Summary

  • Ofcom opened an investigation on 6 October into whether Meta carried out suitable and sufficient illegal-content and children’s risk assessments before Instagram Instants launched on 13 May.
  • The case tests the release process required by sections 9(4) and 11(4) of the Online Safety Act. It has not established a breach, a user injury or an unsafe feature.

The question sits at the launch gate

Instagram Instants arrived inside Instagram Direct. The feature lets a user take a photo or video in the app, add a caption and send it automatically to friends or followers; the content disappears after it has been viewed. Those details describe the product. They do not establish what risks the feature creates.

Ofcom’s 6 October announcement and its open case record identify a narrower question: did Meta carry out further, suitable and sufficient risk assessments before this significant design or operational change went live? The record names sections 9(4) and 11(4) of the Online Safety Act 2023. Both provisions require a further assessment before a significant change; one concerns illegal-content risk, while the other concerns risks to children on services likely to be accessed by children.

That timing matters. A review written after release may help respond to incidents, but it cannot show that the provider examined the proposed change before users encountered it. The legal question is not whether every new button requires a separate document. It is whether this change was significant and whether the relevant assessments were suitable and sufficient for the feature actually designed.

One launch, two assessment duties

The two duties should not be collapsed into a generic “safety review.” Under section 9, the provider assesses illegal-content risk. Under section 11, it assesses children’s risk, including differences between age groups and how service design and functionality affect exposure. The statute also asks providers to consider the content pathways and operational systems that can increase or reduce those risks.

For Instants, a decision-grade record would therefore need to connect the feature’s actual mechanics to the risks considered: where it appears in Direct, how a photo or video is composed and sent, who can receive it, what the viewing and expiry rules do, and which safeguards or reporting paths remain available. These are evidence questions for the investigation, not claims that Ofcom has already found a weakness in any one of them.

Ofcom’s 2025 review of 104 risk-assessment records found recurring problems in feature analysis, use of relevant evidence, confidence in controls and risk governance. That review supplies context for the regulator’s quality standard; it does not report on Meta’s assessment of Instants and cannot decide this case.

An open case is not a verdict

Ofcom says its first step is to gather and analyse evidence. If it considers that a compliance failure occurred, it will issue a provisional decision and give Meta an opportunity to respond before a final decision. Only then could remedies or a penalty follow. The regulator’s published case page expressly says that opening an investigation does not mean it has concluded that Meta breached the Act.

The public record currently establishes the feature’s launch date, the legal provisions under examination and the regulator’s open question. It does not disclose a final finding, an actual harm determination or the contents of Meta’s underlying assessment. Those boundaries should stay visible while the case develops.

Sources