Yes, and the limits are narrower than most clinics realise. Instagram’s Community Guidelines ask you not to repeatedly contact people for commercial purposes without their consent. That single rule is what separates outreach that runs for years from outreach that gets an account restricted, and it says nothing about whether you may message a stranger. You may.

What Instagram’s own rules actually say

Two documents govern this, and they cover different things.

The Community Guidelines deal with spam. The relevant rule asks people not to repeatedly contact others for commercial purposes without their consent. Read it closely and the test has three parts: repetition, commercial purpose, and consent. A single, relevant, personal message to someone who follows your clinic fails none of them. The same message pasted to four hundred accounts a day fails all three.

The Terms of Use deal with automation. They prohibit creating accounts, or accessing and collecting information, in an automated way without express permission from Instagram. That covers a great deal of what outreach software does to build a target list.

Neither document sets a daily message limit, and neither bans messaging people who do not follow you.

What actually gets an account restricted

Enforcement under the Community Guidelines runs from removing content, to restricting what an account can do, to disabling it. Spam is one of the named grounds.

The mechanism worth understanding is that enforcement is driven substantially by how recipients respond. Instagram gives people a route to report a direct message, and blocks and reports are signals. This is why two clinics sending the same number of messages can have completely different experiences. One is messaging people who recognise the name and reply. The other is messaging strangers who report it.

So the number that matters is how many of your messages are welcome. Volume matters only because it drives that number down.

Where the real risk sits: automation

Most clinics that get into difficulty did not decide to spam anyone. They installed a tool.

Automation creates risk on both rules at once. On the Terms of Use, tools that build lists by scraping followers or hashtags are collecting information in an automated way. On the Community Guidelines, a tool sends the same message at a volume and rhythm no person would produce, which is what the spam rule describes.

There is a second, quieter problem. A template repeats. One badly judged sentence in a sequence goes to every recipient in it, and if that sentence breaches the advertising rules below, it breaches them several hundred times.

We have written separately on human versus automated follow-up and what actually converts, which is a different question from whether either is permitted.

The UK layer nobody mentions

Search this question and most of what ranks explains Meta’s rules and stops. For a UK clinic that is half an answer, because two UK rules apply on top and neither is optional.

Direct messages count as direct marketing

The ICO states that where you are marketing using direct messaging via social media, the PECR electronic mail marketing rules apply. PECR defines electronic mail broadly, and the ICO lists direct messages via social media alongside emails and texts.

The consequence is that unsolicited marketing messages to individuals normally require consent. A soft opt-in exception exists, and it is narrower than people hope: it covers your own previous customers who were given a clear chance to opt out. It does not extend to prospective customers, and it does not extend to bought-in lists.

For a clinic this draws a practical line. Messaging a past client about a treatment they have had before sits in very different territory from messaging someone who once liked a post.

You cannot advertise Botox to the public

Botulinum toxin products are prescription-only medicines. CAP rule 12.12 prohibits advertising a prescription-only medicine to the public, and the ASA has issued an enforcement notice specifically about botulinum toxin advertising on social media. The ASA treats almost any reference, direct or indirect, as likely to breach the rules, including images and hashtags.

This applies to what you send, not only to what you post. If a message template names the treatment, that template is the problem, and it is sent every time the sequence runs.

This page is general information, not legal advice. The rules change and enforcement positions move. Check the current Instagram, ICO and ASA guidance, all linked below, before you write or approve any message template.

What this means in practice

Four things keep clinic outreach inside all three rulebooks at once.

  • Message people with a reason. Someone who follows you, asked a question, or booked before is a different proposition from a stranger, under Instagram’s rules and under PECR.
  • Write each message to its recipient. Repetition is the thing the spam rule names. It is also what makes people report you.
  • Do not name prescription-only treatments. Not in the first message, not in a template, not in a hashtag. Describe the concern instead and let the consultation do its job.
  • Keep a record of consent for past clients. The soft opt-in only helps if you can show the opt-out was offered.

Those four are roughly what Instagram, the ICO and the ASA each describe as acceptable, arrived at from three different directions. Three rulebooks agreeing is usually a sign you are on solid ground.

Sources

About the author

Kat Martyn, Founder. Kat Martyn spent fifteen years in sales and marketing before retraining in skin at 33. She opened her own aesthetics clinic in 2019 and has since mentored more than 300 clinic owners. She founded Booked For You to run clinic DMs the way a person would, which means living inside these rules every working day.

Quick answers

Is it against Instagram's rules to DM someone you don't know?

No. Sending a direct message to someone who does not follow you is a normal use of Instagram, and the platform is built for it. What the Community Guidelines prohibit is repeatedly contacting people for commercial purposes without their consent. The rule is about repetition and commercial pressure, not about the first message.

Can Instagram ban my clinic account for sending DMs?

It can restrict or disable an account for breaching the Community Guidelines, and spam is one of the named reasons. Enforcement ranges from removing content to restricting features to disabling the account. In practice, accounts get into trouble for volume and repetition rather than for messaging at all. Recipients can also report a direct message, and reports feed enforcement.

Are Instagram DM automation tools against the terms of use?

The Terms of Use prohibit creating accounts or accessing and collecting information in an automated way without express permission from Instagram. Many outreach tools work by doing exactly that, and they also send identical messages at volume, which is what the spam rules target. Read any tool's method against both rules before you connect it to a clinic account you depend on.

Do UK marketing laws apply to Instagram DMs?

Yes. The ICO states that where you are marketing using direct messaging via social media, the PECR electronic mail marketing rules apply. That normally means unsolicited marketing messages to individuals require consent. The soft opt-in exception covers your own previous customers who were given a chance to opt out, and does not extend to prospective customers or bought-in lists.

How many DMs can I send per day on Instagram?

Instagram does not publish a number, and any specific daily limit you read online is someone's guess rather than policy. Limits are applied dynamically and vary by account age, history and how people respond to your messages. The useful measure is not how many you send but how many are welcome, because reports and blocks are what trigger restrictions.

Can a UK clinic mention Botox in an Instagram DM?

No. Botox and other botulinum toxin brands are prescription-only medicines, and CAP rule 12.12 prohibits advertising a prescription-only medicine to the public. The ASA treats almost any reference on social media, including hashtags, as an implied advert. This applies to messages sent from a clinic account as well as to posts, and it applies to message templates.