Meta faces Ofcom Online Safety Act probe over Instagram

LONDON — June 10, 2025 — Meta is facing its first formal enforcement action under the UK's Online Safety Act after Ofcom opened an investigation into Instagram Instants, a feature that makes photos disappear after they are viewed. The regulator announced the probe Tuesday, saying it needed to establish whether the company had complied with its legal duties before the tool went live in May.

Instants lets users capture a photo and send it to others in a way that leaves no visible trace once the recipient closes it. After 24 hours, the content is no longer accessible. That design made it a test case for how the UK's new internet safety regime handles product features that are built to be temporary.

Ofcom said the investigation centers on two specific obligations: whether Meta conducted a "suitable and sufficient" illegal content risk assessment and whether it carried out a children's risk assessment before the feature launched. The distinction matters. A children's risk assessment must go beyond general terms and conditions, looking at how a feature could realistically be used by minors and whether they could be exposed to harm.

Under the Online Safety Act, illegal content includes child sexual exploitation and abuse material. For children, the law also covers exposure to content involving suicide, self-harm, eating disorders, and pornography. Platforms are expected to assess these risks before making significant changes, not after problems appear.

The announcement came with an unusually direct statement from Ofcom's enforcement chief, George Lusty. "Our online safety laws are clear – significant changes to platforms must be risk assessed before they're launched," he said. "You wouldn't launch a new car without testing it properly, and it's the same for online services." He added that safety by design must be "built in, not bolted on."

This is the first time Ofcom has opened an investigation targeting Meta specifically. The regulator has already exercised its powers against other technology companies, but the choice of Instants suggests it is focusing not just on what platforms remove after a report, but on how features are designed before they reach users.

The timing has not gone unnoticed by campaigners. The Molly Rose Foundation, set up in memory of Molly Russell, a 14-year-old who died in 2017 after encountering harmful content online, said the intensifying scrutiny was long overdue. Rowan Ferguson, the foundation's senior policy and research manager, said tech companies had been allowed for too long to treat child safety as an afterthought.

The foundation's concern is not theoretical. If harmful images are sent through a disappearing feature, there may be no copy for moderators to find. A victim or a witness might report the content, but by the time a human reviewer looks at it, the evidence could be gone. That makes enforcement harder and, critics argue, encourages people to send abusive material without fear of consequences.

The case raises a broader question about the limits of risk assessment. How can a company know whether a feature will be used for abuse before it launches? Ofcom's position is that the answer cannot be "We didn't know." The law puts the burden on the platform to identify foreseeable risks and address them in the design phase.

For Meta, the stakes go beyond London. Although Ofcom is a UK regulator, Meta's infrastructure is global. Changes made to satisfy Ofcom could be implemented across the company's platforms, affecting users in the United States and elsewhere. UK fines can reach 10 percent of a company's global annual revenue, a penalty that would be material even for a company Meta's size.

Ofcom's move also creates a regulatory precedent. The European Union is already using the Digital Services Act to push platforms toward systemic risk management, and the UK's Online Safety Act is frequently described as one of the most detailed internet regulation frameworks outside China. When a government opens a formal probe into a specific feature, it signals to other regulators that ephemeral functionality should not get a free pass.

In the United States, there is no federal online safety law with comparable pre-launch duties. Efforts to pass legislation have stalled in Congress, although state-level bills continue to test the issue. American lawmakers and advocacy groups watching Ofcom's investigation may find it a useful blueprint for future US action.

The implications for product development are also significant. Ofcom did not block Instants from launching. It opened an investigation after the fact to determine whether the rollout was lawful. But the message to social media companies is that "move fast and fix problems later" no longer works in regulated markets. A feature can be legally problematic simply because it was not properly assessed in advance.

Meta has not yet commented publicly on the probe. A spokesperson had not responded to a request for comment at the time of writing. The company has previously said it invests heavily in safety and uses automated systems to catch harmful content before it is widely seen.

Ofcom gave no indication of how long the investigation will take. It will likely request internal documents, product plans, risk assessments, and data on how Instants was developed and tested. If the regulator finds a breach, it can issue an enforcement notice requiring Meta to change its practices or face further penalties.

The case may also force platforms to reconsider how they document internal safety decisions. A feature like Instants can seem simple from the outside, but building it involves choices about data retention, reporting tools, and automated moderation. Those choices are now part of the audit trail that regulators will examine.

For users, especially parents, the outcome is a measure of whether the Online Safety Act can deliver on its promises. The law exists because grief has repeatedly been triggered by content that should never have reached children. To commemorate Molly Russell, Ofcom's first Meta investigation under the new regime is at least a sign that the rules are being used.

What happens next will determine whether "ephemeral" is allowed to mean "unregulated." Ofcom has made clear that it intends to test that assumption. Meta now has to show that it took the same care with a disappearing photo tool that a car manufacturer would take with brakes.