Instagram first-party data is the follower information a business collects directly through its own account rather than buying it. Meta’s messaging API returns seven fields about a person who comments or DMs you: name, username, profile picture, follower count, verification status, and whether either account follows the other. Email address and phone number are not among them. Those you have to ask for.
That gap is the whole story. A marketing platform can promise to turn social into a channel you own, and the promise is real, but it stops at the same endpoint for everyone. Meta hands over a username, not a mailbox. Every tool in this category, at every price, is selling you the same seven fields plus a way to run the conversation where somebody types in the eighth.
This guide covers what Instagram gives you about an engaged follower, what it withholds, the two clocks that decide when you are allowed to ask, the consent record you need before you store an answer, and how to tell whether your social account is producing anything durable at all.
Key Takeaways
- Seven fields, no contact details: Meta’s user profile endpoint returns name, username, profile picture URL, follower count, verification status, and both follow-relationship flags. There is no email field and no phone field (developers.facebook.com, August 2026)
- Ownership is a consent event, not a purchase: the only portable identifier you will ever hold is one the follower typed into a conversation themselves
- Two clocks govern the ask: you have 7 days to send a single private reply to someone who commented on a post or reel, and 24 hours to keep talking once they reply to you (developers.facebook.com, August 2026)
- Profile pictures expire: Meta states the profile picture URL stops working after a few days, so a stored link is not a stored asset
- Consent is unambiguous, not explicit: GDPR asks for a clear affirmative action plus a record of what you showed at the moment of capture, which is a higher bar than most DM flows meet (EDPB Guidelines 05/2020)
- Engagement is not an asset: Instagram engagement fell to 3.54% of reach in early 2026, down 6.61% year on year across 24.3 million posts (Metricool 2026 Instagram Study, June 2026). Reach you rent moves. A contact record does not
- Bottom line: treat every comment as a 7-day window to trade something specific for an address, then move that address somewhere Instagram does not control
What Is Instagram First-Party Data?
First-party data is information you collect directly from your own audience, with their knowledge, through channels you operate. On Instagram that means anything a follower hands you by engaging with your account: the comment they left, the keyword they sent, the email address they typed when you asked for one.
It is worth separating this from two things it gets confused with. Scraped follower lists are not first-party data, because the people on them never interacted with you and never consented. Platform analytics are not first-party data either, because you can read them but cannot take them anywhere.
The distinction that matters commercially is durability. Some of what Instagram shows you survives a suspended account, a changed algorithm, or a platform you decide to leave. Most of it does not.
Klaviyo made this argument the basis of a product launch in mid-2026, shipping Klaviyo Social Marketing to general availability on June 30 and announcing it on July 7, with Instagram Business as the only supported platform at launch (klaviyo.com newsroom and help center, August 2026). The framing was that social should sit alongside email and SMS as an owned channel. The framing is correct. The constraint underneath it applies to every vendor equally, and it is published in Meta’s own documentation.
What Instagram Tells You About a Follower
When someone comments on your post or sends your professional account a message, Meta’s user profile endpoint makes these fields available to an authorized app.
| Field | Type | What it gives you |
|---|---|---|
| name | string | The person’s display name, which can be empty if they never set one |
| username | string | Their Instagram handle |
| profile_pic | URL | A link to their profile picture. Meta states the URL expires after a few days |
| follower_count | integer | How many followers they have |
| is_verified_user | boolean | Whether they carry a verification badge |
| is_user_follow_business | boolean | Whether they follow you |
| is_business_follow_user | boolean | Whether you follow them |
Source: Meta’s Instagram messaging user profile documentation, accessed August 2026.
Alongside these, Meta generates an Instagram-scoped user ID the first time a person comments on or messages your account. Meta describes it as an ID that represents that person on that app, specific to the person and the account they are interacting with (developers.facebook.com, August 2026). It is the key you use to recognize a returning conversation. It is not something you can put in an email tool.
Two of these fields are more useful than they look. The follow-relationship flags are what make a follow gate possible: you can check whether someone follows you before you send a link, which is how creators stop giving away lead magnets to accounts that engage once and leave. Follower count is the crude version of lead scoring, and it is the only sizing signal Meta gives you for free.
