Guides

15 checks before you automate DMs from comments

A pre-flight list for "comment a keyword, get a link" on Instagram: Meta's rules, GDPR basics, and the things that break in practice.

3 min read 2026-10-11 SocialOS

"Comment GUIDE and I'll send it" works only if the guide exists, the message arrives and nobody feels tricked. Go through these 15 checks before the post goes live. Not legal advice.

The promise (1-4)

  1. The thing exists. The guide, checklist or link is published and opens on a phone.
  2. The post says exactly what they get. "The 30-line pack", not "something useful".
  3. One keyword per live post. If two automations share a word, one of them answers the wrong post.
  4. The keyword is easy to type. One word, capitals, no special characters. Accept common misspellings and the local-language version.

Meta's rules (5-10)

  1. One message per comment. A comment allows one private reply, sent within 7 days of the comment. Further messages only after the person replies or taps a button. (Meta developer docs: Private Replies; Messenger Platform send messages.)
  2. The 24-hour window. After they reply or tap, you have 24 hours. No promotional messages after that unless they write again.
  3. Message tags are not for promotion. Coupons, sales and announcements inside tags risk restrictions.
  4. Speed limit. Private replies to post and Reel comments are capped at 750 calls per hour per account. Queue the rest; don't burst.
  5. Opt-out works. "STOP" ends messages at any step and stays honoured.
  6. Say it's automated where the law requires it. At the start of the thread, after a long silence, and when a person hands over to a bot.

The public side (11-12)

  1. Vary the public reply. Three to five different short replies, words not just emoji, no link in the comment.
  2. Mention Message Requests. Messages to people who don't follow you land in Requests: "Sent. Check your DMs or Message Requests."

Data (13-15)

  1. Emails only with a stated purpose. Say in the same message what you'll send, how often, and how to stop. Consent must be "freely given, specific, informed and unambiguous" (GDPR Art. 4(11)).
  2. Keep proof, keep little. Note when and how they agreed; store only what you asked for (GDPR Art. 7(1)).
  3. Leaving is as easy as joining. Withdrawing consent must be as easy as giving it (GDPR Art. 7(3)).

Test before launch

  • Comment from a second account that does not follow you. Did the message arrive? In Inbox or Requests?
  • Tap every button. Do the links open?
  • Send STOP. Does it stop?
  • Check the counts the next day: comments, messages sent, taps, clicks.

Sources

  • Meta for Developers: Instagram Private Replies; Messenger Platform "Send messages" (windows, tags); Graph API rate limiting (messaging rate limits); Messenger Platform policy; Developer Policies (updated 2026-02-03). Read 2026-10-10.
  • Regulation (EU) 2016/679 (GDPR), Art. 4(11), 7(1), 7(3), Recital 32, eur-lex.europa.eu, checked 2026-10-10.
  • Message Requests behaviour for non-followers: Chatfuel documentation (third-party), read 2026-10-10.

Made by SocialOS. Not legal advice.

Keep reading