Rules and ethics
Social commerce UK regulations: a compliance plan
A practical compliance plan for social commerce UK regulations, covering consumer sales, advertising, product safety and data before a campaign goes live.
This guide turns social commerce UK regulations into a practical launch checklist. No single UK regulation governs social commerce. For a consumer order delivered in England, a merchant may need to consider unfair commercial practices, distance contracts, advertising, privacy, product safety and category-specific rules. The applicable mix depends on what is sold, who controls the message, where checkout occurs and how personal information is used.
What to take away
- The rules that apply turn on the product, message control, checkout host and data use.
- Territorial scope variesGreat Britain guidance covers England, Scotland and Wales, with a different Northern Ireland position.
- Consumer protection rules can apply to promotion as well as supply under the Digital Markets, Competition and Consumers Act 2024.
- Advertising responsibility falls primarily on marketers, but agencies, publishers and suppliers also carry obligations.
- Product safety and data duties need separate review, with evidence kept alongside the campaign record.
Start with territorial scope
England is in Great Britain and the UK, but those labels are not interchangeable in product guidance.
The OPSS general product safety page says its Great Britain guidance applies to England, Scotland and Wales. It notes a different position in Northern Ireland from 13 December 2024. Check the precise product regime rather than adding a generic "UK compliant" statement.
In Great Britain, the General Product Safety Regulations 2005 provide a general safety backstop where product-specific rules do not set the relevant requirements. In Northern Ireland, Regulation (EU) 2023/988 on general product safety applies under the Windsor Framework. Product marking is also product-specific: check the current Great Britain rules on whether CE marking is recognised or UKCA marking is required, and check the applicable Northern Ireland rules separately. The Product Regulation and Metrology Act 2025 provides powers to update product regulation; it does not remove the need to check the requirements for the product.
For each journey, record the buyer location rule, seller, product origin, supply-chain role, checkout host and delivery destination. Platform availability does not decide legal scope by itself.
Create a territory line for every source in the compliance file. Mark whether it applies across the UK, only in Great Britain, or specifically in England and Wales, and record the version date. If the business also serves Northern Ireland, build a separate product and fulfilment check rather than treating the England result as portable.
Consumer protection covers the promotion
The CMA's unfair commercial practices guidance explains the Digital Markets, Competition and Consumers Act 2024 provisions applying from 6 April 2025. The rules address misleading actions and omissions, aggressive conduct and practices banned in all circumstances. They can apply to conduct relating to promotion as well as supply.
Banned practices include fake reviews, drip pricing where mandatory fees are left out of the headline price, and false claims that an offer is available for a limited time only. From 6 April 2025, the Act gives the CMA direct consumer-enforcement powers, including to investigate and determine certain breaches. It can act on a banned practice without showing it harmed an individual consumer.
The CMA guidance also covers misleading environmental claims, which must be substantiated. The CMA can impose penalties of up to 10 per cent of global turnover for breaches.
Review the entire impression made by a post, product card, creator statement and linked checkout. Keep substantiation for objective claims, reveal material qualifications at the point needed and match availability or deadline statements to live records.
For covered distance contracts, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 set out pre-contract information, confirmation, delivery and cancellation duties, with exceptions; the GOV.UK online-selling guide describes them. Pre-contract information includes the total price with taxes and delivery charges, the trader's identity and geographical address, and the 14-day cancellation right. The Consumer Rights Act 2015 also requires goods to be as described, of satisfactory quality and fit for purpose, and sets rules on delivery and remedies. Map who provides each item when an app hands the buyer to another seller site.
Advertising rules follow the content
The CAP Code is the non-broadcast advertising rulebook within its scope. The separate BCAP Code covers broadcast advertising; the Advertising Standards Authority (ASA) is the UK's independent advertising regulator and handles complaints under these codes. Section 1 rule 1.3 places primary responsibility on marketers while recognising obligations for agencies, publishers and other suppliers. Section 2 rule 2.1 requires marketing communications to be obviously identifiable.
