How to Answer Instagram DMs Automatically with AI

Instagram has become a genuine customer service channel almost by accident. Around 150 million people send a DM to a business every month, roughly 350 million business profiles exist on the platform, and 76 percent of people messaging a business expect a reply within 24 hours. Very few businesses staff for that.

At the same time, Instagram has spent the last year making automated messaging harder, deliberately and aggressively. Any guide written before late 2025 is describing a platform that no longer exists. This one covers what is actually possible now: what you may automate, what the limits are, how the setup works, and the specific behaviours that get accounts restricted.

The Constraint That Defines Everything

In October, Meta cut the Instagram Messaging API send ceiling per business account by 96 percent.

The reason for the cut is not subtle. Instagram is fighting automated outreach at scale, and the limit is aimed at bulk senders rather than support teams. The published guidance for staying safe is consistent on the boundary: use the official Meta APIs, respect the rate limits, and only message people who contacted you first.

For a support bot, 200 messages an hour is workable. That is roughly 4,800 a day, and support conversations are bursty rather than uniform, so the real constraint is peak-hour concurrency rather than daily volume. Two design consequences follow immediately, and they matter:

• Queue and pace your sends. A burst that hits the ceiling produces errors, and errors on this platform are noticed. Enforce your own send rate below the limit rather than discovering the limit in production.
• Never poll. Webhooks are mandatory in practice, not merely recommended. Polling for new messages burns the same call budget you need for replying, and it is exactly the pattern the abuse detection is tuned to see.

There is a further point worth taking seriously. Reporting on the 2026 enforcement wave notes that the detection looks at how you send, not only how much: uniform intervals, identical message bodies, and outbound-first patterns all read as automation abuse regardless of volume. Reactive support traffic naturally looks nothing like that, which is the main reason support bots are safe on this channel and outreach bots are not.

What You Are Allowed to Automate

The rule that makes everything else legible is that the customer has to message you first. Their message opens a 24 hour window, and inside that window your app can reply automatically. Outside it, the ordinary send path is closed and only a human agent can reply, within seven days, using the human agent path.

That maps onto a clear division:

If your intended use case is anywhere in the bottom three rows, the platform has already decided against it and no tool will fix that.

The Surfaces a DM Can Arrive From

Instagram is less uniform than Messenger, and a bot that assumes every message is a typed question will handle a large fraction of traffic badly. Inbound conversations arrive from at least five places:

• Direct messages, the ordinary case.
• Story replies. These arrive as DMs with the story attached as context. The customer's message is frequently a two-word reaction to something they can see and you cannot infer, which makes "what are you referring to" a legitimate and necessary clarifying question.
• Story mentions. Someone tags your account in their story. Often an endorsement rather than a question.
• Post and Reel shares. A customer sends you a product post and writes "how much". The product is in the attachment, not the text.
• Comment to DM flows. A public comment that moves into a private conversation.

The practical guidance is to detect the shape before answering. A message with an attachment and two words of text is not a question your retrieval system can answer, and a bot that confidently produces a generic answer looks worse than one that asks "which item are you looking at?". Phase one deployments should handle text and ask for clarification on everything else; that is a better experience than pretending.

Setting It Up

Instagram runs through the same Meta app infrastructure as Messenger, which is convenient if you have already done that work and a full detour if you have not.

Step 1. Your Instagram account must be a Business or Creator account, and it must be linked to a Facebook Page. Personal accounts have no messaging API at all.

Step 2. A Meta app with the Instagram product added. If you have already set this up for Messenger automation, it is the same app and the same webhook endpoint. Meta routes both channels through one callback URL and you distinguish them by the payload.

Step 3. Webhook subscription to the messages field on the Instagram object. As with Messenger, your endpoint must respond 200 OK within five seconds. Acknowledge first, process on a queue, reply from a worker. On Instagram this is doubly important because the alternative, polling, is both wasteful and risky.

Step 4. App Review for the Instagram messaging permission. You will need a screencast of the whole flow, a privacy policy URL, and a description of the use. Until it is approved, the app runs in Development Mode and only accounts added as testers can use it, which is enough to build against.

Step 5. Connect the account. Through a platform this is one OAuth flow: authorise, select the Page, and the linked Instagram Business account is detected automatically. In Paperchat this sits in the chatbot's Channels section, and the resulting connection stores the page token encrypted and subscribes the account to the webhook without further configuration.

Design Notes Specific to Instagram

Four things differ enough from web chat and from Messenger to be worth designing for.

