Which Online Safety Act duties apply to Scottish social commerce?

What to take away

For social commerce teams, Online Safety Act duties are not a separate legal silo. They sit inside the same tools and strategies used for listings, reviews, live selling, buyer messages and community groups. The way you moderate content, log decisions and respond to complaints shapes buyer trust and seller retention.

A Scottish platform that treats record-keeping as an operational feature can use the same workflow to spot scam patterns, handle appeals and show consistency.

This site covers social-commerce tools and strategies, so the checklist in this article is written to fit that stack: platform features, moderation processes, escalation paths and the records that keep them auditable. Use it alongside your existing social selling playbook, not as a standalone compliance document.

For social-commerce teams, the practical output is a set of platform settings and workflows. Add a risk note to listing approval, a moderation queue for comments and messages, and an appeal step for removed listings. Log each decision in the same admin tool you use for orders, reviews and seller support.

Tag scam reports by pattern so the data feeds both safety records and seller performance reviews. In England and across the UK, the same tools can cover Scottish operations without a separate stack. Treat the records checklist as a feature backlog: assign owners, dates and review triggers. That way compliance work improves buyer trust, seller retention and marketplace quality.

Which platforms count as user-to-user services under the Online Safety Act 2023

A user-to-user service is any online service where content generated by one user can be encountered by another. That definition catches more Scottish social selling platforms than many operators expect.

A marketplace where buyers leave reviews, a live selling app with comments, a group where members post stock lists, and a messaging feature attached to a shop can all qualify.

The Online Safety Act 2023 sets the duties for user-to-user platforms regulated by Ofcom. The Act is published on legislation.gov.uk, and the explanatory notes on platform duties can help when a clause is unclear.

There is no general exemption just because a service is small. The core duties depend on whether the service is in scope; additional duties vary by statutory service category. Category 1, 2A and 2B services are identified using user-number and functionality thresholds set by regulations. The Act also excludes certain service types or features, so operators should check their actual service rather than assume a low user count removes the duties.

Social selling sits inside this. A Scottish seller who runs a Facebook group for local buyers is not automatically a regulated service, but the platform hosting that group may be. The operator of the platform carries the duty, not the individual seller, unless the seller also runs a user-to-user service.

Territorial reach is narrower than many assume. A service can be regulated in the UK even when the company is registered elsewhere, if UK users are a target market. This overlaps with the territorial scope to product safety rules that already follow cross-border selling.

If you are unsure, write down your reasoning. A dated internal note explaining why you believe a feature is or is not user-to-user is better than no record at all. Ofcom can ask for it later.

Features that usually trigger the duty

Ofcom's regulated duties and what Scottish operators must record

Ofcom regulates online safety duties across the UK, including Scotland; there are no separate Scottish OSA duties. For user-to-user services, Ofcom's Illegal Content Codes of Practice and Protection of Children Codes of Practice set out measures services can take. Its guidance also explains how to approach the relevant risk assessments. Ofcom can request information, issue notices and, in serious cases, take enforcement action.

In-scope user-to-user services have an illegal content risk assessment duty and related illegal-content safety duties. They must also meet the content reporting duty, complaints procedure duty and terms of service duty, and keep records of risk assessments and compliance steps. The terms of service must explain how the service deals with illegal content, and the service must apply them consistently.

Services must assess whether children are likely to access them. If they are, the children's risk assessment duty and children's safety duties apply. The transparency reporting duty applies to Category 1 services, not every platform.

A compromised account is a common trigger for a safety review. If a seller account is taken over and used to post scam listings, the incident, the response and the fix belong in the record. The same applies to coordinated abuse, repeated policy breaches and any harm to a child.

Records do not need to be elaborate. Most Scottish platform operators run lean teams, so a dated folder per assessment plus a decision log is enough, provided one named person in Scotland owns it. A report to Police Scotland about criminal content should be logged with its reference number, because that number links your record to the incident.

What fails is a mixture of email threads, chat messages and memory.

What good records look like

Risk assessments and record-keeping for Glasgow and Edinburgh platforms

A risk assessment is not a one-off form. It is a documented judgement about what could go wrong on your service and what you are doing about it. Glasgow and Edinburgh operators should treat it as a live document, reviewed when features change or when a serious incident occurs.