The Missing Field That Decides Everything
There is no email address on that endpoint. There is no phone number. This is not a restriction one tool has and another has solved. It is the boundary of what Meta publishes, and it applies to a $15 tool and an enterprise marketing cloud identically.
The consequence is straightforward. Every route from Instagram engagement to a channel you own passes through a moment where a human being decides to type their address into a message box. No integration removes that step. Software can make the moment arrive faster, make the trade clearer, and make sure the answer lands somewhere useful, and that is the entire job.
This reframes what you are buying when you buy into the owned-social pitch. You are not buying access to your followers’ contact details, because that access does not exist. You are buying the machinery around a consent event: the trigger that starts the conversation, the offer that makes the trade worth it, the storage that keeps the answer, and the proof that the person agreed.
It is also why personalized social starts as a data question rather than a copywriting one. Social media personalization works through that question field by field.
Three Tiers of Data Durability
Sorting what you can see on Instagram by how long it survives makes the strategy obvious.
Tier 1: platform-held signals. Follower count, likes, saves, shares, reach, story views, audience demographics in Insights. You can read these, report on them, and make decisions with them. You cannot take them with you. If the account goes, they go. Roughly 5,000 Instagram-related disputes reached the Appeals Centre Europe between April 2025 and March 2026, and account restoration was the single largest category across all platforms at 44% of eligible cases (Appeals Centre Europe Transparency Report, May 2026). Tier 1 data is exactly as permanent as your account is.
Tier 2: scoped identifiers. The Instagram-scoped user ID, the username, the follow relationship. You can store these in your own database and they persist there. Their usefulness is still tied to Instagram existing and the person keeping the same handle. You can recognize someone. You cannot reach them anywhere else.
Tier 3: portable contact records. An email address, a phone number, a name they gave you on purpose, a tag describing what they asked for. These work after the platform. They upload into an email tool, a CRM, or a Meta Custom Audience. They are also the only tier that requires the person to actively participate in creating them. Marketing taxonomy has a name for records created that way: zero-party data, the category defined by the customer choosing to answer rather than being observed.
Most social reporting measures Tier 1 and calls it performance. The question worth asking each month is narrower: how many Tier 3 records did this account produce, and what did they cost in reach?
The Windows That Decide When You Can Ask
Meta puts two clocks on the conversation, and both shape how a capture flow has to be written.
The 7-day comment window. When someone comments on a post, ad post, or reel, you can send them one private reply, and it must go out within 7 days of the comment. Meta is explicit that only one message can be sent to the person who commented. The conversation continues only if they respond (developers.facebook.com, August 2026). Comments on Instagram Live are tighter still: private replies work during the broadcast and not after it.
The 24-hour messaging window. Once a person messages you, you have 24 hours to respond, and messages inside that window may contain promotional content. The Human Agent tag extends the response window to 7 days for cases a standard reply cannot resolve (developers.facebook.com, August 2026).
Read together, these two rules explain why an automated first reply is worth more than a fast manual one. Your single permitted message to a commenter has to carry the whole trade: what you are offering, what you need to send it, and enough context for the person to agree. Get it wrong and there is no follow-up to fix it.
On pacing, tools typically hold sends to around 200 automated DMs an hour as a behavioral safety margin. That figure is a convention among tools, not a Meta rule. Meta’s published limits are per second: 100 calls per second for text and links on the Instagram Login path, and 750 private replies per hour to comments on posts and reels (developers.facebook.com, August 2026).
How to Collect What Instagram Withholds
The mechanics are the same regardless of which tool runs them.
- Attach the trigger to content people already want. A post offering a specific asset carries its own reason to exist. A post asking people to join a newsletter does not.
- Name the asset in the comment prompt. “Comment MACROS for the meal plan” sets up a trade the person can evaluate. “Comment below” does not.
- Spend the one permitted reply on the trade, not the pitch. State what they get, state that you need an email to send it, and say what else you will send.
- Ask for one field. Every additional field costs completions, and the address is the only one that makes the record portable.
- Tag the record at capture. Store which post and which keyword produced it. Capture rate by trigger is a different ranking from engagement by post, and it is the one that predicts revenue.
