Ofcom has today opened an investigation into whether Meta has failed to comply with its duties under the UK’s Online Safety Act, by not adequately assessing the risks posed by Instagram Instants before it launched.
Assessing risk is central to safety by design
Risk assessments are fundamental to keeping users safer online. Providers are not able to protect people, especially children, without first understanding how harm could take place on their platforms, and how their features and functionalities could increase those risks of harm.
Under the UK’s Online Safety Act, tech firms must assess and mitigate the risk of people in the UK encountering illegal content, and platforms likely to be accessed by children must also assess and mitigate the risk of under-18s being exposed to certain types of harmful material.
Providers must update their risk assessments before making any significant changes to their service’s design or operation. Earlier this year, we warned major platforms they could face enforcement action if they did not assess the risk of significant changes before they are deployed.
Investigation into Instagram Instants
In May, Meta launched Instants as a feature in Instagram, where content shared by users disappears after it has been viewed.
We have launched a formal investigation to establish whether Meta failed to comply with its duties under the Act by not carrying out a suitable and sufficient illegal content risk assessment and children’s risk assessment before the launch of Instants.
George Lusty, Director of Enforcement at Ofcom, said: “Our online safety laws are clear – significant changes to platforms must be risk assessed before they’re launched.
“This is a vital step that tech firms must take to protect their users. You wouldn’t launch a new car without testing it properly, and it’s the same for online services.
“Safety by design must be built in, not bolted on, and today’s investigation shows we’ll take action where we have concerns that providers are failing to comply.”
Ofcom’s investigation process
The Online Safety Act sets out the process Ofcom must follow when investigating a company and deciding whether it has failed to comply with its legal obligations.
Our first step is to gather and analyse evidence to determine whether a breach has occurred. If, based on that evidence, we consider that a compliance failure has taken place, we will issue a provisional decision to the company, who will then have an opportunity to respond our findings in full, as required by the Act, before we make our final decision.
Enforcement powers
If our investigation finds that a company has broken the law, we can require platforms to take specific steps to come into compliance and/or to remedy harm caused by the breach. We can also impose fines of up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
We will provide updates on this investigation as it progresses.
Related content