The audience skews towards pre-purchase. Instagram DMs are disproportionately "do you ship to Ireland", "is this back in stock", "how much is the large one". This is a sales channel wearing support clothing, and the highest-value automation is inventory, shipping, sizing, and price questions answered instantly. DM-driven commerce has grown sharply, and the response speed is a large part of why.

Messages are short and context is elsewhere. People write three words and expect you to have seen the post. Keep answers proportionally short. A four-paragraph reply to "how much" reads as spam.

Tone matters more than on any other channel. The customer is in a feed, not a help centre. The instruction layer that governs voice should have channel-aware rules: shorter, warmer, no formal support register, no numbered procedures unless asked.

Identity is thin and public. You get a handle, not an email. If a conversation needs an account lookup, the bot has to collect an identifier and should never confirm account details based on a handle alone. Instagram handles are trivially impersonated, and confirming order details to the wrong person is a data breach.

Staying On the Right Side of the Abuse Systems

Beyond the formal rules, a set of operational habits keeps a legitimate support bot from looking like the thing Instagram is hunting.

• Only ever reply. Never initiate. Every message your system sends should be a response to something the customer sent.
• Vary the output naturally. A bot generating answers from a knowledge base does this by default. A bot sending the same canned string to everyone does not, and identical bodies at scale are a detection signal.
• Do not send at machine-perfect intervals. Queue-based delivery with real generation latency produces natural variation. Fixed-interval cron sending does not.
• Stay well below the ceiling. Treat 200 an hour as a hard wall and set your own limit lower, with a queue that smooths bursts rather than dropping them.
• Handle errors as signals. Repeated rate limit errors mean your send pacing is wrong, not that you should retry harder.
• Keep one account per business. Multiple accounts messaging the same audience is an abuse pattern, whatever your intent.

Escalation and the Clock

Instagram inherits the Meta window rules, so escalation has the same deadline it does on Messenger: a human reply inside 24 hours goes through normally, and after that only the human agent path is available, for up to seven days.

What differs is the customer's expectation. Someone who DMs an Instagram account is not sitting waiting; they are scrolling. An asynchronous handover is entirely acceptable, provided it actually happens. Three rules:

• Escalate sales-critical questions fast. "Do you have this in stock in blue" is a purchase intent signal with a short half-life.
• Route to an inbox that can reply through the channel. If your agents work in a tool that cannot send back to Instagram, the escalation is a dead end.
• Never leave an escalation past the 24 hour mark without a human touching it. After that you are relying on a mechanism designed for exceptions.

The general escalation trigger design applies, with commercial intent added as a trigger that most support-oriented rule sets forget.

Disclosure and Data

Two obligations, same as the other channels and slightly sharper here.

Disclose that it is AI. Article 50 of the EU AI Act has been enforceable since 2 August 2026 and requires systems interacting with people to make clear that they are machines. On Instagram the customer sees your brand handle and reasonably assumes a person, so the disclosure needs to be explicit rather than implied.

Treat handles and message content as personal data. Retention period, encryption of the page token at rest, and a privacy notice that names the channel and the processors. If your bot handles anything about orders, the identity verification question above is a compliance matter as much as a design one.

Where the Platform Fits

The recurring theme across the Meta channels is that the integration is a week and the review is a fortnight, and then you own a moving policy surface. The specific Instagram risk on top of that is operational: an implementation that polls, bursts, or sends uniformly can get an account restricted, and the account is your storefront.

Paperchat runs Instagram as a channel on an existing chatbot, sharing the Meta app, the webhook, and the queue with Messenger, so inbound messages are acknowledged instantly, generation happens on a worker, and sends are paced rather than fired. More usefully, the answers come from the same knowledge base as the website widget and land in the same inbox, so an Instagram DM about stock and a website chat about stock cannot diverge.

The Bottom Line

Instagram DM automation is legitimate, useful, and narrower than it was. The platform has drawn a firm line between replying to people who contacted you and messaging people who did not, and it has enforced that line with a 96 percent rate limit cut and detection that reads sending patterns rather than just counts.

Stay on the reply side of that line. Use the official API, subscribe to webhooks and never poll, pace your sends well below 200 an hour, and let real generation produce the natural variation that keeps your traffic looking like what it is. Handle story replies and shared posts by asking for clarification rather than guessing. Keep answers short, keep the tone in the register of the platform, and escalate commercial questions quickly to a queue that can reply inside 24 hours.

Do that and you are automating the part of Instagram that genuinely benefits from it: the 150 million people a month who message a business and mostly wait too long for an answer.