Ofcom's first Meta probe is about paperwork, not peril

Ofcom has opened its first formal investigation into Meta under the Online Safety Act. Announced on Tuesday 6 October 2026, it asks a narrow but pointed question: did Meta carry out the illegal-content and children's risk assessments the law requires before it launched Instants, the disappearing photo and video feature it added to Instagram in May?

"Our online safety laws are clear – significant changes to platforms must be risk assessed before they're launched."
— George Lusty, Director of Enforcement, Ofcom

A feature that vanishes, and a paper trail that mustn't

Instants lets Instagram users share photos and videos through Direct that disappear once they have been viewed. Meta says it blocks screenshots, reshares and forwarding, has no public feed and applies Teen Account protections automatically, according to TechRepublic.

Ofcom's interest is not, at this stage, in whether any of that works. It is investigating whether Meta completed "suitable and sufficient" risk assessments covering illegal content and children before switching the feature on, as the Act expects for any significant change to a service. Ofcom will gather evidence and, if it thinks a breach is likely, issue a provisional decision that Meta can respond to before any final ruling. It has given no timetable.

If a breach is eventually found, Ofcom can order Meta to put things right and fine it up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.

Meta says it did the homework and showed the teacher

Meta disputes the premise. A spokesperson told TechRepublic: "We conducted a risk analysis and briefed Ofcom about this feature on a number of occasions before launching it." The company also told Silicon UK: "We will of course cooperate with Ofcom during this investigation."

That sets up the interesting bit. If Meta really did brief the regulator several times, the dispute is probably less about whether any thinking happened and more about whether it was the right kind, written down in the right form, and covered what the law says it must. Lusty was blunt about the principle: "You wouldn't launch a new car without testing it properly, and it's the same for online services. Safety by design must be built in, not bolted on."

This is a process case, not a verdict on Instants

It is worth being precise, because the headlines won't always be. Ofcom has not found that Instants is unsafe. It has not said children have been harmed by it. What it is testing is the order of operations: assess first, launch second.

That matters well beyond one Instagram feature. The Online Safety Act's whole design leans on platforms judging their own risks and writing that judgement down. If the biggest social media company in the country can be pulled up for the paperwork alone, every service in scope has a reason to treat the risk assessment as a launch gate rather than a document tidied up afterwards.

It also tests Ofcom. Its record on actually collecting money has been patchy, as we noted when most Online Safety Act fines were still unpaid. Taking on Meta over process, rather than proven harm, is a cleaner fight to win, but only if the evidence about what Meta assessed, and when, is on Ofcom's side.

A relationship that was already frosty

The investigation does not arrive in a vacuum. Silicon UK reports that Meta is taking legal action against Ofcom over parts of the Act, including the fees regime and the designation of Instagram and WhatsApp as services in a special category. Separately, Ofcom is investigating whether Meta failed to comply with an information request about WhatsApp Business made under the Communications Act.

Campaigners welcomed the move. Rowan Ferguson of the Molly Rose Foundation said: "This positive move by Ofcom must be matched with a swift and robust investigation of Meta," according to the Press Association.

For UK users, the practical point is this: Instants remains available while the investigation runs, and nothing Ofcom has said so far tells parents to treat it differently from any other disappearing-message feature. The age-check debates of recent weeks, including Discord's age estimation plans, show how quickly these rules are reshaping what platforms switch on in Britain, and when.

To be fair to Meta

Disappearing messages are hardly new; Snapchat built a business on them. Meta says it added screenshot blocking and Teen Account protections from day one, and that it talked to Ofcom before launch. If those briefings were substantive, it is reasonable to ask why the regulator didn't raise concerns at the time rather than afterwards. An investigation is an allegation to be tested, not a finding, and Meta may yet be cleared.

Mind the hype. And if you're launching something in the UK, mind the paperwork first.

Sources: Ofcom · TechRepublic · Silicon UK · Press Association via AJ Bell · Telecoms.com