It depends entirely on how the tool sends. Here is exactly what Tadlo is approved to do, which permissions it holds, and how to take them back.
Not on its own. What gets accounts restricted is the method: tools that log in as you, drive the app in a browser, or scrape pages are breaking Instagram's terms, and Instagram is good at spotting them. Tools that send through Meta's official Messaging API are doing something Meta built the endpoints for.
Tadlo is in the second group. Every message goes through Instagram's official Messaging API, and the app is approved through Meta App Review. That is a review Meta runs against a working build, not a form you fill in. The rest of this page is what that approval actually consists of, so you can judge it rather than take our word for it.
The wider question of why API-based tools behave differently from bot-based ones is covered in our complete guide to Instagram automation. This page stays on what Meta specifically granted us.
Two related questions come up constantly and each has its own answer: what actually gets Instagram accounts actioned, and whether you need a Facebook Page — which depends entirely on which Meta API a tool was built on.
When you connect an account, Instagram shows you a consent screen listing what the app is asking for. These are the five permissions Tadlo requests, verbatim, and what each one allows:
instagram_business_basic — read your profile: username, follower count, media count, bio and profile picture. This is what identifies the connected account.instagram_business_manage_messages — send and receive DMs through the Messaging API. This is the permission automation runs on, and the one that makes a verified follow check possible.instagram_business_manage_comments — read and reply to comments on your own posts and Reels. This is what a comment trigger listens to.instagram_business_content_publish — publish content you create in Tadlo to your own account. Only ever used when you press publish.instagram_business_manage_insights — read your own analytics: reach, follower count, profile views and per-post metrics.Notice what is not in that list. There is no permission to follow or unfollow on your behalf, none to like or comment as you on other people's posts, none to read other people's private messages, and none to access anything belonging to an account you have not connected. Those capabilities are not withheld by policy — they are not in the grant.
Connecting Tadlo sends you to instagram.com/oauth/authorize — Instagram's own login page, on Instagram's own domain. You authenticate with Instagram, approve the permissions above, and Instagram hands Tadlo a token scoped to those permissions.
Tadlo never sees your password, never stores one, and never signs in as you. There is no browser session being driven in the background and no page being scraped. The token can only do the five things listed above, and it can be revoked without changing your password.
Every message Tadlo sends is a response to something a person did: they commented a keyword on your post, replied to your story, or sent you a DM. That action is the trigger, and no trigger means no message.
Tadlo cannot send a cold DM, and this is enforced by the platform rather than by our own good intentions. Meta's Messaging API only permits a business to message a person inside a window opened by that person's own contact. There is no endpoint for messaging a stranger, so there is no setting in Tadlo that could turn one on.
This is the single biggest practical difference between API-based automation and the mass-DM tools that give the category its reputation. One answers people who approached you. The other approaches people who did not ask, which is what Instagram's spam systems are built to catch.
Delivery is also paced rather than fired all at once, as an account-safety measure — a burst of identical messages looks like exactly what it is, and pacing is what keeps normal automation looking normal.
You can withdraw the permissions at any time, from Instagram, without involving us:
The token stops working immediately and automations stop with it. You can also disconnect from inside Tadlo, but doing it from Instagram is the version worth knowing, because it works whether or not you can still get into your Tadlo account. Access you cannot revoke without asking the vendor is not access you control.
Tadlo connects to Instagram directly through Instagram Business Login. You need an Instagram Business or Creator account, and that is the whole prerequisite — no linked Facebook Page, no Business Manager, no Meta Business Suite setup.
Most tools in this category were built on the older Instagram Graph API, which is reached through a linked Facebook Page, so they still require one. It is a genuine obstacle for creators who have never had a Page and do not want one — and most vendors do not mention it until signup. We checked which ones say so openly in our comparison of nine DM tools.
It also has a technical consequence worth knowing: because Tadlo runs on the Instagram Login stack rather than the Page-linked Graph API, it can read a per-person follow signal that the older stack does not expose. That is what makes the verified follow gate possible.
10,000+
Creators using Tadlo
2M+
DMs Automated
120K+
Leads Generated
Before
“I was missing DMs and losing clients every single day.”
After
“Now I get 20–30 leads weekly on autopilot. Tadlo changed everything.”
Sarah Chen
Fashion Creator
Before
“Replying to every comment and DM was eating up 4+ hours daily.”
After
“Automated all my replies. Engagement went up 3x and I got my life back.”
Marcus Johnson
Fitness Coach
Before
“Managing 8 client accounts manually was unsustainable.”
After
“Now all accounts run automated. We saved 20+ hours a week.”
Priya Sharma
Agency Owner
Tadlo sends through Meta's official Messaging API under permissions granted at App Review, which is the behaviour Meta built those endpoints for. What gets accounts restricted is the opposite pattern — logging in as you, driving the app in a browser, or messaging people who never contacted you. Tadlo does none of those, and cannot.
Five permissions, reviewed against a working build rather than a form: basic profile access, message management, comment management, content publishing and insights. App Review means a Meta reviewer confirmed the app uses each permission for the purpose it claims. The full list, and what each one allows, is above.
No, and it has no way to accept one. You authenticate on instagram.com through Instagram Business Login, and Instagram issues a token scoped to the approved permissions. Tadlo never sees, stores or transmits your password, and revoking the token does not require changing it.
No. Meta's Messaging API only allows a business to message someone inside a window that person opened by commenting, replying to a story, or sending a DM. There is no endpoint for messaging a stranger, so there is no feature in Tadlo that could do it regardless of settings.
No. Tadlo connects through Instagram Business Login directly, so an Instagram Business or Creator account is the only prerequisite. Most tools in this category run on the older Page-linked Graph API and still require a Facebook Page, which is a real obstacle for creators who have never had one.
From Instagram: Settings and privacy, then Website permissions, then Apps and websites, open Active, find Tadlo and choose Remove. The token stops working immediately. You can also disconnect inside Tadlo, but the Instagram route works even if you have lost access to your Tadlo account.
No. Those capabilities are not among the permissions granted, so they are not withheld by policy — they are absent from the token entirely. Tadlo can read your profile and insights, manage messages and comments on your own account, and publish content you create. Nothing else.
Automations stop immediately because the token no longer works. Your Tadlo account and its data remain until you delete them, and you can request full deletion at any time — see our data deletion page for what gets removed and how long it takes.