GDPR-compliant Instagram DM automation: a checklist for 2026

The European Data Protection Board explains the split in its guidelines on controllers and processors: whoever decides the purpose and the essential means is the controller. A provider that uses your followers' data for purposes of its own becomes a controller for that use (Art. 28(10) GDPR).

For you, that means:

• People who want to know what you hold about them, or want it deleted, ask you. The tool has to help you answer.
• You need a contract with the tool before it processes anyone's data. More on that below.
• You have to be able to show that you follow the rules (Art. 5(2) GDPR). Add the automation to your record of processing activities (Art. 30 GDPR). The exemption for organisations under 250 employees does not apply to processing that is not occasional, and an automation that runs every day is not occasional. GDPR

• Make the DM expected. Recital 47 of the GDPR weighs what people can reasonably expect. A caption that says "Comment GUIDE and I'll send it by DM" makes the message something they asked for.
• Trigger on a keyword. If the automation answers every comment, people get a DM they never asked for, and the balancing test becomes much harder to win.
• Send what you promised, nothing more. Whether a DM counts as electronic mail under Section 7 UWG is not settled for every case, so treat promotion you add without being asked like an advertising email, which in Germany needs prior express consent.
• Document the balancing test. A few sentences are enough: your interest, what people expect, what data you use and how they can stop it.
• Respect objections. Anyone can object to processing based on legitimate interest (Art. 21(1) GDPR). For direct marketing the objection is absolute: once someone objects, you stop (Art. 21(3) GDPR).

• Say what the address is for. "Reply with your email and I'll send you the checklist" covers the checklist. It is not consent to a newsletter.
• Ask separately for the newsletter. If you want both, ask for both, and let people say yes to one only.
• Use double opt-in. A confirmation email with a link is the established way in Germany to prove that the address belongs to the person who signed up.
• Link your privacy policy in the message that asks for the address, so people get the information Art. 13 GDPR requires when the data is collected.
• Collect only what you need (Art. 5(1)(c) GDPR). An email address or a phone number, not both plus a birthday.
• Think about minors. Where you rely on consent for an online service offered directly to a child, consent under 16 needs a parent in Germany (Art. 8 GDPR).
• Every tool you sync leads to is another processor. Newsletter tools, CRMs and spreadsheets in the cloud each need their own agreement.

The contract has to cover what Art. 28(3) GDPR lists:

• Subject matter and duration, the nature and purpose of the processing, the type of data and the categories of people.
• Processing only on your documented instructions, including for transfers outside the EU.
• Confidentiality for everyone at the provider who handles the data.
• The security measures under Art. 32 GDPR.
• Subprocessors only with your prior authorisation, with notice of changes so you can object (Art. 28(2) and (4) GDPR).
• Help with requests from the people concerned and with your duties under Art. 32 to 36 GDPR.
• Deletion or return of the data when the service ends.
• The information you need to check compliance, including audits.

Ask the provider for its current list of subprocessors and where each one processes data. Missing a required processing agreement is a breach of Art. 28 GDPR on its own, and Art. 83(4) GDPR allows fines for it.

• Check the certification yourself. It applies per company and can lapse. The Data Privacy Framework list shows who is active.
• With standard contractual clauses (decision 2021/914), the CJEU's Schrems II ruling (C-311/18) also expects an assessment of whether the law in the destination country undermines them.
• Look at every part of the setup. AI replies, generated voice, email delivery, content delivery networks and error tracking are often run by US providers, even when the main servers are in Germany.
• Name the transfers and the safeguard in your privacy policy (Art. 13(1)(f) GDPR).

A starting point you can adapt. Replace everything in square brackets and have it checked for your case:

• Choose periods and write them down. The GDPR sets no fixed number. Pick what fits the purpose, for example conversations without a lead after a few months, newsletter contacts until they unsubscribe.
• Deletion has to reach every copy (Art. 17 GDPR): the automation tool, exports and every tool you synced leads to.
• Be able to answer an access request (Art. 15 GDPR) with everything you hold about one person.
• When you stop using a tool, the agreement should make it delete or return the data (Art. 28(3)(g) GDPR). Remove the app in Instagram's settings as well.
• The tool has its own duties. Meta's Platform Terms and Developer Policies limit how apps may use Instagram data and when they have to delete it.

• How to label. The law asks for a clearly legible notice placed before or after the message, such as "Automated message".
• Company accounts. An account that clearly presents as a business may fall outside Section 18(3) MStV. If you are not sure, label.
• Meta asks for it too. Its messaging documentation says automated chats must disclose that at the start of a conversation where the law requires it, and names Germany. Send Messages
• AI replies. Say it in the first message, and never let the assistant claim to be a person. AI Act
• AI-generated voice. A voice note in a cloned voice that sounds like a real person must be disclosed as AI-generated (Art. 50(4) AI Act).

• UTM parameters store nothing on the device. Keep usernames and other personal data out of URLs.
• Per-person click tracking tells you who tapped. If you don't use that, switch it off.
• A lead magnet hosted with another provider raises the same questions about agreements and transfers.

What stays with you

• Your privacy policy, your legal basis and your record of processing activities.
• Switching on the label if your account presents as a person.
• Consent for any newsletter, and agreements with the tools you sync leads to.
• Deciding how long you keep leads, and deleting them.

Details are in Elevion's privacy policy and on the data deletion page. For how the DMs themselves work, read the comment-to-DM guide.