When a platform ships a new feature, the question most people ask is whether it will catch on. The question Britain’s communications regulator is asking about Instagram’s newest addition is different: whether anyone at Meta did the safety work before the switch was flipped.
Ofcom said Monday it had opened an investigation into Meta over Instants, a recently launched Instagram feature, to examine whether the company completed the risk assessment that the Online Safety Act requires before such a feature goes live. The inquiry, reported by the Guardian and the BBC, turns on timing — whether Meta shipped first and assessed later.
The Online Safety Act, passed in 2023 and brought into force in stages since, imposes a duty that older content rules did not. It does not simply ask platforms to remove harmful material after it appears. It asks them to think ahead, estimating before a launch how a new feature could be used to expose children to harm, spread illegal content or amplify abuse, and to act on that estimate.
The act was Britain’s answer to a decade of argument about platform responsibility. For years, lawmakers on both sides of the Atlantic debated whether companies should be liable for the material they host. The British law cut through that debate by shifting the burden: rather than policing every post after the fact, platforms would have to show that they had thought through the risks of what they were building.
Ofcom has spent the past two years turning the act’s principles into enforceable duties, issuing codes of practice that spell out what a proper risk assessment must contain. The regulator has signaled repeatedly that it will not treat the paperwork as optional, and it has used its early enforcement actions to make examples of platforms it believes are moving without looking.
That is a different kind of obligation, and it is one regulators have shown they are willing to enforce. Ofcom has been building out its enforcement machinery as the act takes effect in stages, and it has treated the “safety by design” duties — the requirement to assess risk before, not after — as a priority. A feature launched without the paperwork is not, in the regulator’s view, a detail; it is the offense itself.
Features that change how people interact — new ways to share, react or message — carry risks that are not obvious from the outside. A risk assessment is meant to surface those dangers before they reach millions of users, by asking how a child might encounter the feature, how a bad actor might misuse it, and what harm could follow. Skipping that step does not remove the risk; it simply transfers it to the users.
For Meta, the inquiry lands on a calendar that is already full. The company has spent years answering European regulators on content, advertising and data practices, and it is simultaneously fighting privacy litigation in the United States. The Ofcom investigation is a separate procedure, but it feeds the same impression the company has spent heavily trying to counter: that it moves quickly and cleans up later.
Meta is no stranger to these obligations, and it has built out large teams to meet them. The company has repeatedly said it supports regulation, while arguing over the details of how it is applied. The Instants inquiry tests whether that support extends to the least glamorous part of compliance: doing the analysis before the feature ships, not after the questions start.
Meta has not publicly detailed the safety work behind Instants, and the investigation will effectively ask the company to show its working. Under the act, platforms that launch regulated features without a completed assessment can face enforcement action, including fines, and Ofcom has made clear that it will use those powers when it believes the law has been ignored.
The question of timing matters because a risk assessment is meant to shape a feature before users touch it, not to document a decision that has already been made. A regulator that accepted after-the-fact paperwork would, in effect, let platforms outsource their own safety reviews to the public. That is the outcome the act was written to prevent.
Instants is the feature in question, and its rollout illustrates how quickly new tools can reach large audiences. Instagram is among the most widely used apps in the world, and a feature introduced there can spread across markets within weeks. For a regulator, the size of that reach is precisely why the pre-launch duties exist.
The investigation also carries a message for the rest of the industry. Britain’s act applies to Meta and to every platform that serves UK users, and regulators elsewhere are watching how this enforcement plays out. A finding against Meta would tell other companies that shipping a feature without a completed assessment is not a cost they can quietly absorb.
The case is at its earliest stage, and an investigation is not a finding. Ofcom will gather evidence and decide whether the company breached its duties, a process that could take months. What is already clear is that the regulator is treating the pre-launch duty as a hard requirement rather than a formality, and that Meta will have to show, in writing, what it knew before Instants reached its users.
The broader question for Meta is not about any single feature. It is about whether the company can keep shipping at its usual speed while satisfying regulators who now demand proof that it looked before it launched. Ofcom’s inquiry is one test of that. The answer will shape how Instagram, and every platform watching, treats the gap between an idea and its release.