For illegal content, assess the risks named in the Act, such as scam listings, weapons, drugs, sexual content and harassment. For child safety, first assess whether children are likely to access the service; if they are, carry out a children's risk assessment and address the relevant risks.

Record the reasoning, not just the conclusion. If you decide that a particular risk is low because your platform is invitation-only, write that down with the date and the person who decided. A later reviewer should be able to follow the logic without asking you.

Edinburgh social commerce operators with live selling features should pay attention to real-time risk. Chat moves fast, and moderation that only runs after the stream ends leaves a gap. Record how you monitor live sessions, who can intervene, and how quickly.

Glasgow platform operators with a mixed user base should consider local context. Fraud patterns, counterfeit goods and abusive behaviour vary by market. A risk assessment written for a national audience may miss what your users actually report.

Review triggers matter. A new payment method, a new messaging feature, a change in user demographics or a rise in reports should all prompt a review. Put the trigger list in the record so the review is not left to memory.

Numbered steps for a first assessment

Content moderation duties that touch social selling listings

The Act's safety duties require systems to address illegal content and, where children are likely to access the service, relevant child safety risks. On a social selling platform, that may involve listings, comments, reviews and messages. Difficult cases can include a listing that looks like a scam, a review that is fake, a seller who keeps breaching policy, or a buyer who harasses a seller in messages.

The Act does not require you to remove everything questionable. It requires a system that identifies and deals with illegal content and protects children, with records that show the system working. That means clear rules, consistent decisions and a route for users to complain.

Write your moderation policy so a new user can follow it, and publish it on the platform rather than only in seller terms. Scottish buyers should be able to see what is allowed, how long a decision takes, and which body to approach next.

Criminal content goes to Police Scotland. A consumer dispute goes to the trading standards service at the relevant council, such as Glasgow City Council or the City of Edinburgh Council. A policy that exists only in a staff chat is not a policy.

Train moderators on the specific harms in your risk assessment. Generic training misses the patterns that matter on a selling platform, such as deposit scams, fake tracking numbers and off-platform payment requests. Keep a record of who was trained and when.

Escalation should be named. If a moderator cannot decide, they should know who can, and how quickly that person responds. Record escalations and outcomes so the pattern is visible.

Appeals matter too. A seller whose listing is removed needs a way to ask for review. Record the appeal, the reviewer and the result. This protects users and gives you evidence of a fair process.

A complete request to pause a seller account should follow a written path, not an improvised one. The same discipline applies to reinstatement.

Interaction with consumer law and the Digital Markets, Competition and Consumers Act 2024

The Digital Markets, Competition and Consumers Act 2024 changes consumer protection rules that affect platform operators. It strengthens the Competition and Markets Authority's ability to act on unfair commercial practices, including some online practices.

Online safety duties and consumer duties overlap but are not the same. Ofcom handles online safety; the CMA and Trading Standards handle consumer law. A scam listing can breach both regimes, so your records should be usable by either.

Consumer law, advertising, reviews and creator accountability are already tightening around social selling. Fake reviews, misleading claims and undisclosed ads are consumer law problems before they become safety problems. Scottish operators should keep evidence of how listings and creator content are checked.

Trading Standards in Scotland enforces much of consumer law locally. A complaint from a buyer can reach Trading Standards without passing through Ofcom. Keep your complaints log in a state you would be willing to share.

Where the two regimes meet

A records checklist for Scottish platform operators

Use this checklist as a working document. Review it quarterly and after any serious incident. Keep everything dated and owned.

Named owners, explicit order states and tested recovery make the difference between a checklist that exists and one that works. Assign each item to a person, not a team, and set a review date.

Store records where a colleague in Scotland can produce them without you. An Ofcom information request or a trading standards enquiry from a Scottish council sets a deadline, and a slow reply counts against you.

The registered office on your Companies House entry is often the address a notice reaches, so whoever handles post there should know where the records sit. If retrieval takes a week, the record is effectively missing.

Keep records long enough to be useful. Retention periods should be written down and followed. Deleting evidence of a decision too early is its own risk.

Review the checklist when the platform changes. A new feature, a new market or a new payment route can change your risk profile. The checklist should change with it.

Finally, test the process. Run a tabletop exercise on a scam listing or a child safety report and see what the records look like afterwards. Gaps show up quickly.

Common questions