- Move it out on a schedule. A contact sitting in a DM tool is still one platform away from being usable. It belongs in the system that sends your campaigns.
For a side-by-side on where capture converts best, we compared link-in-bio pages against DM capture on conversion rate and step count. The two-directional version of this, where the list then goes back into ad targeting, is covered in the guide on how to integrate email marketing with social media.
What Consent You Need Before You Store an Address
The common shorthand is that GDPR requires explicit consent for email marketing. That is not what the text says, and the real standard is easier to meet and easier to fail on a technicality.
GDPR Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication of the person’s wishes, by a statement or a clear affirmative action. The EDPB has stated that explicit consent is reserved for special category data, international transfers, and automated decision-making, while ordinary consent needs that clear affirmative action (EDPB Guidelines 05/2020 on consent, edpb.europa.eu).
Typing an email address into a DM in response to a stated offer is a clear affirmative action. The parts that trip people up sit around it:
- You must be able to demonstrate consent. Article 7(1) puts the burden on you, and the EDPB says a record should cover how and when consent was given and what information the person was shown at the time. Pointing at a correctly configured form after the fact is not enough.
- Say who you are and what you will send, at the point of capture. The request has to be separate and distinct, not a line buried in terms.
- Withdrawal must be as easy as consent. Article 7(3). If they opted in with one message, one message should get them out.
- Silence and inactivity are not consent. Recital 32. Someone commenting a keyword has asked for the asset, not subscribed to a weekly newsletter, unless you told them that was part of the trade.
One jurisdictional note worth knowing: the UK’s ICO treats direct messaging on social media as electronic mail for direct-marketing purposes, which puts a promotional DM under the same rules as a promotional email (ico.org.uk, August 2026). We have not found an EU regulator stating this in the same words. The broader rules for automated DM flows are covered in the GDPR compliance guide for Instagram DM automation.
Which Tools Move Instagram Data Off Instagram
Every tool here reads the same seven fields. They differ in what happens to the address after someone types it.
ManyChat publishes native integrations with Klaviyo, Mailchimp, ActiveCampaign, Kit, Flodesk, HubSpot, Google Sheets, Zapier and Make, plus a public API, which suits a team that wants contacts landing in an ESP without a manual step. Integration access is tiered: the Essential plan includes Google Sheets sync, and email, SMS and CRM integrations plus API access begin at Pro. Pricing runs $17, $39, $99 and $199 per month billed monthly for 250, 2,500, 7,500 and 25,000 active contacts, or $14, $29, $69 and $139 per month billed annually, with a free plan capped at 25 active contacts (manychat.com help center, August 2026).
LinkDM is a Meta Business Partner covering Instagram and Facebook, with lead capture in chat and lead-form connections to Kit and Flodesk listed on its public feature pages. Its ladder is a free plan at 1,000 DMs per month, Pro at $19 per month for 25,000 DMs per account, and Platinum+ at $99 per month for 300,000, with no card required for the free tier (linkdm.com, August 2026).
Klaviyo Social Marketing takes the opposite approach and starts from the database. Social auto-replies collect email, SMS and WhatsApp consent inside Instagram DMs, and comments, DMs and mentions land as events on a customer profile that already holds purchase history, which is useful if you are running ecommerce email from Klaviyo already. It requires a Klaviyo account and an Instagram Business account, and ships as a paid add-on with a free auto-replies tier and a 14-day trial. No price is published on the product page (klaviyo.com and help.klaviyo.com, August 2026).
CreatorFlow is built for the Instagram-only case at a flat $15 per month, or $12 billed annually. The Email Gate collects the address inside the DM before the link goes out, the Follow Gate uses the follow-relationship flag to require a follow first, CSV export on Pro moves those contacts into any email platform, and geographic analytics show where the clicks came from. CreatorFlow is a Meta Tech Provider (since December 2025) and connects through Meta’s official Instagram API with OAuth, so no password is shared (creatorflow.so, August 2026).
If you want the platform-by-platform version of moving contacts into an ESP, see the walkthrough on getting Instagram DMs into Klaviyo, Kit or Mailchimp. For managing the conversations themselves rather than the contact records, the Instagram CRM guide covers the inbox side, and the social media CRM breakdown compares what the platforms and the tools each contribute to a contact record.