Rule 2.3 requires marketing communications to make clear their commercial intent if not clear from context. Rule 3.1 prohibits material misleading claims.
Classify brand posts, paid ads, gifted creator content, affiliate links and customer reviews separately. Facts about payment and control determine the analysis. The ASA's current influencer resource library provides routes to disclosure and affiliate guidance, but a qualified reviewer should assess the actual execution.
Product and data duties remain separate
OPSS product-safety advice for businesses describes responsibilities for businesses that make, import, distribute or sell consumer products. The advice covers toys, electrical goods, cosmetics and other consumer products. Keep category evidence, labels, warnings, traceability and incident ownership with the campaign record. Do not let high sales exposure outrun recall readiness.
Tracking and messaging need their own review. The UK GDPR and Data Protection Act 2018 govern personal-data processing; the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) also apply to matters including electronic-mail marketing and tracking technologies. The ICO's direct-marketing guidance covers data-protection and PECR considerations for activities including targeted social media, while separate electronic-mail guidance addresses email, text and direct messages. Check whether the organisation must pay the ICO data protection fee or is exempt, and keep its fee registration current if required. Where a personal-data breach is reportable, use the ICO's personal data breach reporting route and notify affected people where required.
The guidance explains that consent must be freely given, specific, informed and unambiguous. For electronic mail, PECR requires consent unless the soft opt-in applies, and the guidance sets out the conditions.
Map the merchant website, platform, pixel provider, customer-list upload and support inbox individually. Confirm which organisation decides each purpose and which agreement covers processing. Check consent behaviour in the deployed route, including refusal and withdrawal, instead of relying on the setup screen.
Regulated categories need an early branch. For example, financial promotions may engage the Financial Services and Markets Act 2000 and Financial Conduct Authority (FCA) rules; medicines may engage the Human Medicines Regulations 2012 and Medicines and Healthcare products Regulatory Agency (MHRA) requirements; gambling may engage the Gambling Act 2005 and Gambling Commission rules; and alcohol sales may engage the Licensing Act 2003 and local licensing authority requirements. Food products and claims may need review against Food Standards Agency guidance and local-authority requirements. Age-restricted goods and high fat, salt and sugar (HFSS) advertising also need product-specific checks, including applicable CAP and BCAP rules. A finance, medicine, age-restricted, food, environmental or prize-promotion claim may trigger additional rules and competent review. Record the decision to exclude such material from an ordinary-retail campaign; absence from the content brief should not be left to chance.
Before launch, create a legal issue register by product, claim, audience, territory and data use. Assign the applicable source, reviewer, evidence, decision and recheck date. Pause on unresolved seller identity, safety, material claim, price or disclosure questions rather than assuming a platform approval settles them.
Before you act
- Log buyer location, seller, origin and checkout host per journey.
- Date each territorial source in the compliance file.
- Assess posts, cards and creator statements as one impression.
- Label paid, gifted, affiliate and organic content apart.
- List data purposes and the processor contract for each organisation.
- Open a legal issue register by product, claim, audience and territory.
Common questions
How should a merchant handle territorial scope for a social sale?
Apply the product rules for the buyer's location, not the platform's reach. Record the source, version date and whether it covers the UK, Great Britain or England and Wales.
Do consumer protection rules cover promotion as well as supply?
Yes. The CMA unfair commercial practices guidance explains Digital Markets, Competition and Consumers Act 2024 provisions applying from 6 April 2025. The rules address misleading actions and omissions, aggressive conduct and practices banned in all circumstances. They can apply to conduct relating to promotion as well as supply, so review the entire impression made.
What should a business do about product safety and data duties?
OPSS product-safety advice for businesses describes responsibilities for those who make, import, distribute or sell consumer products. Keep category evidence, labels, warnings, traceability and incident ownership with the campaign record. For data, the ICO direct-marketing guidance covers data-protection and PECR considerations, including targeted social media.
