Summary

• Ofcom is investigating Meta’s risk assessment process before Instagram Instants launched.
• The case concerns illegal content and children’s risk assessment duties under sections 9 and 11 of the Online Safety Act.
• Opening the investigation does not mean Ofcom has concluded that Meta broke the law.

Ofcom has opened an investigation into whether Meta adequately reassessed illegal content and child safety risks before launching Instagram Instants, putting the Online Safety Act’s rules around significant product changes into a live enforcement case.

The regulator is examining whether Meta carried out suitable and sufficient further risk assessments before introducing the feature. Instants launched in May and allows Instagram users to capture photographs or video and distribute the material immediately through Instagram Direct.

No breach has been established. Ofcom says opening an investigation means it has begun gathering and assessing evidence, not that it has concluded Meta failed to comply with the law or that Instants has already caused a specific illegal or harmful incident.

The case centres on sections 9 and 11 of the Online Safety Act. Providers of regulated user to user services must assess risks around illegal content, while services likely to be accessed by children carry additional assessment duties. Both provisions require another assessment before a significant change to a service’s design or operation.

A feature can reopen the risk assessment

That requirement prevents a large platform from treating safety analysis as something completed once for the service as a whole. A new sharing mechanism, recommendation system or messaging function can alter how users behave even when it appears inside an established application.

Instants gives Ofcom a concrete case on which to test that principle. The regulator describes the feature as allowing users to add a caption before capturing material and sending it immediately, with the resulting content designed to be ephemeral.

The legal question is therefore procedural as well as technical. Meta needs to show what risks it examined before launch, whether the change was treated as significant and how any resulting findings influenced the design or safeguards around the feature.

Ofcom has emphasised that risk assessment sits at the centre of its safety by design approach. A provider cannot decide which protections are proportionate without first establishing how a feature could change exposure to illegal material or content harmful to children.

That moves regulatory work further into ordinary product development. Companies operating regulated services need processes capable of identifying when a proposed feature is significant enough to trigger another formal assessment before engineers make it available to users.

Compliance becomes continuous product governance

Large platforms change constantly. Interfaces are redesigned, messaging behaviour is adjusted and new formats are introduced through frequent software releases. If the Online Safety Act operated only through periodic platform wide assessments, material product changes could accumulate between reviews.

Sections 9 and 11 address that gap by attaching duties to significant changes themselves. The investigation will help establish how Ofcom applies that concept in practice and what evidence it expects a company to hold when challenged.

Not every interface adjustment can reasonably require the same regulatory process. The difficult boundary lies in determining when a change alters user behaviour or exposure enough that an existing assessment no longer captures the relevant risk.

Meta’s internal records are likely to be central. Product documents, safety analysis and the timing of decisions can show whether risk assessment influenced the launch before it happened rather than being reconstructed after regulatory scrutiny began.

For other technology companies, that creates an operational requirement extending beyond a legal team. Product managers, engineers, safety specialists and compliance functions need a shared process capable of flagging features whose design may change regulated risks.

If Ofcom ultimately finds a breach, the Online Safety Act provides substantial enforcement powers, including financial penalties. Reaching that stage would require the regulator to complete its investigation and follow the statutory process before making a final determination.

The current case remains far earlier in that sequence. Ofcom has not claimed that Instants itself is unlawful, that a particular user has suffered harm because of it or that Meta deliberately ignored a known risk.

The narrower issue may prove more important for the wider market. A company can maintain extensive safety policies and still face scrutiny if it cannot show that those policies were applied when a product changed.

That makes the investigation a test of operational governance rather than a referendum on one social media feature. The Online Safety Act assumes that risk evolves with the service, and Ofcom is now examining whether Meta’s assessment process evolved with Instagram when Instants was added.