Britain’s communications regulator has opened its first Online Safety Act investigation involving Meta’s Instagram. Ofcom will examine whether the platform met duties created by the 2023 legislation. The decision moves scrutiny beyond guidance and into a formal enforcement process. It does not establish that Meta broke the law.
Ofcom has investigated other services under the Act, so this is not its first case overall. However, it marks the regulator’s first formal use of those powers involving Instagram. That distinction matters because Instagram reaches millions of British users, including many teenagers. The case could therefore clarify expectations for other major social networks.
What Ofcom is examining
Ofcom’s public investigation notice sets the legal questions and identifies the service under review. Investigators can demand documents, risk assessments, technical explanations, and details about protective measures. They can examine how Meta identifies foreseeable harms and evaluates Instagram’s design. They can also test whether advertised protections operate effectively in practice.
The inquiry focuses on compliance systems, rather than judging every disputed post. Under the Act, regulated companies must assess relevant risks and adopt proportionate measures. For Instagram, evidence may cover recommendations, search, comments, messages, reporting tools, and account controls. Ofcom will compare Meta’s evidence with legislation and applicable codes of practice. This approach connects individual experiences with decisions made across the platform.
A formal probe is not a guilt finding
A formal investigation starts an evidence-gathering process; it does not amount to a violation finding. Meta can answer questions, correct assumptions, and explain how its controls work. Ofcom may close the case if evidence shows compliance. If concerns remain, it can send provisional findings before reaching a final decision. That procedure gives the company an opportunity to make legal and factual representations.
Investigations rarely follow a fixed public timetable. Technical evidence, platform changes, and fresh submissions can alter the schedule. Ofcom may publish updates when developments justify disclosure. Meanwhile, Instagram continues operating under its existing legal duties and policies. Users should not interpret silence as either clearance or proof of wrongdoing.
How the Online Safety Act works
Parliament passed the Online Safety Act in 2023 after years of debate about internet regulation. The law covers certain user-to-user services, search services, and pornography providers linked with Britain. A provider can fall within scope even when its headquarters and servers sit elsewhere. Instagram qualifies because people can publish and share content with other users. Ofcom oversees compliance and publishes guidance and codes.
Illegal-content safety duties became enforceable on 17 March 2025, after Ofcom completed the relevant codes. Covered services had to assess illegal-content risks before that enforcement date. They must maintain proportionate systems addressing illegal material specified by the Act. Separate child-safety duties took effect on 25 July 2025 for services likely accessed by children. Those phased deadlines transformed the Act from a legislative framework into an operational regime.
Systems regulation and fundamental rights
The Act regulates platform processes instead of making Ofcom a national content moderator. Ofcom does not approve each Instagram post before publication. It examines whether providers understand risks, design suitable systems, and apply them consistently. The regulator must also consider privacy and freedom of expression while exercising its functions. Those protections remain important during politically sensitive or technically complex investigations.
Risk-based regulation does not promise a completely harm-free service. Instead, it requires reasonable, proportionate action against harms covered by particular legal duties. A large service may need more sophisticated controls because its scale can magnify failures. However, Ofcom must base any conclusion on evidence and the law. Popularity alone cannot establish a breach.
Instagram’s existing safety tools
Instagram already uses several safeguards aimed at younger users. Meta’s Teen Accounts place teenagers into private accounts and apply stricter messaging and content settings. They also include time reminders, sleep mode, and limits on unwanted contact. Users under 16 generally need parental permission to make settings less protective. Meta can present these features as evidence of its safety strategy.
Yet a feature’s existence does not automatically demonstrate legal compliance. Investigators can ask whether users receive it, whether circumvention remains easy, and whether outcomes match claims. They may study testing methods, staffing, escalation procedures, and internal accountability. They can also consider how recommendation systems interact with protective settings. This evidence helps separate policy language from everyday performance.
Age checks and recommendation systems
Age assurance creates especially difficult technical and privacy questions. Platforms need reliable signals without collecting unnecessary personal information. Children may misstate their ages, while adults can resist intrusive checks. Companies therefore combine account information, behavioural signals, verification tools, and parental supervision. Ofcom must judge those arrangements against the specific duties under examination.
Recommendations create another important area for oversight. Algorithms can amplify engaging material quickly, including content that users never requested. Protective systems can reduce exposure through ranking changes, filters, warnings, and removal. However, overbroad controls can suppress lawful discussion or important support resources. Effective regulation must therefore weigh safety, access, privacy, and expression together.
Ofcom’s enforcement powers and possible penalties
Ofcom can issue enforcement notices requiring companies to remedy confirmed failures. It can also impose penalties reaching £18 million or 10% of qualifying worldwide revenue. The law uses whichever maximum is higher. For Meta, the turnover-based ceiling could greatly exceed the fixed figure. Any actual penalty would depend on the breach, evidence, and statutory process.
In serious cases, Ofcom can seek court-backed business disruption measures. Those orders can target payment providers, advertisers, or access to a noncompliant service. Such measures represent an escalation tool, not an automatic result of opening an investigation. Specific information offences can also create personal consequences for senior managers. However, the Act does not make executives automatically liable for every safety failure.
Why the first Instagram case matters
The Instagram case matters beyond one platform because enforcement decisions establish practical benchmarks. Other services will study Ofcom’s reasoning, evidence demands, and interpretation of proportionality. Investors and advertisers may also watch for operational or reputational effects. Campaigners will assess whether the process delivers meaningful safety improvements. Free-expression groups will examine whether remedies protect legitimate speech.
The probe also tests whether Britain’s regime can oversee a global technology company effectively. Meta operates interconnected products, shared infrastructure, and rapidly changing recommendation systems. National rules must address British users without pretending platforms stop at national borders. Cooperation with overseas regulators may reduce duplication, although legal standards differ. That tension will shape future cross-border enforcement.
What happens next
Ofcom will gather evidence before deciding whether Instagram complied with the relevant requirements. It could close the investigation, secure changes, or proceed toward formal enforcement. If Ofcom alleges a breach, Meta can respond before a final decision. Meta can appeal certain enforcement decisions to the Upper Tribunal. Public notices should explain any confirmed findings and required remedies.
Until then, the inquiry remains a test of evidence, systems, and regulatory judgment. Its outcome will show how Ofcom translates statutory duties into clear expectations for Instagram.
