Ofcom turns up the heat on Meta
Ofcom’s opened a probe into Meta over Instagram Instants, a disappearing-image feature that looks a lot like the photo-sharing tricks that made Snapchat a habit for millions of users. The regulator wants to know whether Meta broke UK online safety rules when it launched the product, and the centre of that inquiry’s simple enough to explain even if the law around it isn’t: did the company do the required risk assessment before turning the feature on?
That question lands at a tricky moment for Meta. The UK’s Online Safety Act doesn’t treat major product changes as a bit of harmless app housekeeping. If a platform adds a new feature that could affect how users share content, who sees it, or how children might use it, the company’s expected to check the dangers first. In other words, the paperwork isn’t decorative. It’s part of the safety process. For Ofcom, the issue is whether Instagram Instants went live with the right checks in place, or whether Meta moved first and asked questions later.
A disappearing photo may vanish in seconds, but the duty to assess its risks does not.
That may sound dry, yet it sits right at the heart of Britain’s online-safety regime. The law is built on the idea that platforms shouldn’t wait for complaints, bad headlines, or a pile of awkward moderation reports before thinking about the consequences of a new tool. A feature like Instagram Instants might seem small compared with a feed overhaul or a new messaging system, but regulators tend to care less about the product’s glamour than about the harm it could invite. If an image disappears after viewing, that can change how people share sexual content, bullying material, or other posts that’d otherwise leave a visible trail.
Ofcom hasn’t said Meta is guilty of anything yet. It’s said enough to make the point clear, though: the watchdog’s examining whether the company complied with the legal requirement to assess risks before rollout. That leaves Meta with a fairly familiar kind of headache. The company gets to argue that it acted properly. Ofcom gets to inspect whether the process matched the rules. Everyone else gets another reminder that digital culture now lives under a more watchful set of eyes than it did a few years ago.
The possible consequences aren’t trivial. Under the Online Safety Act, Ofcom can start with an official warning. If it thinks a company has crossed the line seriously enough, it can also push for a fine of up to 10% of global turnover. That’s the sort of number that makes even a giant platform pause and check the maths twice. For Meta, the stakes are bigger than one feature. For Ofcom, the case is a test of whether it can force big platforms to treat pre-launch safety checks as more than a box-ticking exercise. And for everyone else watching this bit of tech news, it’s another sign that the UK means to test the rules against the products people actually use, not just the ones policy teams write memos about.
Inside Instagram Instants: Meta’s case for the feature
At first glance, Instagram Instants sounds almost quaint: send a photo, let the other person open it once and then it disappears. The pitch’s simple enough. You take a picture, share it and the image is gone after viewing, which puts it in the same family as the ephemeral messaging tools that have kept disappearing content popular for years. In the world of lifestyle tech, that sort of feature can look harmless. It can look a lot less harmless, in a regulator’s notebook.
Meta describes the product in its launch note for Instants as a quick way to share photos in the moment rather than leave a permanent trail. That is the whole attraction, really. There’s less pressure to polish, less reason to overthink, and more room for the sort of throwaway image that people used to send without treating it like a minor archive event. The disappearing part is the point. So is the feeling that you are sharing something only briefly, without turning it into a permanent object in a feed or inbox.
The company says it did not just fling the feature into the app and hope for the best. Meta says it carried out its own risk review before launch and held multiple conversations with Ofcom ahead of rollout. That matters because the argument here is not simply “we made a new button.” It is “we checked the button before we put it on the screen.” In Meta’s telling, that is what responsible product work looks like when a feature can affect messaging, privacy, and younger users all at once.
A disappearing photo may feel casual, but the safety questions it raises are anything but casual.
On the product side, Meta points to a few protections it says are built in from the start. One of the more obvious ones is forwarding: Instants blocks it, so a recipient can’t simply pass the image along to someone else in the usual tap-and-send fashion. That may sound basic, but basic protections often do the unglamorous work. If a picture vanishes after viewing, the forwarding button is the sort of thing that can quietly undo the whole concept. Meta’s view’s that taking that option away keeps the feature closer to its stated purpose.
