UK marketplace seller software rules and ethics: controls

Marketplace seller software rules and ethics sit within a trading arrangement; the software does not replace it. For this guide, the operating case is one merchant established in England, one authorised seller legal entity, one named marketplace account, one defined software service and a bounded journey from approved product record to stock, order, payment and later customer states.

The seller, marketplace operator, software supplier, managed provider, advertiser, payment or fulfilment party and consumer may have different legal and contractual positions. A marketplace acceptance or successful configuration does not prove that the seller has met a duty, that a claim is supported or that another party has assumed responsibility.

This guide sets out operational questions, not advice on a particular case. Check the actual goods, parties, communications, data flows, territory and contracts before relying on a compliance decision.

What to take away

Fix the territory and factual trigger

Start with where the seller is established, where the consumer is, where goods are located and supplied, and which marketplace contract governs the account. Record whether a product is offered in England, elsewhere in Great Britain, Northern Ireland or another country. Do not write "UK compliant" as a single status.

Product safety is a clear example. OPSS says its product-safety advice for businesses reflects different treatment in Great Britain and Northern Ireland, including the application of the EU General Product Safety Regulation in Northern Ireland from 13 December 2024. Product-specific rules may also take precedence. A qualified safety reviewer must identify the actor and regime for each product.

Record the event that engages each review: an invitation to purchase, optional charge, consumer order, advertising claim, customer review, product incident, cookie or other device operation, marketing message, return, refund, security incident or supplier exit. A generic tool category does not trigger every rule in the same way.

Map seller identity and the consumer journey

The seller's approved record should identify the contracting trader and contain the information required for the actual offer. Relevant UK instruments include the Consumer Rights Act 2015, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 and the Electronic Commerce (EC Directive) Regulations 2002; check their scope against the seller, goods, transaction and territory. GOV.UK's online-selling and distance-selling guidance covers ordering steps, seller contact information, product description, price, delivery, correction, contract confirmation, pre-contract information, cancellation and post-order records. Exceptions and separate cross-border considerations may apply.

Turn that material into fields rather than a blanket conclusion. For every product population, record seller identity, description, total-price basis, delivery, payment, order correction, confirmation, cancellation, return, refund and support evidence. The consumer lawyer decides scope and exceptions.

Order and money states remain separate. Placed, authorised, captured, accepted, fulfilled, cancelled, returned, refunded, disputed and settled should never collapse into "sale"; the software may report one state while the marketplace, payment provider and accounting ledger report others. Where cardholder data is involved, establish the seller's and provider's responsibilities under the Payment Card Industry Data Security Standard (PCI DSS) rather than treating payment states as evidence of payment security.

Check price and optional choices independently

The unfair-commercial-practice provisions in Part 4 of the Digital Markets, Competition and Consumers Act 2024 apply to commercial practices from 6 April 2025, according to the CMA's current CMA207 guidance. That guidance replaced and updated the earlier CPUTR framework for those practices and includes invitation-to-purchase, misleading-practice and banned-practice material.

The CMA's price-transparency guidance addresses mandatory charges and the practices described as drip pricing and partitioned pricing. GOV.UK separately explains that a business must obtain express consent for optional extras, rather than preselecting a charge.

Test the actual invitation, total displayed price, unavoidable charges, optional choice and resulting order evidence. Do not infer a lawful presentation from a correctly calculated back-office amount. Consumer and advertising review are separate non-compensating gates.

Apply ethical controls beyond legal compliance

A useful named ethical framework is the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct; they are voluntary guidance, not a substitute for UK law. Turn the principles of transparency, accountability and respect for consumers into a seller code: prohibit fake reviews, fabricated scarcity and hidden charges, and test whether choices or interface design unfairly pressure customers.

Keep advertising apart from the product record

An approved catalogue record may be used in editorial material, a seller's own marketing, paid marketplace promotion, affiliate content or a sponsored endorsement. Label the relationship and communication before applying a rule.

The CAP Code requires non-broadcast marketing communications to be recognisable as such in its recognition rules. CAP's Section 3 misleading-advertising advice says the overall impression and objective claims matter, while the advice itself states that it is not legal advice and does not bind the ASA or CAP panels.

Maintain a claim register with exact wording, product population, evidence owner, source date, permitted channel and expiry. Reviews and endorsements need their own evidence and relationship fields. A platform label may help a user recognise an ad, but it does not substantiate the product claim.

Preserve safety and traceability

Product identity, batch or model evidence, manufacturer or importer details, instructions, warnings and applicable conformity material belong with the approved product record. The software may transport those fields; a product-safety specialist decides whether they are accurate and sufficient.

OPSS's product-safety business guidance says businesses must not sell consumer products they know, or should have known, are unsafe, and describes supplier traceability and corrective action. OPSS's business notification guidance distinguishes Great Britain and Northern Ireland markets. Check the current guidance and the applicable territory before acting.

