How Does Ofcom Enforce the Online Safety Act? Inside the Meta Instagram Instants Investigation

What Ofcom is investigating at Meta

Ofcom is investigating whether Meta breached its Online Safety Act duties by launching Instagram Instants without first carrying out a suitable and sufficient illegal content risk assessment and children's risk assessment covering the new feature. The investigation concerns process, not a finding that harm has occurred: opening a formal investigation means Ofcom has concerns it wants to test, not that it has decided Meta broke the law.

According to the BBC, Instants lets users take an image and share it with people they have marked as "close friends" or with accounts they follow that follow them back, and the image disappears once viewed. Disappearing images have long been flagged as a particular risk for younger users, because content that vanishes is harder to report and moderate. The Molly Rose Foundation, quoted by the Press Association, said Meta had "repeatedly failed to prioritise children's safety" and that the move must be matched with "a swift and robust investigation".

George Lusty, Ofcom's director of enforcement, framed the case around timing, saying that "significant changes to platforms must be risk assessed before they're launched", adding that "safety by design must be built in, not bolted on". Meta's position, as reported by The Telegraph, is that it "conducted a risk analysis and briefed Ofcom about this feature on a number of occasions before launching it", and that Instants has built-in protections including blocking screenshots, reshares and forwarding, no public feed and Teen Account protections switched on automatically. Meta said it would co-operate.

Several things are not public. Ofcom has not published what it considers deficient in any risk analysis Meta did carry out, Meta has not published that analysis, and no timetable for the investigation has been announced. The case sits alongside the child-safety litigation Meta faces in the United States, including the New Mexico court order requiring Meta to fund a $567m child mental health remedy and the Tennessee jury trial over Instagram "addiction" claims, but the UK case is a regulatory compliance inquiry, not a damages claim.

The risk assessment duties at the heart of the case

The Online Safety Act requires every regulated user-to-user service to assess the risk of illegal content and, if children are likely to use it, the risk of harm to children, and to repeat that assessment before making any significant change to the service. Those are the two duties Ofcom says it is testing.

Section 9 sets out the illegal content duties. Section 9(4) of the Online Safety Act 2023 imposes, "before making any significant change to any aspect of a service's design or operation, a duty to carry out a further suitable and sufficient illegal content risk assessment relating to the impacts of that proposed change". The assessment must consider, among other things, the user base, the risk of users encountering each kind of priority illegal content, how easily content can be disseminated, and which functionalities present higher risk. Section 11(4) imposes the same pre-change duty for the children's risk assessment on services likely to be accessed by children.

The duties are now fully live. The government's explainer records that the Act became law on 26 October 2023, that in-scope providers had to complete illegal content risk assessments by 16 March 2025, with Ofcom able to enforce the illegal content regime from 17 March 2025, and that services likely to be accessed by children had until 24 July 2025 to complete their children's risk assessments. Content harmful to children ranges from "primary priority" material, such as pornography and content encouraging suicide, self-harm or eating disorders, to "priority" content such as bullying and abusive material.

The Act also reaches providers based outside the UK where a service has links to the UK, for example a significant number of UK users or the UK as a target market. Child protection online has become a sustained political theme in the UK, with police chiefs urging tighter social media controls for under-16s earlier this year, which helps explain why a feature launch has become an enforcement case.

How does Ofcom enforce the Online Safety Act? The process

Ofcom enforces the Online Safety Act through a staged statutory process: it gathers evidence, issues a provisional notice if it believes there has been a breach, considers the provider's representations, and only then issues a final "confirmation decision" that can require remedial action and impose a penalty. The provider can appeal that decision to the Upper Tribunal.

Ofcom explained the sequence when it opened its investigation into X over the Grok chatbot in January 2026. As reported by Advanced Television, its first step is to gather and analyse evidence; if it considers a compliance failure has occurred, it issues a provisional decision, and the company has an opportunity to respond in full before any final decision is made. In the Act, that provisional decision is a "provisional notice of contravention" under section 130, and the final step is a confirmation decision under section 132.

