On 6 October 2026, Ofcom opened a formal Online Safety Act investigation into Meta. It is examining whether Meta carried out a "suitable and sufficient" illegal-content risk assessment and a children's risk assessment before launching Instagram Instants, a disappearing-content feature, in May 2026. If Meta is found in breach, it faces a fine of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
The strongest case for the investigation
The argument for acting is serious. Ephemeral content is harder to report, preserve and review after the fact. A feature built around disappearance can leave a child with no evidence of grooming or harassment, and leave a regulator with nothing to inspect. If the risk is highest at launch, a duty to assess risk before launch is the sensible place to intervene. Ofcom's enforcement director, George Lusty, put it this way: "Safety by design must be built in, not bolted on, and today's investigation shows we'll take action where we have concerns that providers are failing to comply." (Ofcom)
The investigation is also narrower than headlines may suggest. Ofcom is not alleging that Instants has harmed anyone. It is asking whether a documented assessment existed and was adequate before launch. That is a process question, and Ofcom can answer it from Meta's own records.
What the law requires, and what it does not
The Online Safety Act 2023 requires providers to assess risks to users, and for services likely to be accessed by children, risks to children. The GOV.UK explainer says services "must assess any risks to children from using their platforms," and that the children's risk assessment deadline was 24 July 2025 after an extension from the earlier April access-assessment stage (GOV.UK). The same explainer confirms the penalty ceiling of £18 million or 10% of qualifying worldwide revenue.
The duty is to assess, and to mitigate what the assessment finds. It is not a licensing regime. Nothing in the process Ofcom describes requires a provider to obtain approval before shipping a feature. Ofcom says it will gather evidence, and if it finds non-compliance it will issue a provisional decision and let the company respond before any final determination.
That sequence matters for innovation. Product teams can live with a rule that says: document the risks you foresee, show what you did about them, and be ready to explain it. They cannot live with a rule that treats every novel feature as presumptively unlawful until a regulator signs off.
Meta's defence and the evidence question
Meta says it "conducted a risk analysis and briefed Ofcom about this feature on a number of occasions before launching it," and points to built-in protections, including screenshot blocking and automatic Teen Account protections (LBC). If true, the dispute is not whether Meta thought about risk. It is whether the assessment met the statutory standard of being "suitable and sufficient."
That is the hard part. "Suitable and sufficient" is a flexible standard, and the more flexible the standard, the more the outcome depends on regulatory judgment after the event. An assessment that looked reasonable in April could look thin in October once Ofcom has seen how the feature is used. Hindsight is a poor basis for a penalty that can reach 10% of global revenue.
The question about briefings is also important. If a company tells its regulator about a feature repeatedly before launch and is then investigated for its risk assessment, other companies will draw a lesson. They may brief less, share less, or delay launches in the UK. A regime that wants early engagement should say clearly how that engagement counts when the assessment is later judged.
The enforcement record so far
Ofcom has issued more than £7 million in fines to 11 providers since October 2025 (LBC). One example is 4chan, fined £520,000, including £450,000 for failing to protect children from pornographic content. Those cases involved services with no age checks on adult material. The Meta case is different in kind: a large, well-resourced provider that says it did the work, accused of not doing enough of it.
This does not follow from earlier Ofcom action alone. On 12 March 2026, Ofcom issued legally binding information requests to Instagram and other major platforms about child protection (Digital Policy Alert). The Instants investigation is the first step in this series that tests a specific product launch.
What a proportionate outcome looks like
A proportionate outcome would do three things. First, Ofcom should publish what it considers a "suitable and sufficient" assessment for a feature of this kind, so that other providers can calibrate. Second, it should treat pre-launch engagement as a mitigating factor rather than a reason for suspicion. Third, any penalty should track demonstrated gaps in protection, not the size of the company's revenue.
The free-expression angle is easy to miss. Ephemeral messaging is valued by people with good reasons to avoid permanent records: abuse survivors, dissidents, and teenagers talking about sensitive subjects. A regime that pushes providers to strip out disappearance entirely, to be safe, would remove a privacy feature from everyone in exchange for a risk that targeted mitigations could address.
The investigation is legitimate. Whether it is a good precedent depends on whether Ofcom uses it to clarify the standard or to expand it.