An Instagram DM bot is software that sends direct messages for you when someone comments, replies to a story or messages you a keyword. Instagram allows the kind that connects through its own login screen and answers people who contacted you first. Instagram prohibits the kind that asks for your password and acts as you.

The word "bot" covers both, which is why one person can say bots are fine and another can say they get accounts banned, and both can be right. This page is about telling the two apart. The full rulebook is in is Instagram DM automation allowed, and the chain from a comment to a reply is in how Instagram DM automation works. Everything below was read on Instagram's Help Center and Meta's developer pages on 12 October 2026.

What does a DM bot do?

A DM bot waits for one of three starting points, then sends the message you wrote. The starting points are a comment containing your keyword on a post or reel, a reply to your story, and a direct message containing a keyword. Each one is something the other person did first, and the bot answers it.

What goes out is whatever you wrote: text, plus link buttons, up to three in one message. The bot decides nothing about who to message or when. It is a faster pair of hands for replies you would send anyway.

Are Instagram DM bots allowed?

Yes for the kind that runs on Instagram's official tools, and no for the kind that logs in as you. The rule against the second kind is written down in three places.

  • Instagram's Terms of Use. They say nobody may access or collect information in an automated way without Instagram's express permission, whether or not they are logged in. They also bar asking for or collecting other people's Instagram usernames and passwords.
  • Meta's Platform Terms. Section 6, last updated 3 February 2026, tells developers they may use Meta's login to sign people in but may not separately request or collect login credentials.
  • Instagram's Help Center. It warns that handing your login details to a third-party app can give that app complete access to your account, including your private messages.

The permitted route works differently. Instagram's tools for apps serve professional accounts, Business or Creator. The account owner signs in on Instagram's own screen, Instagram opens a window listing the permissions the app is asking for, and the owner approves them there. Meta's terms forbid the app from collecting the password on the side.

How can you tell an official bot from one that logs in as you?

Look at how it connects. An official bot sends you to Instagram's own screen to approve it, and a login-based bot asks you to type your Instagram password into its own form. Five checks, in the order you meet them:

  1. The sign-in. You land on an Instagram page that lists what you are allowing. If the tool asks for your password, stop there.
  2. The account type. Instagram's tools for apps serve Business and Creator accounts, and you switch in Instagram's settings. A tool that promises to automate a personal account is working some other way.
  3. The promise. Official bots reply to people who commented, replied to a story or messaged you. A tool that offers to message a list of strangers, or everyone who follows you, is describing something Instagram's official tools do not offer.
  4. The list afterwards. An app connected the official way shows up in Instagram under Profile, Menu, Your app and media, Website permissions, Apps and websites, Active, with a Remove button beside it.
  5. The badge, which is not a test. An approved Meta Tech Provider has passed Meta's review for the permissions it holds. That is vetting, not endorsement, so run the first four checks anyway.

For what each permission lets an app do once you approve it, is it safe to connect Instagram goes through them one by one.

What happens to an account that uses the wrong kind?

Instagram's Help Center says an account can be restricted and flagged for review when its systems see automated access without permission, or when the owner gave a username and password to a third-party app. For apps that trade likes or followers for login details it goes further: Instagram may remove the engagement they created, may limit parts of the account, and says the account may be disabled or terminated.

The fix Instagram gives is to remove the app under Apps and websites and change your password. In the pages we read, Instagram does not say how it detects these tools. Its Help Center says only that dedicated teams look for and block patterns linked to scraping. Treat any precise list of detection signals, especially one with numbers in it, as a guess and not a rule.

How do Instagram bot DMs reach the person who commented?

Meta's developer documentation says a private reply appears in the person's inbox if they follow your account, and in their Requests folder if they do not. A bot DM to a non-follower is therefore delivered but easy to miss. Say "check your message requests" in the public reply or the caption, and read where Instagram message requests go to see where to look.

Instagram also tells everyone, on its Help Center page about sending messages, that the accounts they message may use third-party apps or automated services. Automated replies are a known part of Instagram.

Does an Instagram bot message have to say it is automatic?

Where the law requires it, yes. Meta's developer rules say an automated chat must disclose that a person is talking to an automated service, at the start of a conversation, after a long gap, and when a chat moves from a person to a bot. They name California and Germany as places to pay particular attention, and they recommend telling people everywhere as good practice.

One short line covers it: "This is an automatic reply, and I follow up myself." Write the second half only if it is true.

What can a DM bot send, and what can it not?

Inside Instagram's rules a bot can send text and up to three link buttons in one message, to people who commented, replied to your story or messaged you. These limits shape everything else:

  • One private reply per comment, within 7 days of the comment. Meta's private replies page says the same on both counts.
  • Follow-ups only if the person answers. After a private reply, further messages can go out only if the person responds, and within 24 hours of that response.
  • About 750 private replies an hour per account. That is Meta's cap for replies to comments on posts and reels.
  • 1,000 bytes of text in a message. Emoji and non-Latin letters use more than one byte each, so a message full of them runs out sooner.
  • No messages to people who never contacted you. Instagram's official tools are built around replying, so there is no list and no cold outreach.
  • No message to someone for following you. ManyChat runs a Follow to DM beta, and its Help Center says Meta decides which accounts are eligible. Tools built on the public API cannot do it.

Where this stops working

A bot only answers. It cannot reach people who have never contacted you, it cannot make a post that people comment on, and it cannot fix an offer nobody wants. Three things we could not verify, so we left them out: how Instagram detects login-based tools, how often accounts that use them are restricted, and anything about a particular tool's Meta review beyond what Meta says on its own pages. Meta changes these rules without notice, so read 12 October 2026 as the date this page was true, and open the sources below before relying on a rule that matters.

You can now judge any bot by its sign-in screen, and an official one such as inDM, an approved Meta Tech Provider, needs only Instagram's own login and has every automation type on its Free plan.

Sources

All read on 12 October 2026.