A confirmation decision can require the provider to take specific steps to comply or remedy harm, and can impose a single penalty, plus a daily penalty if a failure continues. Under section 168 of the Act, a provider can appeal a confirmation decision or penalty notice to the Upper Tribunal, which applies judicial review principles rather than rehearing the case from scratch. That matters for Meta: a challenge to any eventual Instants decision would be fought on rationality, procedure and legal error, not on whether the tribunal would have assessed the risks differently.

The investigation stage is where Ofcom's information powers do most of their work, and it is those powers that Meta, X and TikTok were contesting in court this week. The process also gives providers early chances to settle the issue: in several earlier cases, services under investigation changed their practices, or blocked UK users, and Ofcom closed its files.

Ofcom's enforcement powers at a glance

Ofcom's sanctions under the Online Safety Act run from fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater, to court orders cutting a non-compliant service off from payment providers, advertisers and UK internet access, and criminal liability for some information failures, including for named senior managers.

Power	Legal basis	What it allows
Financial penalty	Schedule 13, paragraph 4	Up to the greater of £18 million and 10% of qualifying worldwide revenue for the most recent complete accounting period
Daily penalty	Section 137	A daily rate penalty where a failure to comply continues after the confirmation decision
Information notice	Section 100	Requires information Ofcom needs for its online safety functions, including generating information and real-time remote viewing of systems
Information offences	Section 109	Offences for failing to comply with a notice, giving materially false information, or suppressing or destroying information
Senior manager liability	Section 110	A named senior manager commits an offence if the company commits certain information offences and the manager failed to take all reasonable steps to prevent it
Service restriction order	Section 144	Court order requiring ancillary services, such as payment or advertising providers, to stop serving a non-compliant service
Access restriction order	Section 146	Court order requiring UK access to a service to be blocked or restricted where a service restriction order is not enough

The penalty cap in Schedule 13 to the Act is the figure most quoted, and it is the figure Meta is challenging. Where several group companies are jointly and severally liable, a modified cap applies by reference to the revenue of the group. For the largest platforms, the "business disruption measures" in section 144 and section 146 are a theoretical backstop rather than a likely outcome: Ofcom has said a court may impose them only where appropriate and proportionate to prevent significant harm to people in the UK.

The senior manager offences in section 110 attach to information notices, not to the safety duties themselves. Their practical effect is that compliance with an Ofcom information request is a matter for a named individual, as well as the company, which raises the stakes of the information-notice litigation discussed next.

Information notices and the High Court hearing

Meta, X and TikTok are asking the High Court to quash information notices Ofcom issued in February 2026, arguing that the demands for content moderation data are excessive, burdensome and lack a clearly defined regulatory purpose; Ofcom says it genuinely needs the data to judge whether the regime is working.

The power in question is section 100 of the Act, which lets Ofcom require any information it needs "for the purpose of exercising, or deciding whether to exercise, any of their online safety functions", including requiring a provider to obtain or generate information. The section also requires the power to be exercised proportionately to the use to which the information will be put, and that proportionality requirement is the natural focus of a judicial review.

According to Reuters, the notices asked for detailed content moderation metrics, including how many posts were removed or had their visibility restricted and how many users were exposed to harmful content. Meta said in court filings that Ofcom wanted "wide-ranging and granular information" about seven of its services for no clearly defined regulatory purpose. A witness statement for X called it "the most burdensome information request X has received from any regulator in any jurisdiction". TikTok argued that Ofcom had circumvented an alternative monitoring regime with specific safeguards. The Telegraph reported that Meta is seeking to quash three notices concerning Facebook, Instagram and WhatsApp, that it says Ofcom asked for more than 10,000 extra pieces of information to build a "bank of data", and that the companies accuse the regulator of "fishing".

