Short answer: you may reply automatically to people who contacted you first. You may not message people who have not. Someone messaging you opens a 24-hour reply window; someone commenting lets you send one private reply within 7 days. Everything outside that is where accounts get restricted.
The two windows worth memorising
The 24-hour window
When someone sends you a DM, you can reply freely for 24 hours. This is the standard messaging window and it covers most automation: keyword auto-replies, FAQ answers, a welcome message. Each new message from them resets it.
The 7-day private reply
When someone comments on your post, you may send that person one private message in reply, within 7 days. This is what powers “comment ITEM1 and I’ll DM you the link.” One reply, per comment — not a sequence.
What is not allowed
- Cold DMs. Messaging people who never contacted you. This is the fastest way to get restricted.
- Bulk outreach. Blasting your followers, or anyone who once liked a post.
- Follow-up sequences to non-repliers. If they did not reply, the window closed. Respect it.
- Tools that log into your account. Anything simulating the app rather than using the official API puts your account at risk, whatever it promises.
- Auto-liking and auto-following. Different feature, same outcome — and it is the classic trigger for action blocks.
Why the line exists
It is about consent, not throttling. A comment or a message is a signal that someone wants to hear from you; nothing else is. Once you see it that way, the rules stop feeling arbitrary and start reading as reasonable — and, usefully, they align with what actually converts. People who asked for something respond far better than people who did not.
What restriction looks like
Rarely a dramatic ban. Usually an action block (temporarily unable to send messages), messages quietly failing, or your content becoming non-recommendable so it stops reaching non-followers — which is often mistaken for a mysterious reach drop. Check Account Status in your settings; Instagram tells you directly.
How to automate safely
- Only ever reply. Every automated message should answer something the person initiated.
- Use a tool built on the official API. If it asks for your Instagram password, walk away.
- Send one message, not a sequence. Deliver what was asked for and stop.
- Sound like a person. Give a real answer, not a wall of marketing.
- Keep a human in the loop. Automation opens conversations; you should still read them.
The takeaway
Automation is not the risk — unsolicited automation is. Valarcha only ever replies to people who commented or messaged first, through Instagram’s official API, one message per trigger, with every send logged so you can see exactly what went out. That is not a limitation we work around; it is the design.