Ofcom opened a formal investigation into Meta yesterday for launching Instagram Instants without the risk assessment the law requires. Its own records show Meta had already promised to warn it first.
Estimated reading time: 7 minutes
.jpg){kind=link}
In short. Ofcom announced on 6 October 2026 that it has opened a formal investigation into whether Meta broke its Online Safety Act duties by not carrying out "a suitable and sufficient illegal content risk assessment and children's risk assessment" before launching Instagram Instants in May 2026 [1]. The announcement says only that Ofcom "warned major platforms" earlier in the year. Its own 12 March letter named Instagram directly, with a deadline of 30 April [2], and its own 21 May progress report records that Meta had already committed to notify Ofcom before launching changes of this kind, a commitment logged before Instants went live on 13 May (page 11) [3] [6]. Three documented mistakes: four stars.
Instants is a small feature by Instagram's standards. Launched inside Direct Messages on 13 May 2026, it lets users share a photo with close friends or mutual followers that disappears once viewed, with screenshots blocked [6]. Five months later, on 6 October, Ofcom opened a formal investigation into whether launching it complied with the Online Safety Act. "Ofcom has today opened an investigation into whether Meta has failed to comply with its duties under the UK's Online Safety Act, by not adequately assessing the risks posed by Instagram Instants before it launched" [1].
The legal basis is real and specific. Sections 9 and 11 of the Online Safety Act 2023 each carry the same operative line: "Before making any significant change to any aspect of a service's design or operation, a duty to carry out a further suitable and sufficient illegal content risk assessment relating to the impacts of that proposed change" [4], with section 11 repeating it word for word for children's risk assessments [5]. Ofcom's enforcement director, George Lusty, put it plainly: "Our online safety laws are clear - significant changes to platforms must be risk assessed before they're launched" [1]. What the announcement does not say is how long, and how specifically, Ofcom had already been telling this one company exactly that.
The warning was not general. It had Instagram's name on it
The announcement's own account of the run-up reads as background colour: "Earlier this year, we warned major platforms they could face enforcement action if they did not assess the risk of significant changes before they are deployed" [1]. Ofcom's own 12 March 2026 release shows what that warning actually was. "On 12 March we wrote to the tech firms most popular with children - Facebook, Instagram, Roblox, Snapchat, TikTok and YouTube" (page 3) [3], one of four named demands being "an end to product testing on children": "They must conduct risk assessments for significant updates, such as the launch of new AI tools, to ensure these updates have been made safe for children before being deployed and tell Ofcom when they have done so" (page 3) [3]. Ofcom's own news page for that letter headlines it as addressed to "Facebook, Instagram, Roblox, Snapchat, TikTok and YouTube", with "a deadline of 30 April to report back" [2]. This was not a sector-wide reminder. It was a dated, written demand naming Instagram, with the precise failure Ofcom now alleges spelled out as one of four numbered points.
Meta's own promise, on Ofcom's own file, before Instants launched
The 30 April deadline sat thirteen days before Instagram launched Instants on 13 May [6]. Ofcom published its scorecard of the responses on 21 May, and the summary of Meta's reply is unambiguous: "Meta committed to notifying Ofcom when it has updated its risk assessment due to a significant change" (page 11) [3]. Ofcom's own overview describes what that commitment was supposed to buy it: "This will mean that Ofcom can be made aware of new products and features before they are launched and made available to children" (page 4) [3]. Meta's reply had to exist by the time that 21 May report went to press, which puts the commitment on Ofcom's file before, or at the very latest within days of, the 13 May launch it would go on to investigate. The 6 October announcement calls this a question of whether Meta "failed to comply with its duties under the Act". Ofcom's own May report shows it was also, on its own telling, a promise to the regulator that had just been made and immediately tested.
The same 21 May report spends a page tracking Meta's child-safety commitments on Instagram in detail, including plans for "AI tools to detect likely sexualised conversations between adults and teens in Instagram Direct messages" (page 11) [3]. Instants is itself a Direct Messages feature, built around disappearing photos sent to close friends [6]. Eight days after it launched, Ofcom's own close reading of Meta's Instagram DM plans had nothing to say about it.
