Postora

A handbook for people who run social media for a business or for clients

Rules for brand posts

WhatsApp, Messenger and Instagram DM rules for businesses: the 24-hour window, templates, opt-in and comment-to-DM

By the Postora editorial teamUpdated 10 min read

Short answer

On WhatsApp, Messenger and Instagram a business may reply freely for 24 hours after the customer last messaged. After that, WhatsApp needs an approved template, Messenger a tag, utility or marketing message, Instagram only a tagged human-agent reply.

This is general information, not legal, tax or financial advice. Rules change and depend on your country and situation; check the linked official sources or ask a qualified professional.

On WhatsApp, Messenger and Instagram a business may reply freely for 24 hours after the customer last messaged. After that, WhatsApp needs an approved template, Messenger a tag, utility or marketing message, Instagram only a tagged human-agent reply.

WhatsApp has its own Business Messaging Policy and a price per message. Messenger and Instagram Direct sit under Meta's Developer Policies, with fewer options on Instagram. Every rule below was read on Meta's own pages on 2026-10-04 and is linked where it is stated.

What is the 24-hour window on each channel?

  • WhatsApp. When a user messages you, a 24-hour customer service window opens. The policy says you "may reply to a user message without use of a Message Template as long as it's within the 24-hour customer service window" (WhatsApp Business Messaging Policy, last updated 23 September 2026). Messages that come from a Click to WhatsApp ad or a Facebook Page call-to-action button also open the window (WhatsApp pricing).
  • Messenger. The standard messaging window is 24 hours. Meta's send-messages guide lists what opens it: a message to the Page, a call-to-action button such as Get Started, a Click-to-Messenger ad, a plugin, or a comment on your content (Messenger Platform). The Developer Policies add one exception: when a person clicks a Click-to-Messenger or Click-to-Instagram-Direct ad and then sends a message, the window "may last up to 7 days" (Meta Developer Policies, 5.6.1.a).
  • Instagram. Meta's Instagram messaging guide says your app "has 24 hours to respond" to a message, and that a business can only message a person after that person has messaged the professional account (Instagram Platform). Messages from people who do not follow the account land in their Requests folder.

Promotional content is allowed inside the window on Messenger: the policy states that messages sent within it "may contain promotional content" (Messenger Platform policy).

What can a business send after the window closes?

WhatsApp Business Platform Facebook Messenger Instagram Direct
Free-form window 24 h from the user's last message 24 h; up to 7 days after a click-to-message ad 24 h from the user's last message
Free entry point 72 h after you answer a click-to-WhatsApp ad or Page button message within 24 h Not applicable Not applicable
Outside the window Approved message templates only (marketing, utility, authentication) HUMAN_AGENT tag (7 days), utility messages, marketing messages, one-time notifications, sponsored messages A human-agent reply, tagged (Meta's Instagram guide gives no time limit)
Who may start a conversation Anyone who gave you their number or username and opted in People who messaged you first, or subscribed to marketing messages Only people who messaged you first
Opt-in rule Written into the WhatsApp Business Messaging Policy Developer Policies 5.2.a: "legally sufficient" consent Developer Policies 5.2.a: "legally sufficient" consent
Cost of messages Per delivered template, by category and country Not stated on the pages read Not stated on the pages read

WhatsApp: templates

Outside the customer service window, "you may only send messages via approved Message Templates" (WhatsApp policy). Meta's template guide says every template must be categorised as authentication, marketing or utility, and that templates are reviewed automatically when created or edited; only an approved template can be sent (template fundamentals).

Messenger: tags, utility and marketing messages

Three Messenger message tags are gone. Meta's changelog states that from 27 April 2026, requests using CONFIRMED_EVENT_UPDATE, ACCOUNT_UPDATE or POST_PURCHASE_UPDATE "will receive error code 100", and tells developers to move to utility templates or the Marketing Messages API (Messenger changelog). Utility messages are pre-approved templates for updates after purchases, events or account activity, announced in July 2025 to replace those tags (Meta for Developers blog).

