Software sits in an unusual position: broadly advertisable, and almost entirely excluded from commerce listings. Meta's Commerce Policies state that commerce content may not promote the buying, selling or trading of downloadable digital content, digital subscriptions or digital accounts, so a SaaS product cannot be listed in a Meta Shop. TikTok Shop's US prohibited product list covers Services and Virtual Products, and Virtual Goods sits in the invite-only tier a seller cannot self-apply into. LinkedIn, where software buyers keep their professional identity, has no shop, catalog, product tag or checkout format anywhere in its ads guide. All three were read against the platforms' own policy pages on 28 September 2026. They change without notice, so re-check before you build anything on them.
That single constraint decides the shape of everything else. There is no product tag to attach, no in-app checkout to optimise, no shoppable live stream. Every sale lands on your own domain, which means the job of social here is to move one named human from a scroll to a trial or a form, and then to get them to finish one real job inside the product. It also means the regional commerce gaps that wreck other categories barely register for this one. TikTok Shop is not available in Canada, and YouTube's shopping affiliate program runs in a short list of markets that excludes Canada, the UK and the EU. A software seller was never going to use those surfaces.
The second difference is that nobody buys software off one scroll, and the person who finds you is usually not the person who pays. Between discovery and money sits a trial, a peer check, a security questionnaire and often a budget holder who never saw a single post. So your content is not doing the selling. It is recruiting an internal champion and handing them something they can forward.
Who is buying, and how they decide
Software has three buyer shapes and they behave nothing alike. The prosumer buys with a card in one sitting, for a job they personally do every day, and decides inside the first session of actual use. The owner-operator of a small business is simultaneously the user, the economic buyer and the person who will implement it, so the deciding question is never the feature list, it is whether the thing removes work they hate. Mid-market and enterprise buying is a committee: a champion who found you, a manager who owns the budget and never saw your content, IT or security, and frequently finance and legal. In all three shapes the evaluation leaves your feed immediately. Buyers search your name alongside "alternative", "vs" and "pricing", read review sites, open your docs and your security page, and then ask one trusted peer in a private Slack, Discord or WhatsApp group whether it is any good. That private answer usually decides it, and you are not in the room for it. Purchases are triggered by change rather than by persuasion: a new hire in the role, an incumbent tool being ripped out, a failed audit, a compliance deadline, a funding round, a headcount freeze that makes automation cheaper than hiring. This is why consistency beats campaigns in this category. You are not trying to create the trigger. You are trying to be the familiar name when it fires.
Where this actually sells
Not every platform is worth your time in this category. These are the ones that are, and why.
The content that works
The path from scroll to sale
- Scroll stop on a single-job clip or a point-of-view post, where the first line names the role and the specific outcome rather than the product. The viewer's only question at this moment is whether this is about their job.
- Profile check. They read your bio and two or three adjacent posts to decide whether you actually do this for a living or merely post about it. Most of your loss happens here, and it is fixed by consistency of subject, not by production value.
- The off-platform click, which is mandatory here because no social surface can sell software. Two legitimate branches: a self-serve trial link for prosumer and SMB buyers, and a native lead form for anything with a committee. If you use Meta's instant forms, note that a Facebook Page is mandatory even for an Instagram-only campaign and the leads belong to the Page, and that Meta's developer documentation states you cannot retrieve leads while your app is in Development mode, so App Review including the leads_retrieval permission plus Business Verification come first. On LinkedIn, bidding is by click or impression rather than by cost per lead, and LinkedIn's own help documentation caps a Lead Gen Form at three custom questions drawn from twelve selectable fields, so the form will not do your qualification for you.
- First-session activation, which is the real conversion event. Getting one genuine job finished inside the product, using data the buyer cares about, is what separates a signup from a prospect. Instrument it and attribute it back to the source post. It is the number that tells you whether your content is reaching buyers or entertaining spectators.
- Human follow-up, time-boxed by platform policy. Meta's messaging policy gives businesses up to 24 hours to respond to a user, after which promotional content requires an approved message tag or a sponsored message, with the Human Agent tag covering manual responses within a seven-day period. Note also that a person logged in to Facebook cannot message your Instagram professional account, and the reverse holds too, so do not design one inbox where the platform gives you two.
- Money. Self-serve means a card and an onboarding sequence. Committee deals mean a security questionnaire, procurement and a signature from somebody who never saw your feed. Your champion runs that gauntlet without you, so the last job of your content is to give them the internal business case in a form they can paste.
Rules that constrain this category
Policies and regulations change. Treat this as the starting point for your own check, not as legal advice.
