Ofcom opens first Online Safety Act investigation into Meta over Instagram Instants risk checks

On October 6, 2026, Britain's communications regulator Ofcom opened its first formal investigation under the Online Safety Act into Meta, examining whether the company properly assessed illegal-content and child-safety risks before launching Instagram Instants in May 2026. The inquiry focuses on a single feature, but it carries significance for how the United Kingdom's online safety regime treats new products that let users share disappearing content. Ofcom has not found a breach. Meta says it conducted a risk analysis, briefed Ofcom several times before launch and will cooperate.

Instagram Instants allows users to share content that disappears after it is viewed. That design choice limits persistence and public visibility, but it also creates challenges for regulators who must judge whether a platform has done enough to keep illegal material and harmful interactions away from children. The Online Safety Act requires social media companies to conduct risk assessments before significant design or operational changes. Ofcom's enforcement director, George Lusty, said significant platform changes must be risk assessed before launch, and he described safety as something that must be built into products from the start.

The investigation will establish whether Meta carried out a 'suitable and sufficient' assessment of both illegal-content risks and risks to children before Instants went live, according to Reuters. Ofcom will consider two risk assessments required by law: the risk of illegal content on Instants and risks to children, and whether Meta completed both before the feature was released. The regulator can order compliance or remediation if a breach is found, and it can impose a fine of up to £18 million or 10 percent of qualifying worldwide revenue, whichever is greater. Meta says Instants includes protections such as blocked screenshots, blocked reshares, blocked forwarding, no public feed, and Teen Account safeguards enabled automatically for users under 18.

Key Facts

Reuters reported on October 6, 2026, from London that Ofcom opened its first formal investigation into Meta under the Online Safety Act. The inquiry asks whether Meta properly assessed risks from Instagram Instants before launching the feature in May 2026. Instants lets Instagram users share content that disappears after it is viewed. Ofcom said it will establish whether Meta carried out a 'suitable and sufficient' assessment of both illegal-content risks and risks to children before launch.

George Lusty, Ofcom's director of enforcement, said significant platform changes must be risk assessed before launch. The Guardian reported on October 6, 2026, that Lusty said assessments are vital to user safety and that safety by design should be built in. The Guardian also quoted him warning that Ofcom will act when it has compliance concerns. The report says Ofcom is investigating whether Meta breached the Act by failing to carry out adequate checks on whether Instagram Instants could show illegal content or be accessed by children.

Meta said it takes its Act obligations seriously, conducted a risk analysis, briefed Ofcom several times before launch, and will cooperate. Meta said Instants includes protections such as blocked screenshots, blocked reshares, blocked forwarding, no public feed, and Teen Account safeguards enabled automatically for users under 18. A Meta spokesperson said it would cooperate.

The Next Web reported on October 6, 2026, that Ofcom will consider two risk assessments required by law: the risk of illegal content on Instants and risks to children, and whether Meta completed both before the feature went live. The article says platforms must update risk checks before significant changes to how a service works. The next steps are evidence gathering and review. If Ofcom sees a likely breach, it will issue a provisional decision and give Meta a chance to respond before a final ruling. Reuters noted that Ofcom can impose up to £18 million or 10 percent of qualifying worldwide revenue, whichever is greater, for non-compliance. The Guardian also says Ofcom was already investigating Meta over its response to an information request about WhatsApp.

Analysis

What this really means is that Ofcom is testing the Online Safety Act's safety-by-design requirement on a single new feature, and the outcome will shape how platforms approach pre-launch risk assessments. The Act requires social media companies to conduct risk assessments before significant design or operational changes. Instagram Instants, which launched in May 2026, is exactly the kind of ephemeral, image-based feature that can be introduced quickly and scaled widely. Regulators want to know whether the company's pre-launch work matched the legal standard, not just whether the feature has safeguards after launch.

The investigation is procedural in focus but substantive in effect. Ofcom will examine two required risk reviews: illegal content and risks to children. George Lusty, Ofcom's director of enforcement, said significant changes must be assessed before launch and described safety as something that must be built into products. That framing puts the burden on companies to document their assessments before release. Meta says it conducted a risk analysis and briefed Ofcom several times before launch, which suggests the company believes it met the procedural bar. Ofcom has not said it found a breach.

The bigger picture here is that Ofcom now has its first formal Online Safety Act investigation into Meta, and the case will set expectations for how the regulator handles rapid product launches. Reuters reported on October 6, 2026, that the investigation is the first of its kind into Meta under the Act. The Guardian reported on October 6, 2026, that potential enforcement can range from a formal warning to a fine of up to 10 percent of global revenue. The Next Web reported on October 6, 2026, that if Ofcom sees a likely breach, it will issue a provisional decision and give Meta a chance to respond before a final ruling. This is a process with multiple stages, and the early stage defines what evidence Ofcom will demand.

For Meta, the case adds to an existing regulatory workload. The Guardian says Ofcom was already investigating Meta over its response to an information request about WhatsApp. The Instants probe is separate, but it reinforces a pattern of scrutiny over how Meta communicates with regulators and documents risk decisions. Meta's stated safeguards for Instants, including blocked screenshots, blocked reshares, blocked forwarding, no public feed, and Teen Account safeguards enabled automatically, are designed to address some of the risks Ofcom is examining. The question is whether those safeguards were part of a suitable and sufficient pre-launch assessment, as the Act requires.

Why It Matters

The outcome will matter beyond Instagram. The Online Safety Act requires social media companies to conduct risk assessments before significant design or operational changes. If Ofcom concludes that Meta's pre-launch work was inadequate, the finding would signal that regulators expect detailed, documented risk reviews even for features that disappear after viewing. If Ofcom concludes the work was adequate, the case still establishes a template for how companies should record and share their assessments with the regulator. Either way, the investigation clarifies the compliance bar for new products.

The case also matters for children. Ofcom is examining whether Meta properly assessed risks to children before launching Instants. The feature lets users share content that disappears after it is viewed, which can make oversight harder for parents and regulators. Meta says Teen Account safeguards are enabled automatically for under-18s, and it blocks screenshots, reshares and forwarding, and offers no public feed. Those measures are part of the company's answer to child-safety concerns. Ofcom's inquiry will test whether the company's pre-launch assessment captured those concerns before the feature went live.

For the wider platform industry, the first formal Online Safety Act investigation into Meta is a signal about enforcement priorities. Ofcom can impose up to £18 million or 10 percent of qualifying worldwide revenue, whichever is greater, for non-compliance. The regulator has said it will act when it has compliance concerns. Companies launching ephemeral or image-based features will watch how Ofcom weighs pre-launch documentation against post-launch protections. The investigation is an inquiry, and no finding of liability had been made at publication.

Next Up

Ofcom will gather evidence and review it. The Next Web reported on October 6, 2026, that if Ofcom sees a likely breach, it will issue a provisional decision and give Meta a chance to respond before a final ruling. Meta has said it will cooperate with the investigation. The company said it takes its Act obligations seriously, conducted a risk analysis, and briefed Ofcom several times before launch. Those briefings and the company's risk analysis will be central to the evidence phase.

If Ofcom finds a breach, it may order compliance or remediation and can impose a fine of up to £18 million or 10 percent of qualifying worldwide revenue, whichever is greater. The Guardian reported on October 6, 2026, that potential enforcement can range from a formal warning to a fine of up to 10 percent of global revenue. For now, the investigation is an inquiry. The report does not say Ofcom has found a breach. The next visible step will be Ofcom's assessment of the evidence, followed by a provisional decision if the regulator believes a breach is likely.