Ofcom's answer is that it narrowed the scope of the requests before implementation and needs the information to regulate. "Parliament has charged us with the job of regulating an industry that has been unregulated and unaccountable for more than 20 years," a spokesperson said. Reuters reported that the hearing began on 5 October and was due to conclude on 7 October; no judgment had been given at the time of writing. The case is a reminder that the High Court supervises regulators through judicial review, a function distinct from the commercial work handled in the new Business and Property Division, and that UK courts are increasingly the arena for technology regulation disputes, as in Apple's fight over encrypted data access.

Meta's challenge to fees and penalties

Meta's second front is a judicial review of Ofcom's approach to "qualifying worldwide revenue", the figure Ofcom uses to calculate both the annual fees that fund the regime and the maximum fines; Meta argues that both should reflect only the revenue of the regulated services in the UK.

Section 84 of the Act allows Ofcom to require providers above a threshold to pay a fee computed by reference to their qualifying worldwide revenue and any other factors Ofcom considers appropriate. TNW reported that Ofcom has signalled a levy of between 0.02% and 0.03% of qualifying worldwide revenue, with a £250m revenue threshold and a £10m UK-revenue floor below which providers are exempt, and that Ofcom's counsel told the court in May it intended to issue its first invoices in the third quarter, most likely September. Meta argues that Ofcom's interpretation "reaches further than Parliament intended".

As reported by The Register, Meta also objects to the way Ofcom aggregates revenue across services and group entities. A Meta spokesperson said: "We believe fees and penalties should be based on the services being regulated in the countries they're being regulated in. This would still allow Ofcom to impose the largest fines in UK corporate history." Ofcom said its approach reflects a "plain reading of the law" and that it would "robustly" defend its reasoning and decisions.

Reuters reported on 5 October that this challenge was expected to be heard the following week. The stakes go beyond Meta's invoice: if the court accepted that fines must be calculated on UK revenue only, the maximum penalty for every global platform would fall sharply. Challenges of this kind, where a platform contests the legal basis of a regulator's measure rather than the facts, are now familiar in Europe, as in Google's challenge to the Commission's DMA search data order.

The Category 1 dispute over Instagram and WhatsApp

Meta's third front is a challenge to Ofcom's decision to designate Instagram and WhatsApp as Category 1 services, the tier that carries the Act's most demanding additional duties on transparency, user controls and fraudulent advertising.

Ofcom must keep a register of categorised services under section 95 of the Act. The Guardian reported that Meta is challenging Ofcom for placing WhatsApp and Instagram in the category, and the BBC reported that Meta contends its messaging and image-sharing apps should not face additional requirements such as tackling paid-for fraud adverts, an area where Meta already faces scrutiny in Europe through complaints over financial scam advertising. Meta has said that these "are not challenges to the law itself, but how Ofcom has interpreted it", according to Eastern Eye, which also reported that Roblox and Quora are challenging their own categorisation decisions.

The procedure matters. Section 167 gives a provider a right of appeal to the Upper Tribunal against a decision to include its service in the Category 1 part of the register, and provides that the special Category 1 duties need not be complied with until the appeal is determined or withdrawn. That is why critics see the appeal as buying time. Damian Collins, a former technology minister, called it "a deliberate strategy by Meta to frustrate and delay the implementation of the Online Safety Act", Biometric Update reported. Oliver Griffiths, Ofcom's group director for online safety, acknowledged the legal risk: "if we run unnecessary risks, we are going to get absolutely clobbered legally."

Front	What Meta challenges	Forum and status (as reported, 7 October 2026)
Information notices	Three notices covering Facebook, Instagram and WhatsApp, issued February 2026	High Court judicial review, heard 5 to 7 October alongside X and TikTok; no judgment yet
Fees and penalties	Use of qualifying worldwide revenue and group aggregation	High Court judicial review, filed by May 2026; hearing expected the week after 5 October
Category 1 designation	Inclusion of Instagram and WhatsApp in the Category 1 register	Challenge reported in September 2026; hearing date not public
Instants investigation	Not a Meta challenge: Ofcom's own inquiry into pre-launch risk assessments	Opened 6 October 2026; at the investigation stage

Ofcom's enforcement record so far

Ofcom's Online Safety Act enforcement has so far produced fines against smaller and higher-risk services, mostly for failing to answer information requests, failing to complete risk assessments or failing to use effective age checks; formal investigations of the largest social media platforms are more recent.