How to Tell If Social Is Producing Owned Data
Three numbers answer it, and none of them are follower growth.
Capture rate per triggered post. Addresses collected divided by comments on the trigger word. Under 30% usually means the trade was vague or the single permitted reply asked for too much.
Cost per record in reach. Addresses collected divided by the reach the post spent getting them. This is the number that survives an algorithm change, because it prices your audience in the currency Instagram charges you.
Share of revenue attributable to Tier 3 records. What percentage of sales trace to someone whose contact details you hold, versus someone who happened to see a post. If that share is not rising quarter over quarter, the account is producing engagement and not assets.
For context on what the alternative channel returns, all-industry email click rate sat at 2.09% across 3.6 million campaigns sent between December 2024 and November 2025 (MailerLite benchmarks, December 2025). Open rates are less useful for comparison since Apple Mail Privacy Protection began pre-fetching tracking pixels, which registers opens no human performed. The trade-off between the two channels is broken down in DM funnels versus email funnels.
FAQ
Can Instagram give me a follower’s email address?
No. Meta’s user profile endpoint for Instagram messaging returns name, username, profile picture URL, follower count, verification status, and the two follow-relationship flags. Email and phone number are not fields on that endpoint (developers.facebook.com, August 2026). The only way to hold a follower’s email is for them to type it into a conversation after you ask.
Is social media an owned channel or a rented one?
Both, in different layers. The content you publish and the account you operate are yours to control. The distribution is rented, and the audience list is not transferable. Instagram engagement averaged 3.54% of reach in early 2026, down 6.61% year on year (Metricool 2026 Instagram Study, June 2026), which is a reminder that the rented layer reprices without warning. Social becomes an owned channel only for the followers whose contact details you have collected.
How long do I have to reply to someone who commented?
Seven days from when the comment was created, and Meta allows only one private reply per commenter. If the person replies to that message, a 24-hour window opens in which you can continue the conversation (developers.facebook.com, August 2026). Comments on Instagram Live are an exception: private replies work only during the broadcast.
Is it legal to collect email addresses inside Instagram DMs?
Yes, with the same consent obligations as any other collection method. GDPR asks for a clear affirmative action rather than explicit consent, and requires you to be able to demonstrate what the person was shown at the time they agreed (EDPB Guidelines 05/2020). In practice that means the DM must name who you are and what you will send before the address is given, and unsubscribing must be as easy as signing up.
What is an Instagram-scoped user ID?
It is the identifier Meta creates when someone first comments on or messages your professional account. Meta describes it as representing that person on that app, specific to the person and the account they are interacting with (developers.facebook.com, August 2026). It lets you recognize a returning conversation and personalize a reply. It is not a contact detail and cannot be used to reach anyone off Instagram.
Does scraping follower lists count as first-party data?
No. First-party data comes from people who interacted with you and knew they were giving you information. A scraped list is neither, which makes it a compliance problem under GDPR rather than a marketing asset, and it will not survive a records-of-consent request.
Which is more valuable, a follower or an email subscriber?
An email subscriber, for the reason that has nothing to do with engagement rates: it is a record you keep. A follower is an entry on a list Instagram maintains, subject to reach decisions you do not control and to account actions you cannot appeal directly. An address moves with you across platforms, uploads into ad targeting as a Custom Audience, and survives the account.
Instagram API fields, messaging windows, private-reply rules and rate limits verified from developers.facebook.com as of August 2026. Consent standards from EU Regulation 2016/679 and EDPB Guidelines 05/2020 on consent. Account-dispute figures from the Appeals Centre Europe Transparency Report, May 2026. Engagement benchmarks from the Metricool 2026 Instagram Study (24,364,803 posts, January to February 2026), which measures engagement against reach rather than followers. Email click-rate benchmark from MailerLite, December 2025. Competitor pricing and integration lists verified from manychat.com help center, linkdm.com, klaviyo.com and help.klaviyo.com, August 2026. Klaviyo Social Marketing pricing is not published. Individual results vary by audience, offer, and list quality.