What remains:

  • HUMAN_AGENT. A human agent may answer within 7 days of the user's message using the human_agent tag. It is for people, not bots, and an app needs Meta's App Review to use it (Human Agent feature).
  • Marketing messages. "Customers must subscribe before businesses can send marketing messages, and can opt-out anytime" (Meta, marketing messages).
  • One-time notifications and sponsored messages. A one-time notification asks permission for one follow-up after the window; sponsored messages are labelled "Sponsored". Neither is available on the Instagram Messaging API (Messenger Platform policy).

One rule covers tags and utility messages alike. The Developer Policies say not to use them "to send promotional content or other advertising, marketing, or solicitations", naming upsells, coupons, sale announcements and polls among the examples (5.6.2.c).

Instagram: human agent only

One-time notifications, news messaging and sponsored messages are not supported on Instagram (Messenger Platform policy). Meta's Instagram messaging guide describes one extension: if a human agent responds, the app can tag the reply to send it outside the 24-hour window (Instagram Platform).

What opt-in do businesses need before messaging customers?

WhatsApp. The policy sets two conditions. You may only contact people if they have given you their mobile number or username, and you have opt-in permission confirming "that they wish to receive subsequent messages or calls from you". You must respect every request, on or off WhatsApp, to block, stop or opt out (WhatsApp policy). Meta's opt-in guide for the Platform adds that the opt-in must clearly state that the person is opting in to messages from the business, and name the business. It can be collected by SMS, on a website, through an interactive voice response (IVR) call, or in person or on paper. Meta suggests either one opt-in covering several message categories or separate opt-ins by category, with clear opt-out instructions either way (opt-in guide).

Messenger and Instagram. The Developer Policies say not to contact people in Messenger or Instagram messaging unless you have obtained "legally sufficient consent, permission, and/or opt-in" under all applicable laws, to provide a legally sufficient way to opt out, and to respect opt-out requests immediately (5.2.a and 5.2.b).

"Legally sufficient" points to the marketing-consent law where your customers live.

A practical opt-in line for a website checkout, built from the WhatsApp guide's requirements:

[ ] Send me order updates from [BUSINESS NAME] on WhatsApp.
[ ] Send me offers from [BUSINESS NAME] on WhatsApp.
Reply STOP at any time to stop each type of message.

Keep a record of when and where each person ticked each box.

How does WhatsApp pricing work now?

WhatsApp Business Platform pricing moved to per-message billing on 1 July 2025. Meta's page says "you are only charged when a template message is delivered", and the rate depends on the template's category and on the recipient's country calling code (WhatsApp pricing). How each kind of message is treated:

Message Inside a 24-hour customer service window Outside the window
Non-template (free-form) message Free Cannot be sent
Utility template Free Charged
Authentication template Not named as free; budget it as charged Charged
Marketing template Charged Charged
Any message inside a 72-hour free entry point window Free Free while the entry point window is open

Source: WhatsApp pricing, read 2026-10-04. Service conversations have been free since 1 November 2024.

Utility and authentication messages get lower rates at higher monthly volumes, with tiers that reset monthly and are "determined solely by Meta". Rate cards also move: from 1 October 2026 Meta put more markets, among them Bangladesh, Kuwait and Ukraine, on standalone rate cards. This guide quotes no per-message prices for that reason; read the current rate card for each country you message. To estimate a month, count the templates you send outside customers' 24-hour windows by category, and multiply by each country's rate.

WhatsApp Business app or WhatsApp Business Platform?

The WhatsApp Business app is the phone app. The WhatsApp Business Platform, through the Cloud API, is what software uses to "programmatically message and call on WhatsApp" (Cloud API overview). The pricing, template and customer-service-window rules above are Platform rules.