The first fine came on 13 October 2025, when Ofcom fined 4chan £20,000 for failing to respond to two statutory information requests, including a request for its illegal content risk assessments, with a further £100 a day for up to 60 days, as reported by The Register. In December 2025 Ofcom fined AVS Group Ltd, which runs 18 adult websites, £1 million for failing to have highly effective age checks, plus £50,000 for failing to respond to information requests, according to STV News, which also reported that Ofcom had opened investigations into 92 online services by then.

In March 2026 Ofcom fined 4chan a further £520,000, made up of £450,000 for failing to implement age checks, £50,000 for failing to assess the risk of illegal content and £20,000 for failing to set out in its terms of service how it protects users, with daily penalties if it did not comply, as reported by Help Net Security. 4chan has said it will not pay. Ofcom's Suzanne Cater, then quoted as its director of enforcement, said that "age checks and risk assessments are cornerstones of our laws". Since October 2025, LBC reported, Ofcom has issued more than £7 million in fines to 11 providers.

Large platforms are now in scope of formal action. In January 2026 Ofcom opened an investigation into X over the use of the Grok chatbot to create and share sexualised images, examining among other things whether X carried out an updated risk assessment before significant changes to its service. Separately, Ofcom is investigating whether Meta complied with information requests about WhatsApp Business, but that inquiry, opened in January 2026, is under section 135 of the Communications Act 2003 and concerns a review of the business SMS market, not online safety. The Instants case is the first Online Safety Act investigation into Meta.

How the UK regime compares with the EU Digital Services Act

The Online Safety Act and the EU Digital Services Act share a risk-assessment model, but they differ in who enforces them, how much they can fine and how they treat feature launches; the DSA does not apply in the UK, each regime protects users in its own territory, and a platform operating in both must comply with each separately.

Under Article 34 of the Digital Services Act, very large online platforms, those with at least 45 million average monthly active users in the EU, must assess systemic risks at least once a year "and in any event prior to deploying functionalities that are likely to have a critical impact" on those risks. The UK test is broader in one respect: section 9(4) applies before "any significant change" and to every regulated user-to-user service, not only the largest. The Commission can fine a very large platform up to 6% of total worldwide annual turnover, against Ofcom's 10% of qualifying worldwide revenue.

Feature	UK Online Safety Act	EU Digital Services Act
Enforcer for the largest platforms	Ofcom	European Commission (very large online platforms)
Who must assess risk	All regulated user-to-user services; children's assessment where children are likely users	Systemic risk assessment for very large online platforms and search engines
When to reassess	Before any significant change to design or operation	At least annually and before deploying functionalities likely to have a critical impact
Maximum fine	Greater of £18 million or 10% of qualifying worldwide revenue	6% of total worldwide annual turnover
Challenge route	Upper Tribunal appeals; High Court judicial review	Action before the EU General Court

Meta faces parallel scrutiny in Brussels. On 29 April 2026 the Commission preliminarily found Instagram and Facebook in breach of the DSA for failing to diligently identify, assess and mitigate the risks of children under 13 using the services. The Commission has already used its fining power, against X in the first DSA non-compliance decision, a €120m fine now under challenge in the General Court, and against marketplaces such as AliExpress, fined €550m.

What happens next

The Instants investigation will run on its own track and could take many months; the nearer-term developments are the High Court judgments on Ofcom's information notices and on its fees and penalties methodology, which will shape how forcefully Ofcom can investigate any platform.

For the Instants case, the next formal step, if Ofcom concludes there are reasonable grounds to believe Meta failed to comply, would be a provisional notice of contravention, followed by Meta's representations and a confirmation decision. Ofcom can also close an investigation without a finding, as it has done in earlier cases where providers changed their practices. If the High Court upholds the information notices, Ofcom will have firmer footing to demand the kind of granular data that investigations such as this depend on; if it quashes them, Ofcom is likely to have to reframe its requests. A ruling for Meta on qualifying worldwide revenue would reduce both fees and the maximum fine across the market. Each outcome may be appealed. UK courts are handling a growing volume of technology disputes, from regulatory challenges like these to consumer claims such as the £1.2bn Google Play Store claim at the Competition Appeal Tribunal.

