Opinion

Meta's two weeks in May

7 May to 19 May 2026. Four regulatory and product moves by one company. Look at them together and the strategy resolves.

Saturday 16 May 2026 · Caroline Wells, Founder, Iris Anticipa

Between 7 May and 19 May 2026, Meta will have executed four moves that read separately like coincidence and together like strategy. On 7 May Meta filed a judicial review against Ofcom on the "qualifying worldwide revenue" basis for OSA fees, on a theoretical fine ceiling near $16B. On 8 May Meta dropped end-to-end encryption on Instagram DMs. In the same fortnight Mark Zuckerberg announced the AI assistant inside WhatsApp incognito mode, "the first major AI product where there is no log of your conversations stored on servers." On 19 May the US Take It Down Act becomes effective with a 48-hour takedown clock from actual knowledge.

One company. Four jurisdictions in scope. Two weeks.

The pattern only resolves if you read the moves as a single posture. Drop end-to-end where the litigation clock is shortest. Pre-empt enforcement by challenging the fee methodology. Launch a new product where the audit trail does not exist by design. Time it all to the same news cycle, so the moves are read as four discrete stories and not one.

Professor Alan Woodward at Surrey has been making the same point about ephemeral channels for two years: the audit question moves with the channel. When the channel moves into incognito AI, the regulator's view moves with it or it does not move at all. The FCA and ICO joint statement of 27 March placed lawful-by-design on financial services. Ofcom's hash-matching technical standard moved the OSA duty from reactive takedown to proactive prevention. Both are doing work the Take It Down Act assumes is already done.

The bit nobody has flagged is that 8 May was the easy decision. The Take It Down Act's "actual knowledge" standard plus 48-hour clock plus statutory damages made Instagram E2E a federal litigation liability. Dropping E2E on Instagram while turning on a no-server-log AI in WhatsApp is one strategy, not two. The audit trail moves to a different layer. McGlynn's evidentiary gap is the same gap, on a different surface.

The Meta v Ofcom JR is where the next round of the question lives. If Meta wins, OSA enforcement weakens for every platform in scope. If Ofcom prevails, the compliance economics of the entire categorised services register reset upward. Epic Games and the CCIA are expected to join as third parties. The first OSA invoices issue Q3 2026, most likely September.

The fortnight tells you that platform-side compliance is now a forecast game, not a calendar one. The forecast is built from regulatory commencement orders, judicial review timelines, US litigation windows, and the gap between announcement and enforcement. Regulators who read the forecast write the next round of rules. Regulators who do not will be writing the round after.

FS Boards face the same forecast question. For eighteen months online platforms have been asked, "could you have seen this earlier?". The FCA's NFM rule lands the same question on Boards. The s166 template is being written now.

Two weeks in May tells you that the answer to "could you have seen this earlier?" is no longer about the data the firm holds. It is about the architecture the firm chose. Iris is built for the architecture question.

Sources: Meta v Ofcom judicial review filing, 7 May 2026; Meta E2E announcement on Instagram, 8 May 2026; WhatsApp incognito AI announcement, May 2026; US Take It Down Act (effective 19 May 2026); Ofcom hash-matching standard, May 2026; FCA and ICO joint statement, 27 March 2026; Professor Alan Woodward, University of Surrey.

← Back to Iris · caroline@trustiris.com