Ofcom has opened a formal investigation into whether Meta breached the Online Safety Act by launching Instagram Instants — a Snapchat-style disappearing-image feature — without conducting adequate risk assessments for illegal content exposure and child access. The law requires platforms to complete these assessments before making significant changes to service design, not after. The question is whether Meta treated compliance as a checkbox or a genuine engineering constraint. Meta says it did perform a risk analysis and consulted Ofcom before launch. It points to existing safeguards: forwarding is blocked, and the feature inherits the restrictions of Instagram's teen account settings, the default mode for under-18s across Instagram, Facebook, and Messenger. Ofcom is unconvinced, or at minimum wants to see the receipts. The enforcement context matters more than the feature itself. This is Ofcom's second active investigation into Meta — the first concerns WhatsApp's failure to comply with an information request. Meta is simultaneously fighting Ofcom on three legal fronts: challenging the fee structure the regulator uses to fund its operations, contesting its reclassification under the OSA into a higher-duty category, and joining TikTok and X in a broader challenge to the scope of information demands under the new regime. The pattern is clear: Meta is testing whether the OSA has teeth by litigating the infrastructure of enforcement while continuing to ship product. If the regulator can be bogged down in court over fees, categorization, and information scope, the substantive safety obligations become harder to enforce. This is regulatory attrition dressed up as legitimate legal challenge. Ofcom's enforcement director, George Lusty, framed the issue in deliberately plain language: "You wouldn't launch a new car without testing it properly." The analogy is precise. The OSA's risk-assessment requirement is a pre-market safety regime, not a post-incident liability framework. The question is not whether Instants caused harm, but whether Meta demonstrated safety before shipping. The Molly Rose Foundation — established after teenager Molly Russell's death following exposure to harmful Instagram content — called for Meta to be "held to account for their failures under the Online Safety Act." The foundation's involvement anchors the investigation to a specific, documented failure in Instagram's content systems. The stakes are structural. If Ofcom establishes that shipping a major feature without adequate pre-launch assessment violates the OSA, it sets a precedent that safety-by-design is a binding obligation, not a best-practice aspiration. If Meta's litigation strategy succeeds in narrowing Ofcom's authority, the OSA becomes a paper tiger within its first years of operation. The maximum penalty — 10% of global revenue, or roughly $19 billion at current valuation — exists to make this a serious calculation. Whether Ofcom would ever approach that ceiling is the real test.