What this means for platforms and their advisers

The practical lesson of the Meta investigation is that the Online Safety Act turns product launches into compliance events: a platform must be able to show Ofcom a documented, suitable and sufficient risk assessment of a significant change before the change goes live.

• Build the assessment into the launch process. Treat the section 9(4) and section 11(4) reassessments as a gate in product release, not a later write-up.
• Document the reasoning. Meta says it briefed Ofcom several times; the investigation suggests that informal engagement is not a substitute for an assessment Ofcom regards as suitable and sufficient.
• Treat information notices as high stakes. Failure to comply, or giving false information, can be an offence, and named senior managers can be personally liable.
• Model penalty exposure on both bases. Until the High Court rules on qualifying worldwide revenue, budget for fees and penalties on Ofcom's global basis.
• Align UK and EU compliance. A single risk assessment framework can serve both regimes, but the triggers and enforcers differ.

Platforms facing Ofcom inquiries usually need specialist technology, media and telecoms advisers alongside regulatory and public law specialists for representations and appeals, and dispute resolution and litigation counsel where a judicial review or Upper Tribunal appeal is in prospect. Corporate INTL's directory lists advisers in the United Kingdom and in England. In short, how does Ofcom enforce the Online Safety Act? Through risk-assessment duties, information powers and escalating sanctions, and the Meta cases will decide how far each of those can reach.

Frequently asked questions

How does Ofcom enforce the Online Safety Act?

Ofcom investigates suspected breaches, gathers evidence with statutory information notices, issues a provisional notice of contravention if it believes a breach has occurred, considers the provider's response and then issues a confirmation decision. That decision can require changes and impose fines. Providers can appeal to the Upper Tribunal.

Why is Ofcom investigating Meta?

Ofcom opened an investigation on 6 October 2026 into whether Meta carried out a suitable and sufficient illegal content risk assessment and children's risk assessment before launching Instagram Instants, a feature for sharing images that disappear once viewed. Meta says it conducted a risk analysis and briefed Ofcom before launch.

What are the requirements for risk assessments under the Online Safety Act?

Regulated user-to-user services must carry out a suitable and sufficient illegal content risk assessment, keep it up to date and repeat it before any significant change to the service's design or operation. Services likely to be accessed by children must do the same for a children's risk assessment.

How much can Ofcom fine a company under the Online Safety Act?

The maximum penalty is the greater of £18 million and 10% of the provider's qualifying worldwide revenue for its most recent complete accounting period. Ofcom can also impose daily penalties for continuing failures. Meta is challenging in the High Court how Ofcom calculates qualifying worldwide revenue.

Can Ofcom block a website or app in the UK?

Not on its own. Ofcom can apply to a court for business disruption measures: a service restriction order requiring payment or advertising providers to withdraw services, or an access restriction order requiring UK access to be blocked. Courts may make them only where appropriate and proportionate.

Can senior managers be prosecuted under the Online Safety Act?

Yes, in relation to information notices. A senior manager named in a response to an Ofcom information notice commits an offence if the company commits certain information offences, such as failing to comply or giving false information, and the manager failed to take all reasonable steps to prevent it.

What was the court ruling in the case against Meta?

There is no ruling yet. The High Court heard the challenge by Meta, X and TikTok to Ofcom's information notices from 5 to 7 October 2026, and Meta's separate challenge to Ofcom's fees and penalties methodology was expected the following week. Meta is also challenging Instagram and WhatsApp's Category 1 status.

Does the Digital Services Act apply in the UK?

No. The Digital Services Act is an EU regulation and applies to services offered to users in the EU. In the UK, online platforms are regulated by the Online Safety Act and Ofcom. A platform serving both markets must comply with both regimes, which share a risk-assessment model but differ on enforcement and fines.