A business does not always have to choose. Meta's coexistence option lets a business connect an existing Business app number to the Cloud API through a solution partner or tech provider, so it can send high volumes through the API and keep one-to-one chats in the app, with the history synced (coexistence guide). Meta states that "messages sent from the WhatsApp Business app are not subject to the customer service window and do not create, extend, or affect Cloud API conversation windows or Cloud API pricing." After onboarding, broadcast lists in the app become read-only.

The opt-in conditions apply to the app and the Platform alike. One rule applies to the app only: "You are prohibited from messaging about any Regulated Verticals on the WhatsApp Business App." The policy's list includes alcohol and tobacco, medical and healthcare products, real-money gambling, dating services and payday loans (WhatsApp policy).

What are the rules for comment-to-DM and automated replies?

Comment-to-DM tools send a private message to someone who commented on a post. On both Instagram and Facebook this runs on Meta's private replies feature, and the limits are the same:

  • One message per comment. On Instagram, "only one message can be sent to the commenter"; on Facebook, only one message can be sent to the person who commented (Instagram private replies, Facebook private replies).
  • Within 7 days of the comment. On Instagram Live, only while the broadcast is running.
  • More messages only after the person answers. On Instagram, follow-ups must be sent within 24 hours of the person's response. On Facebook, a reply opens the normal 24-hour window.
  • On Instagram it works on comments on posts, reels, stories, Live broadcasts and ad posts. The message reaches the person's inbox if they follow you and their Requests folder if they do not.

A "comment GUIDE for the link" campaign fits: one message with the link, then a conversation only if the person writes back. A second unprompted nudge does not.

Do automated DMs have to say they are a bot?

Meta's Messenger Platform policy says that when applicable law requires it, automated chat experiences must disclose that the person is talking to an automated service: at the start of a conversation, after a significant lapse of time, and when a chat moves from a human to automation. The policy names users and markets in California and Germany, and gives sample lines such as "You are talking to a bot" (Messenger Platform policy). Our recommendation: put that line in the first automated message everywhere.

WhatsApp's policy allows automation inside the 24-hour window but requires "prompt, clear, and direct escalation paths": an in-chat human agent, a phone number, an email address, web support, a store visit or a support form (WhatsApp policy).

A pre-send checklist for small teams

  1. Did the customer message us in the last 24 hours? If yes, reply freely. If no, go to 2.
  2. Is a human answering a question the customer asked? On Messenger, the HUMAN_AGENT tag covers 7 days; on Instagram, a tagged human-agent reply can go out after the window. Both only if your tool has it.
  3. Is it an update about an order, booking or account? WhatsApp utility template, or a Messenger utility message. No discount, upsell or poll inside it.
  4. Is it promotional? WhatsApp marketing template to opted-in contacts, or Messenger marketing messages to subscribers. On Instagram, wait for the customer to write.
  5. Is an automated flow involved? First message says it is automated; a human or other contact route is offered.
  6. Did the person opt out anywhere? Stop on every channel where you can act on it.

Who may press send on which of these belongs in your social media policy. If DM codes are part of a giveaway, the giveaway rules guide covers the platform terms and prize law. If an agency answers your inbox, give it a role instead of a password: see how to give an agency access without a password. For automation across several Instagram accounts, the multi-account rules explain why it must run through Meta's approved APIs.

Frequently asked questions

Can a business message someone on Instagram first?

Not through Meta's API. Meta's Instagram messaging guide says a business can only send a message after the Instagram user has messaged its professional account. A private reply to a comment is the one exception, and it allows a single message.

Are WhatsApp messages free for small businesses?

On the WhatsApp Business Platform, non-template replies inside the 24-hour window are free, and so are utility templates sent inside it. Marketing templates are charged unless a free entry point window is open, utility templates are charged outside the window, and Meta's pricing page names no free case for authentication templates outside a free entry point window.

Sources

All read on 2026-10-04.