the app by logging in as you is a different thing, and it does put the account at risk.
How many DMs can be sent per comment?
One. Meta’s documentation states that only one message can be sent to the user who commented, and it must be sent within seven days of the comment. Further messages require the person to reply or tap something first.
How long does a tool have to reply to a comment?
Seven days from when the comment was created, for posts, ads posts and reels. Private replies to comments on a live broadcast are narrower still — they can only be sent during the broadcast.
Can a tool require a follow before sending the link?
It can ask, and it can verify — but only after the person interacts with the DM, because the follow-status field errors until then. Any tool that claims to check the follow before sending anything is describing something the API does not offer.
Is ManyChat safe for Instagram?
Tools built on Meta’s official messaging permissions operate inside the platform’s own rules; the risk sits with tools that automate the app itself. The test worth applying to any of them is whether they ask you to authorise through Instagram or to hand over a password.
What happens if a post gets thousands of comments at once?
The account limit is 750 private replies an hour, so a viral post creates a queue. What the tool does with the overflow — delay, drop, or tell you — is a design decision, and worth asking about before a reel makes it your problem.
Sources
- Meta — Instagram private replies — One message per commenter, the seven-day limit, the live-broadcast exception and the permissions required
- Meta — Instagram user profile API — is_user_follow_business, and the interaction required before it can be read
- Meta — Messenger Platform policy overview — The 24-hour messaging window and the HUMAN_AGENT tag
- Meta — Instagram Platform webhooks — The comments, messaging_postbacks and messaging_seen subscriptions behind the flow
Read next
- Where your Instagram insights wentInstagram keeps account metrics for about 90 days, serves post insights only as a running total, and stops serving a story after 24 hours. What that costs you.
- Instagram story insights: navigation, forward, back and exits explainedWhat navigation, forward, back, next story and exits mean in your Instagram story insights, which ones are good news, and when the numbers appear and disappear.