Ofcom opened its first Online Safety Act investigation into Meta on 6 October 2026, and the target is a feature most creators have probably used without a second thought: Instagram Instants, the disappearing-photo messaging tool Meta switched on in May. The regulator wants to know whether Meta properly assessed the risk of illegal content and harm to children before it launched.
Why it matters to creators: Instagram is still the single biggest free traffic funnel into OnlyFans, Fansly and Fanvue accounts for most working creators, and ephemeral DM tools like Instants are exactly the kind of feature used to send previews, teasers and “link in my bio” nudges without leaving anything permanent on the grid. If Ofcom finds Meta cut corners, the fallout — tighter DM moderation, a feature frozen or rebuilt, another account sweep — could land squarely on the part of Instagram creators and their teams lean on hardest.
What Ofcom is actually looking at
Instagram Instants lets users send photos in a direct message that disappear once they’ve been viewed. Under the Online Safety Act 2023, any platform likely to be accessed by under-18s has to carry out an illegal content risk assessment and, where relevant, a children’s risk assessment — and crucially, it has to redo that assessment before making a “significant” design or operational change, not just at launch. Ofcom is examining whether Meta did either before rolling Instants out.
George Lusty, Ofcom’s Director of Enforcement, didn’t mince words announcing the case: “Our online safety laws are clear – significant changes to platforms must be risk assessed before they’re launched,” he said, adding that “safety by design must be built in, not bolted on,” and that Ofcom will act where providers appear to be falling short. Ofcom had already warned major platforms earlier in 2026 that skipping a risk assessment before shipping a significant change could trigger enforcement — Instants is the first time that warning has turned into an actual case against one of the largest platforms in the world, and Meta is the one wearing it.
This isn’t a one-off — it’s a pattern
Instants is just the newest name on a list. Ofcom’s October industry bulletin confirms it’s also investigating TikTok (opened July, over whether its age assurance is “highly effective”) and Aylo, the Pornhub owner (opened September, over age assurance and children’s access assessments). Smaller sites have already paid the price: the operator behind Fapello.com was fined £630,000 in July, Xgroovy.com’s operator £730,000 in September, and First Time Videos LLC £80,000 — all over failures to implement proper age checks or respond to Ofcom’s information requests.
Ofcom also launched a dedicated enforcement programme in September specifically targeting non-consensual intimate image sharing, pushing platforms toward hash-matching technology to catch leaked content automatically. None of this is abstract for creators: it’s the same regulatory machinery that, in September, coincided with Instagram, X and Reddit banning OnlyFans-linked accounts within the same two weeks. Instagram’s own CEO has previously acknowledged how aggressively the platform polices adult-adjacent accounts — and a live Ofcom investigation into how Meta handles risk around a messaging feature gives the company every incentive to tighten things further, fast, rather than wait for a provisional decision.
What happens next, and what it could cost Meta
Ofcom’s process runs in stages: it gathers and analyses evidence, and if it finds a likely breach, issues Meta a provisional decision. Meta can respond in full before Ofcom reaches a final decision. If Ofcom ultimately finds against Meta, it can order specific remedial steps and fine the company up to £18 million or 10% of its qualifying worldwide revenue — whichever is greater. For a company the size of Meta, that upper bound runs into billions, which is why these cases tend to produce fast product changes long before a final ruling ever lands. Category 1 and 2A platforms — the largest services, a list that includes Instagram — also have to publish summaries of their illegal content and children’s risk assessments by November 2026, so expect more of this detail to surface publicly within weeks.
What to do now
- Audit how much of your funnel runs through Instagram DMs. If Instants or similar disappearing-message tools are a core part of how you move fans from free content to your paid page, work out what you’d do if that specific feature got restricted or re-moderated with no warning.
- Don’t treat “disappearing” as “undetectable.” Ofcom is explicitly pushing platforms toward hash-matching and similar automated detection. Ephemeral messages are not invisible to moderation systems, and leaning on that assumption is a bad bet right now.
- Keep a channel to your paying fans that no platform controls. An email list, an SMS list, or your OnlyFans/Fansly mass-message list survives an Instagram account suspension. A DM funnel alone does not — a lesson plenty of creators, including some who’ve dealt with impersonation and account problems on Instagram before, have already learned the hard way.
- If an agency or team runs your Instagram, ask them directly how they’re preparing for tighter DM and disappearing-content rules, rather than finding out after an account gets restricted.
- Watch for Ofcom’s provisional decision. It won’t land this week, but when it does, it will likely come with specifics about what Meta has to change — and those changes could affect anyone using Instagram to promote a paid page.
This is general information, not legal advice — speak to a qualified professional about your situation.