Build an urgent route to identify affected listings, stop further publication, preserve the decision, notify the authorised owner and verify correction or withdrawal. Absence from an alert list is not evidence that a product is safe. A marketplace's willingness to host the listing is not regulatory approval.

Draw the personal-data and device map

List every personal-data flow by purpose, source, field, recipient, location, retention and deletion route. Orders, customer messages, return reasons, fraud flags, account-user logs and support records may involve different people and purposes. Record who decides why and how processing occurs; do not assign controller or processor labels from the contract heading alone.

The ICO's summary for organisations on the Data (Use and Access) Act 2025 (DUAA) explains the Act's data-protection changes; check commencement and current ICO material before relying on a provision. The ICO's controller-processor contract guidance is marked as under review, so verify the current version and assess the actual processing arrangements.

The ICO's storage and access technologies guidance addresses PECR and, where relevant, UK GDPR. A privacy and PECR adviser must classify each cookie, pixel, local-storage use or similar operation and its purpose before activation.

Control access, suppliers and incidents

Map human and service accounts, authentication, permissions, logs, support access and revocation. A managed provider's account needs its own authority. Do not share a marketplace owner credential because a supplier needs to investigate an error.

NCSC guidance for using SaaS securely covers privileged access, monitoring, protected copies and recovery exercises. Named control frameworks to assess include ISO/IEC 27001, Cyber Essentials and SOC 2; they have different scopes and forms of assurance, and none by itself proves legal compliance. NCSC guidance is security guidance, not law or certification. Test the exact configuration with synthetic or specifically authorised records.

Define the response to a data, account, product or payment incident. Preserve logs, restrict further harm, identify the decision owners and follow the applicable reporting route, checking current ICO personal-data breach guidance and statutory requirements.

Test accessibility as a separate service question

The Equality Act 2010 applies across Great Britain, while Northern Ireland has different equality legislation. The government's service-provider quick-start guide describes anticipatory reasonable-adjustment duties under the Act. Exact application requires accessibility and legal review.

Test the seller's staff task and the consumer journey, including product information, price, optional choices, error correction, checkout, cancellation and support. Record technology, browser, assistive setup, task, result and barrier. A conformance statement or automated scan cannot prove that the whole journey works.

Reconcile VAT and contractual records

HMRC's VAT record guidance identifies supplies, time and value of supply, adjustments, invoices and credit or debit notes. Treatment depends on the seller, goods, location and transaction. An accountant and VAT adviser must map marketplace, payment and ledger events without treating the software state as a tax conclusion.

The commercial contract should name the entity and service, authority, scope, marketplace or interface dependencies, data roles, security, support, change, evidence, audit, correction, suspension, fees, VAT basis, liability review, insurance evidence, export, transition and deletion. These are due-diligence questions, not model clauses. Privacy, product, consumer and tax responsibilities cannot be assigned accurately without the factual activity and qualified review.

Examples of marketplace-seller software to assess include Linnworks, Brightpearl, ChannelEngine and Veeqo; check each product's actual functions, permissions and service terms against this control map rather than treating a product name as proof of compliance. For marketplace access, identify the terms that actually govern the account and integration, such as Amazon's Selling Partner API terms or eBay's API License Agreement, and check the applicable versions and permissions.

Keep a correction and disclosure record

For each public or consumer-facing statement, record whether it is seller-supplied product fact, verified independent evidence, advertising, a paid or sponsored relationship, platform-provided information or unresolved uncertainty. State material limits beside the claim. Keep price and charge evidence with the exact product and time.

Define who can correct a listing, withdraw a claim, pause an advert, suppress a product and notify operational teams. Preserve the old version, reason, approval and completion evidence. A disclaimer cannot repair a hidden charge, unsupported claim, missing safety evidence or unlawful data use.

Publication and release gate

Before publishing a listing, check the current legislation and regulator guidance for the relevant territory, including commencement and scope, and assign an owner to every field requiring review. Before putting software into production, verify the actual marketplace terms, interface permissions, supplier edition and signed contracts.

Record each decision as pass for a narrowly evidenced state, hold pending evidence or stop. This guide does not certify software, a seller, a listing or a marketplace journey.

Before you act

Common questions

Does a marketplace acceptance prove the seller has met its legal duties?

No. A marketplace's acceptance or successful configuration does not prove that the seller has met a duty, that a claim is supported or that another party has assumed responsibility. The seller, marketplace operator, software supplier and other parties may hold different legal and contractual positions.

Why should order and money states be kept separate?

Placed, authorised, captured, accepted, fulfilled, cancelled, returned, refunded, disputed and settled should never collapse into sale. The software may report one state while the marketplace, payment provider and accounting ledger report others, so each state needs its own record.

What must happen before a cookie or similar device operation is activated?

A privacy and PECR adviser must classify each cookie, pixel, local-storage use or similar operation and its purpose before activation. Consult the ICO's storage and access technologies guidance, which addresses PECR and, where relevant, UK GDPR.