Ofcom Investigates Meta Over Instagram Instants Safety Assessments

Key Takeaways

• Ofcom Opens Meta Investigation: The UK regulator is investigating whether Meta complied with online safety requirements before launching Instagram Instants in May.
• Risk Assessments Under Scrutiny: Ofcom is examining whether Meta conducted suitable and sufficient illegal content and children's risk assessments before introducing the feature.
• Safety Reviews Required Before Launch: The Online Safety Act requires platforms to reassess potential risks before making significant changes to their services.
• Substantial Penalties Possible: Companies found in breach can face fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
• No Violation Established: Ofcom has not determined that Meta broke the law. The company will have an opportunity to respond to any provisional findings.

Deep Dive

Britain's communications regulator has opened an investigation into whether Meta failed to carry out required safety assessments before introducing Instagram Instants, a feature that allows users to share photos and videos that disappear after being viewed.

Ofcom announced the investigation on October 6, nearly five months after Meta launched Instants on May 13. The regulator is examining whether the company complied with its obligations under the UK's Online Safety Act to assess the risks of illegal content and potential harm to children before making significant changes to its platform.

Instants is accessible through Instagram Direct and allows users to share photos and videos captured within the app. According to Ofcom's investigation notice, content shared through the feature is temporary and cannot be captured through screenshots.

The regulator is examining whether Meta carried out further suitable and sufficient illegal content and children's risk assessments before introducing the feature, as required under Sections 9(4) and 11(4) of the Online Safety Act 2023.

The legislation requires regulated services to assess the risks of users encountering illegal content. Platforms likely to be accessed by children must also assess the risks of minors being exposed to certain types of harmful material. Companies are required to revisit those assessments before making significant changes to a service's design or operation.

Ofcom had warned major technology platforms earlier this year that introducing significant changes without first assessing their potential risks could result in enforcement action. George Lusty, Ofcom's director of enforcement, said companies were expected to complete that work before releasing new features.

“Our online safety laws are clear – significant changes to platforms must be risk assessed before they’re launched,” Lusty said. “This is a vital step that tech firms must take to protect their users. You wouldn’t launch a new car without testing it properly, and it’s the same for online services.”

He added that safety considerations needed to be incorporated into the development of online services rather than addressed after their introduction. The investigation has not established that Meta violated the law. Ofcom has also made no finding that Instants caused harm to users. The inquiry concerns whether the company fulfilled its statutory risk assessment duties before the feature was launched.

Under the enforcement process established by the Online Safety Act, Ofcom will gather and examine evidence before determining whether a compliance failure occurred. If investigators find grounds for a breach, the regulator will issue a provisional decision and give Meta an opportunity to respond before reaching a final determination.

Companies found to have violated the Act can be ordered to take corrective measures or remedy harm resulting from a breach. Ofcom can also impose fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. The regulator has not proposed a penalty against Meta.

Ofcom has not publicly established whether Meta failed to complete the required assessments or conducted assessments that were insufficient under the law. Its investigation will examine the company's compliance with both obligations. The regulator said it would provide further updates as the case progresses.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.