The claims, tested
| Ofcom's own words | What the record shows | Verdict |
|---|---|---|
| "Earlier this year, we warned major platforms they could face enforcement action if they did not assess the risk of significant changes before they are deployed" [1] | The 12 March letter named Instagram directly among six platforms, with a 30 April deadline and "an end to product testing on children" as one of four numbered demands (page 3) [2] [3] | A dated, personalised written demand, downgraded to a generic "warned major platforms" |
| The investigation tests whether Meta "failed to comply with its duties under the Act" [1] | Ofcom's own 21 May report records Meta's specific commitment "to notifying Ofcom when it has updated its risk assessment due to a significant change" (page 11), logged before or within days of Instants' 13 May launch [3] [6] | A statutory duty is the framing offered; Ofcom's own file shows a specific, dated promise too |
| The 21 May report details Meta's Instagram Direct Messages safety commitments at length (page 11) [3] | Instants, an Instagram DM feature launched eight days earlier, is not mentioned anywhere in that report [3] [6] | Ofcom's own close tracking of Meta's Instagram DM plans missed the feature it is now investigating |
The mistakes, counted
A personalised, dated demand is described as a general warning (1). The 6 October announcement's "we warned major platforms" has no name and no date attached. Ofcom's own March letter did: Instagram, named alongside five other platforms, with a 30 April deadline and the exact duty now at issue written out as one of four demands [1] [2].
The investigation announcement omits Meta's own prior commitment to Ofcom (2). The May progress report records Meta's promise, in its own words, to notify Ofcom before launching changes like Instants. That promise, made before or within days of the launch under investigation, does not appear in the October announcement at all [1] [3].
Ofcom's own May tracking of Meta's Instagram DM commitments did not catch the feature it now investigates (3). A report that lists Meta's Instagram Direct Messages safety plans in detail, published eight days after Instants launched inside that same surface, says nothing about it [3] [6].
Credit where due
The investigation announcement is honest about what it has not yet decided. George Lusty's quote says Ofcom "will take action where we have concerns", not that a breach has been proven [1], and the process section sets out the sequence plainly: gather evidence, issue a provisional decision, let the company respond, then decide, with the maximum penalty, "up to £18 million or 10% of qualifying worldwide revenue, whichever is greater", stated upfront rather than left for a reader to find elsewhere [1]. And the March demand this piece says is undersold was not vague on its own terms either: it gave six named platforms a hard date, said what it expected in plain English, and followed through with a published scorecard of who had and had not committed. The system did what it was supposed to do up to May. What the October announcement does not explain is why none of that record made it into the document announcing the result.
Verdict
Four stars, from three documented mistakes. Nothing here says Meta's defence to the investigation will fail; that is still Ofcom's process to run. What Ofcom's own public record shows is a regulator that wrote to Instagram by name in March, received and logged Meta's promise to flag changes like this before they went live in May, and then opened an investigation in October into exactly that scenario without telling readers any of the first two parts.
The star score counts three documented mistakes against Ofcom's own public record: the 6 October investigation announcement's "warned major platforms" line, compared against its own 12 March letter naming Instagram directly with a 30 April deadline; the announcement's statutory-duty framing, compared against Meta's own notify-before-launch commitment logged in Ofcom's 21 May progress report before or within days of the Instants launch; and that same 21 May report's detailed tracking of Meta's Instagram Direct Messages safety commitments, which does not mention Instants despite being published eight days after it launched inside that feature. Three falls in the 1 to 3 band: four stars; the bands are on the ratings page. This piece makes no finding on the merits of the investigation itself, which Ofcom has not yet decided. Checked against Ofcom's 6 October 2026 investigation announcement, its 12 March and 21 May 2026 publications, sections 9 and 11 of the Online Safety Act 2023 on legislation.gov.uk, and TechCrunch's contemporaneous report of the 13 May 2026 Instants launch.
Sources
- Ofcom investigates Meta's compliance with UK online safety laws, Ofcom, published 6 October 2026
- Keep underage children off your platforms, Ofcom tells tech firms, Ofcom, published 12 March 2026, last updated 15 June 2026
- Update: tech firms' responses to our call for action to protect children (PDF), Ofcom, published 21 May 2026
- Online Safety Act 2023, Section 9: Illegal content risk assessment duties, legislation.gov.uk
- Online Safety Act 2023, Section 11: Children's risk assessment duties, legislation.gov.uk
- Instagram's new 'Instants' feature combines elements from Snapchat and BeReal, TechCrunch, published 13 May 2026