Ofcom Investigates Meta Over Instagram Instants Safety Checks

Ofcom opens its case against Meta

Britain's communications regulator has opened a formal investigation into whether Meta breached UK online safety laws with the launch of its Instagram Instants feature. Ofcom said on Tuesday it would establish whether the company failed to comply with its duties under the Online Safety Act by not carrying out a "suitable and sufficient" illegal content risk assessment and children's risk assessment before Instants launched in May.

"Our online safety laws are clear — significant changes to platforms must be risk assessed before they're launched," said George Lusty, Ofcom's director of enforcement. "This is a vital step that tech firms must take to protect their users. You wouldn't launch a new car without testing it properly, and it's the same for online services." He added that safety by design had to be built in rather than bolted on: "Today's investigation shows we'll take action where we have concerns that providers are failing to comply." The BBC first reported the probe, and Ofcom's own announcement sets out the investigation process in full. Our technology coverage follows every development in the UK's online safety regime.

What Instagram Instants is

Instants is a feature inside Instagram that lets users take and share an instant image with close friends — content that disappears once it has been viewed. It rolled out to users in May, and Ofcom's concern centres on what the company did, or did not do, to assess the feature's risks before that launch.

Disappearing images have previously been singled out by safety experts as posing particular risks for children and teenagers: content that vanishes after viewing is harder for parents, moderators and law enforcement to detect and evidence, which can make it attractive for bullying, sextortion and the sharing of illegal material. That context explains why the regulator is examining not just the feature's design but the homework Meta did before releasing it. The feature's risks echo wider concerns about Meta's AI products, including the privacy backlash over its Muse image tool on Instagram.

!A US Army graphic promoting online safety and caution while using social media Online safety campaigns stress caution on social media — the principle behind the UK's risk-assessment rules. Image: U.S. Army / Wikimedia Commons (Public domain).

What the law demands

The Online Safety Act, passed in 2023, sets obligations for social media platforms, search engines and adult content providers to tackle illegal content and protect children's safety. Regulated services must carry out risk assessments showing how they prevent users encountering illegal material, while services likely to be accessed by children must additionally assess risks to under-18s. Platforms must also conduct fresh risk assessments before making significant changes to their design or operation — the duty at the heart of the Instants case.

The harms in scope include what the regime calls "priority" illegal content and material harmful to children, spanning pornography, content encouraging self-harm and suicide, and child sexual abuse material. Ofcom requires companies not only to assess these risks but to implement mitigations such as age verification and safety-by-design measures. Channel News Asia's report, citing Reuters, notes the investigation will test whether Meta's pre-launch work met the "suitable and sufficient" bar the law sets. The children's-safety dimension also connects to Westminster's broader agenda, from the proposed midnight social media curfew for teens to doctors' warnings about vaping risks to children.

Meta's defence

Meta rejects the suggestion it skimped on safety work. "We conducted a risk analysis and briefed Ofcom about this feature on a number of occasions before launching it," a spokesperson said, adding that the company takes its regulatory obligations under the Online Safety Act seriously and will cooperate with the investigation.

The company points to protections built into Instants from the start: blocking of screenshots, reshares and forwarding, no public feed for the feature, and Teen Account protections applied automatically. The question for Ofcom's investigators is whether those design choices were the product of the rigorous, documented risk assessment the Act requires — or whether the paperwork followed the product. As the Britain Herald summarised, the probe turns on the adequacy of Meta's pre-launch assessments rather than on any specific incident. Meta is no stranger to Ofcom enforcement: the regulator previously hit Virgin Media with a £28 million fine over customer cancellation practices.

A wider court battle over Ofcom's powers

The investigation lands in the middle of an increasingly adversarial relationship between the tech giants and the regulator. Meta, TikTok and X are simultaneously challenging Ofcom's information demands under the same legislation in a London court, in one of the first major courtroom tests of the 2023 Act. The hearing opened on Monday and concludes on Wednesday, with a separate Meta legal challenge over how Ofcom calculates fees and penalties expected next week.

At issue are information notices Ofcom issued in February requesting detailed content-moderation metrics — how many posts the companies removed or hid, and how many users were exposed to harmful content. The companies say the demands create unprecedented regulatory burdens: X told the court the request was "the most burdensome information request X has received from any regulator in any jurisdiction", while Meta said Ofcom wanted "wide-ranging and granular information" about seven of its services for no clearly defined regulatory purpose. TikTok argued the regulator had circumvented an alternative monitoring regime. Ofcom countered that the data is genuinely needed to judge whether the regime is working. "Parliament has charged us with the job of regulating an industry that has been unregulated and unaccountable for more than 20 years," a spokesperson said, according to Reuters. The Times of India also covered the mounting pressure on Meta over the Instants launch.

What enforcement could look like

Ofcom's investigation process has several stages. First it gathers and analyses evidence to determine whether a breach occurred. If it provisionally concludes there was a compliance failure, it issues a provisional decision, the company gets to respond in full, and only then does Ofcom make a final decision. If a breach is confirmed, the regulator can require specific steps to bring the platform into compliance and remedy harm — and it can impose fines of up to £18 million or 10 percent of qualifying worldwide revenue, whichever is greater.

The Instants probe is Ofcom's first formal investigation into Meta under the Act, but not its first enforcement action overall: its inaugural investigation targeted an online suicide discussion forum last year, followed by probes into pornography sites, file-sharing services used to distribute child sexual abuse material, and platforms such as 4chan. Earlier this year Ofcom warned major platforms they could face enforcement action if they deployed significant changes without assessing the risks first — a warning this week's investigation puts into practice. For platforms, the message is that "safety by design" is now a legal duty with a paper trail, not a slogan. The case will also be watched closely by privacy advocates, given parallel concerns such as the hidden privacy risks of period-tracking apps and the rogue ChatGPT security incidents that have sharpened scrutiny of tech safety claims. Updates on the investigation will appear in Verity's technology section as Ofcom publishes them.