There’s also the question of age. Meta says Instants inherits the teen-account safeguards already used across Instagram, Facebook, and Messenger, where those protections are the default for users under 18. In practice, that means the feature sits inside a broader set of controls rather than floating around as a special exception for younger users. The company has been leaning harder on those tools in recent months, including a separate update on parent supervision tools and teen account settings, which give families more visibility into how teen accounts are being used and what they can access.
That setup is clearly central to Meta’s defense. If the company can show that Instants was rolled out inside a system already built for younger users, it gets to argue that the feature was never treated as a free-for-all. The same goes for the risk review. Meta seems to be saying: we looked at the feature, we checked the likely hazards, we spoke with the regulator, and we added limits that stop the most obvious problems from getting out of hand. That is the corporate version of, “Yes, we thought this through before we pressed publish.”
Of course, that does not end the argument. The relevant legal backdrop is section 9 of the Online Safety Act, which ties platform duties to risk assessment and safety processes rather than after-the-fact cleanup. Meta’s position is that it worked within that frame. It says it reviewed the feature before launch, adapted it with protections, and kept Ofcom in the loop rather than surprising the watchdog with a live product and a hopeful smile. In other words, the company wants credit for paperwork as much as for product design.
That may sound dry, but it’s exactly where the fight sits. A feature like Instants lives in the middle of a messy set of questions about what disappears, who can copy what, and how much access teenagers should’ve by default. Meta’s answer’s that the system was built with those worries in mind, not after them. Whether Ofcom buys that argument is another matter entirely, and that’s where the discussion turns from product design to the paperwork the regulator expects to see next.
Why Ofcom thinks the paperwork matters
Meta may be telling a neat story about the product itself. “ In the regulator’s view, that paperwork is the point.
Under section 11 of the Online Safety Act, larger platforms are supposed to carry out risk assessments before major changes go live. Not after launch. Not once complaints start landing. Before. That distinction sounds fussy until you remember what the law is trying to do: make safety part of product design, not a coat of paint applied once the damage is visible.
Ofcom’s enforcement chief, George Lusty, framed the issue in pretty plain language. The basic expectation, he said in effect, is that a company should test a new feature properly before it reaches users. The regulator wants to see the company think through the risks first, write them down and decide what protections belong in the product from day one, if a platform is changing how people share content. No grand theory required. Just adult supervision for software, really (at least in most cases).
In Ofcom’s eyes, a launch without a proper risk check is not a harmless shortcut. It is the moment a platform decides to see what happens and hope for the best.
That logic matters because the regulator’s Worried about one disappearing-image trait. It’s worried about the kind of harms that can move fast once a feature is in people’s hands. The first concern’s illegal content. A Snapchat-style message that vanishes after viewing can still carry abuse, threats, fraud, or other material a platform would rather not discover after the fact. The second concern’s children. Ofcom wants to know whether the service’s checked who can use it, how age limits work and whether the product opens a side door for accounts that shouldn’t be there, if a feature makes it easier for younger users to send or receive private images.
That’s where the regulator’s thinking gets very concrete. Safety checks aren’t just about whether a tool has a report button or a block button tucked somewhere in the menu. They’re about whether the platform considered likely misuse before the rollout, whether it documented the risks, and whether the design itself reduces the chance of harm. A product can be technically clever and still be badly timed. It can also be clever and still create headaches if nobody asked the awkward questions early enough.
For Ofcom, the paperwork is evidence that those questions were asked. The absence of it, or a flimsy version of it, suggests the company treated safety as something to tidy up later. That’s a problem because the Online Safety Act is built around the opposite assumption: if a platform knows it is making a material change, it should be able to show its working before users start tapping away. Regulators are usually less interested in slick launch notes than in whether someone in the building sat through the part of the meeting where everyone says, “Yes, but what could go wrong?”
