Ofcom Probes Meta Over Instagram Instants Feature Under UK Online Safety Act
What Happened – Ofcom opened a formal investigation into Meta’s Instagram Instants feature, a disappearing‑photo/video tool launched in May 2026. The regulator is assessing whether Meta completed the illegal‑content and children‑risk assessments required by sections 9(4) and 11(4) of the UK Online Safety Act before the feature went live.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of launching new functionality without documented safety‑by‑design assessments, a gap continuous‑control‑assurance programs are built to close.
- Highlights the need for auditable evidence that risk analyses are performed pre‑launch and communicated to regulators.
- Aligns with the control objective of “Product risk assessment and mitigation” that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected – Social‑media platforms, SaaS providers, and any tech companies that introduce user‑facing features that could expose illegal or harmful content.
Recommended Actions
- Review product‑release governance to ensure risk assessments are completed, documented, and signed off before any feature rollout.
- Map your safety‑by‑design controls to the relevant control objectives in your trust framework and collect evidence for audit readiness.
Technical Notes – The Online Safety Act 2023 mandates pre‑launch illegal‑content and children‑risk assessments for significant product changes (sections 9(4), 11(4)). Instagram Instants disables screenshots, reshares, and forwarding, and applies Teen Account protections, but the regulator argues that risk checks must precede deployment, not follow it. Source: TechRepublic article