Has Ofcom fined anyone under the Online Safety Act?

Yes. Ofcom fined 4chan £20,000 in October 2025 and a further £520,000 in March 2026, and fined AVS Group £1 million plus £50,000 in December 2025. LBC reported that Ofcom has issued more than £7 million in fines to 11 providers since October 2025.

Sources

1. BBC News: Ofcom investigates Meta over Instagram Instants feature (6 October 2026)
2. The Guardian: Ofcom investigates Meta over Instagram Instants safety checks (6 October 2026)
3. The Telegraph (via Yahoo News): Ofcom investigates Meta amid High Court showdown (6 October 2026)
4. Nation.Cymru (PA): Ofcom opens first investigation into Meta under Online Safety Act (6 October 2026)
5. Insurance Journal (Bloomberg): UK watchdog opens first Online Safety Act probe into Meta (6 October 2026)
6. LBC: Ofcom opens investigation into Meta over potential failure to comply with Online Safety Act (6 October 2026)
7. Reuters (via The Star): Meta, TikTok, X challenge UK watchdog over online safety data demands (5 October 2026)
8. The Register: Meta fights Ofcom over how many billions count as billions (8 May 2026)
9. TNW: Meta takes Ofcom to the High Court over how the UK calculates Online Safety Act bills (May 2026)
10. Eastern Eye: Why is Meta fighting Ofcom on multiple fronts over Britain's online safety rules? (September 2026)
11. Biometric Update: Meta appeals Ofcom's categorization of Instagram, WhatsApp (September 2026)
12. The Register: Ofcom fines 4chan £20,000 (13 October 2025)
13. STV News: Pornography provider fined £1m by watchdog over weak age checks (December 2025)
14. Help Net Security: 4chan refuses to pay £520,000 in Ofcom fines (19 March 2026)
15. Advanced Television: Ofcom investigates X over Grok deepfakes (12 January 2026)
16. The Register: Ofcom probes Meta over WhatsApp info it was legally required to provide (23 January 2026)
17. Online Safety Act 2023, section 9 (illegal content risk assessment duties)
18. Online Safety Act 2023, section 11 (children's risk assessment duties)
19. Online Safety Act 2023, section 84 (duty to pay fees)
20. Online Safety Act 2023, section 100 (power to require information)
21. Online Safety Act 2023, section 110 (senior managers' liability)
22. Online Safety Act 2023, section 144 (service restriction orders)
23. Online Safety Act 2023, section 146 (access restriction orders)
24. Online Safety Act 2023, section 167 (appeals relating to the register)
25. Online Safety Act 2023, section 168 (appeals against Ofcom notices)
26. Online Safety Act 2023, Schedule 13, paragraph 4 (maximum penalties)
27. Online Safety Act 2023, Schedule 13, paragraph 5 (maximum penalties: group of entities)
28. GOV.UK: Online Safety Act explainer
29. European Commission: Commission preliminarily finds Meta in breach of the Digital Services Act for failing to prevent minors under 13 from using Instagram and Facebook (29 April 2026)
30. Regulation (EU) 2022/2065 (Digital Services Act), EUR-Lex

About this article

This analysis was researched and written by The Corporate INTL Newsroom, which covers cross-border legal, regulatory and business developments for lawyers, professional advisers and financiers in over 150 jurisdictions. It has been checked against the text of the Online Safety Act 2023, the UK government's explainer, the European Commission's announcement and primary reporting by the BBC, The Guardian, The Telegraph, the Press Association, Bloomberg and Reuters. Ofcom's investigation notice, the parties' court pleadings and any judgment in the High Court challenges had not been published or given at the time of writing, and details of Meta's risk analysis for Instants are not public. This article is general information, not legal advice; for advice on a specific matter, consult a qualified adviser. Last reviewed 7 October 2026. For more analysis like this, visit the Corporate INTL newsroom or subscribe to Corporate INTL.