Meta’s said it completed its own review and discussed the feature with Ofcom before launch, which is exactly the sort of thing a company says when it wants to sound calm and organised. Yet Ofcom’s position appears to be that a conversation isn’t the same as a completed assessment, and an assessment isn’t the same as a safe launch. And it works. The difference may sound bureaucratic, but in online safety law it matters a great deal. If the risk review’s weak, late, or missing altogether, the company may have launched first and asked the right questions later, which is precisely what the act tries to stop.
There’s also a broader point here about how UK tech regulation’s meant to work. The law doesn’t ask platforms to predict every bad outcome. That’d be impossible, and probably enough to keep a whole army of lawyers employed forever. What it does ask for is a documented, serious attempt to spot likely harm before the feature ships. If the feature’s aimed at ordinary users, fine. Even more care, if it can be used by children. The bar goes up again, if it can be abused for illegal content.
So the paperwork is not paperwork in the sleepy office-supply sense. It’s proof that the company thought before it acted. That’s the line Ofcom’s trying to enforce here, and the regulator seems keen to make sure platforms don’t treat safety checks like a chore to be handled once the product is already out the door.
That logic’s what turns this from a product squabble into a test of how seriously the UK wants to police platform design, and it sets up the bigger fight that’s waiting just around the corner.
A wider showdown with the watchdog
This is where the Instagram Instants story starts to look less like a one-off row and more like a standing appointment with the regulator. Ofcom is already examining whether Meta failed to comply with a separate information request tied to WhatsApp, so the new probe arrives while the company is already under a bright lamp. The timing matters because the watchdog is not just asking whether one disappearing-photo feature was checked properly. It’s also testing how much patience it has left for Meta’s wider compliance habits.
At the same time, Meta’s fighting Ofcom in court over the way the watchdog charges firms to help cover its own running costs. Not exactly the kind of legal drama that fills stadiums, granted. But it does tell you plenty about the mood. When a company starts arguing about the bill as well as the rules, the relationship’s moved well past polite disagreement.
Meta is also challenging Ofcom’s decision to place WhatsApp and Instagram into a higher-compliance category under the Online Safety Act. That classification isn’t just a bit of regulatory admin. It changes the level of scrutiny, the obligations on the service and the pressure to prove that social media safety checks are happening before new features go live. Meta appears to think Ofcom’s drawn the line too aggressively. Ofcom, for its part, seems content to keep the line where it put it.
In online safety, the paperwork is not a side quest. It is part of the test.
The dispute has widened beyond Meta alone. The company’s joined TikTok and X in challenging how much information Ofcom can demand from firms under the online-safety regime. That gives the whole thing a larger cast and a cleaner legal question: how far can the regulator go when it asks companies to hand over internal details about products, risks and moderation systems? If Ofcom wins that argument, the pressure on big platforms will harden. The law may end up looking a good deal softer than Parliament probably intended, if it loses.
For Instagram safety checks, that question cuts right to the bone. If regulators can’t see enough of the decision-making trail, they can’t tell whether a platform spotted problems early or papered them over later. And if companies can push back every time Ofcom wants to inspect the details, then the Online Safety Act risks becoming a rulebook full of big promises and thin evidence. Nobody in child-safety circles sounds especially keen on that outcome.
So the Molly Rose Foundation has already said Meta should be held accountable for failures under the Online Safety Act, which brings the child-safety stakes back into sharp view. That part of the argument is hard to shrug off. A feature that lets images disappear may sound playful on the surface, but the legal and safety questions around it aren’t. If Ofcom decides Meta missed the mark, the fallout won’t stop at one product launch. Other platforms will be watching closely, because the next Meta legal challenge may help define how much power the watchdog really has when it asks companies to prove they took safety seriously before the release notes were even sent out.
