Auto-replies to comments and Direct messages are allowed as long as you work through the official Meta API and follow its rules: the 24-hour reply window, opt-in and correct message types. The danger is not automation itself but “grey” methods that bypass the API — those are what lead to restrictions.
The difference: official API versus grey bots
- The official Meta API (Graph API, Messenger Platform) is the legal way to automate replies. Meta provides these tools to businesses itself.
- Grey bots imitate user actions around the API — auto-clicks, unofficial integrations. That is exactly what breaks the rules and risks an account ban.
What you have to respect
- The 24-hour window. You can reply freely for 24 hours after the customer contacts you.
- Opt-in. The customer started the conversation — a message or a comment; that is the basis for replying.
- Correct message types. Promo and broadcasts follow Meta rules, not spam patterns.
- Official integration. Connect through the Graph API rather than emulating a human.
How the platform handles it
| Rule | How it works |
|---|---|
| The 24-hour window | Replies stay inside 24 hours of the customer contacting you |
| Opt-in | The conversation starts from the customer — a message or a comment |
| Correct message types | Promo and broadcasts follow Meta rules |
| Official integration | Work runs through the Graph API — no auto-clicks, no user emulation |
How the comment replies and the hand-off to Direct actually work is described on the comment AI page. All channels then land in a single inbox instead of five tabs.
Meta rules are half the question: ZRU-547 and customer data
Meta rules govern how you send the message. The second set of rules kicks in the moment the reply is automated and the conversation lands in the customer record: name, phone, request history — that is personal data, and in Uzbekistan its processing is governed by ZRU-547, the Personal Data Act. A platform permission does not replace a lawful basis for processing data.
The ZRU-1125 amendment of 26 March 2026 clarified which three categories must physically stay in the country: biometrics (voice prints included), genetic data and telecom subscriber data. Ordinary correspondence — name, phone, order history — may also be processed abroad given an adequate level of protection, standard contractual clauses (SCC) or ISO 27001 / 27701 certification. If the business stores voice messages from Direct, though, the voice-biometrics question arises exactly as it does for call recordings.
The practical takeaway for auto-replies: the official Meta API covers the platform-side risk of restrictions, while ZRU-547 answers on what basis, where and for how long the conversation is stored. A breakdown of the law is in Personal data localisation: ZRU-547; access rights and roles are in the security section. Zukko.AI helps you meet the requirements, but the legal assessment for your business comes from your lawyer.
What the business gets
- Lower risk of restrictions — you operate by Meta rules.
- A stable account — no grey methods or workarounds.
- Fast replies, legally — within the 24-hour window.
- Predictability — automation does not put the ad channel at risk.
The full picture on auto-replies is in the guide for businesses in Uzbekistan. Access, chat storage and role permissions are covered under security.
Onboarding takes from 2 hours for a small business and up to 30 days for enterprise.
Frequently asked questions
Are auto-replies allowed on Instagram
Yes — through the official Meta API and within platform rules: the 24-hour window for direct messages and customer opt-in.
What can get you banned
Grey automation that bypasses the API — auto-clicks, emulating user actions, unofficial integrations.
What is the 24-hour window
The period during which a business can reply freely to a customer message after they get in touch.
Is customer opt-in required
Yes — the conversation must start from the customer: a Direct message or a comment under a post or an ad.
Do Uzbek laws regulate auto-replies
Meta rules cover sending the message, while processing the customer's data is governed by ZRU-547, the Personal Data Act. Correspondence that lands in the customer record is stored under those rules; the ZRU-1125 amendment requires biometrics, genetic data and telecom subscriber data to stay in the country, while other personal data may be processed abroad given adequate protection.
Can we broadcast to that audience
Only under Meta rules and with correct message types. Promo outside the window requires separate, platform-approved scenarios.