- Software is largely unrestricted as a product and blocked as a commerce listing. Meta's Commerce Policies state that commerce content may not promote the buying, selling or trading of downloadable digital content, digital subscriptions or digital accounts, while the same product may be advertised to an off-platform checkout. TikTok Shop's US prohibited product list includes Services and Virtual Products, with Virtual Goods in the invite-only tier a seller cannot apply into. LinkedIn has no commerce format at all. That is the organic-versus-paid split that actually matters in this category: you can advertise software nearly everywhere and list it almost nowhere. Verified against the platforms' own policy pages on 28 September 2026.
- LinkedIn prohibits affiliate advertising as a category. Its ads policy states that ads related to affiliate advertising are prohibited, and it was the only one of six major platforms checked with a blanket ban of that kind. This lands squarely on B2B software, because LinkedIn is where the buyers are and partner-led growth is this category's default second channel. Partners can post organically. You cannot buy affiliate reach there.
- Certain software subcategories carry gates that catch teams by surprise. Google Ads' restricted businesses policy states that third-party technical support for consumer technology products and online services is not allowed, requires certification as an authoritative distribution source to promote free desktop software, and bars promotion of call directory, forwarding and recording services. TikTok prohibits VPN services in a named set of markets, restricts them in others, and does not allow services used for copyright infringement, dishonest behaviour or bypassing subscription walls; those market tables are long and move, so read the live version rather than any count. Add a financial feature and your product inherits the financial services rulebook. Meta may require licensing or regulatory proof for insurance, mortgages, loans, investment products and credit card applications, and requires written permission plus a recognised licence for crypto exchanges, crypto lending, wallets that add buying, selling, swapping or staking, and mining software, while exempting crypto education, tax services, storage-only wallets and blockchain products that are not a virtual currency. Google Ads prohibits DeFi trading protocols, the purchase, sale or trade of cryptocurrencies, crypto loans, unhosted wallets, trading signals and investment advice platforms, and affiliate or aggregator sites in that vertical. Note the asymmetry a wallet feature walks into: Meta exempts a storage-only wallet, Google prohibits unhosted wallets outright. Treat written policy as the floor. Automated enforcement on financial and health-adjacent claims is routinely stricter than the text, and rejection is common even where a pathway exists on paper.
- AI claims are a substantiation problem, not a positioning choice. The FTC announced Operation AI Comply on 25 September 2024, a sweep of five law enforcement actions covering deceptive AI claims and AI-enabled deception, and the announcement stated there is no AI exemption from the laws on the books. If your creative says the product does something on its own, you need evidence in the form a regulator would accept, held before the ad runs.
- The review-incentive habit that is normal in this category is regulated conduct. The FTC's Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect on 21 October 2024 and reaches conditioning compensation or other incentives on a review expressing a particular sentiment, insiders writing reviews without clearly disclosing the relationship, company-controlled review sites purporting to be independent, review suppression, and fake negative reviews of a competitor. Unlike the Endorsement Guides it is a trade regulation rule, so civil penalties are available against knowing violators. The first public enforcement step under it was a set of warning letters to ten companies, announced by the FTC on 22 December 2025. Offering something in exchange for a five-star review, promoted through a social campaign, is the exposed tactic.
- When other people promote your software, disclosure differs by country and the platform's own label is not a defence. 16 CFR 255.5 requires that a connection which might materially affect the weight or credibility of an endorsement, and is not reasonably expected by the audience, be disclosed clearly and conspicuously, and 16 CFR 255.0(f) requires that in interactive media such as social the disclosure be unavoidable. The FTC states that responsibility rests with the influencer and the brand rather than the platform, and that a platform's built-in disclosure tool might not be adequate. Canada's Competition Bureau treats a material connection as any relationship that could influence how consumers perceive the influencer's independence, and Ad Standards' current guidance names "#Ad" used on its own as the gold standard and asks for disclosure of AI-generated or significantly AI-altered content. The UK diverges: CMA guidance lists "#spon" and "#sponsored" among labels to avoid, so wording the FTC expressly accepts is not safe in Britain. Two operational details for a partner programme: TikTok's Branded Content Policy defines branded content to include promotion where the creator will receive a commission on sales, for instance via an affiliate link or promotional code, and places compliance on the creator, so your brief has to carry the disclosure instruction; and TikTok's disclosure label cannot be changed once a post or LIVE is published, which means a mislabelled post has to be deleted and reposted.
- Three rules bind the part of the funnel just past the click. First, trial and subscription mechanics fall under the FTC's Negative Option Rule at 16 CFR Part 425, and that rule is mid-rewrite: the 2024 click-to-cancel amendments were vacated, the FTC published a rule on 12 February 2026 recodifying the Negative Option Rule as it existed before the 2024 final rule, and it issued a proposed rule on negative option marketing practices on 13 March 2026. Read the current rule text before you design a trial that auto-converts. Second, for phone follow-up on social leads, the Eleventh Circuit vacated the FCC's one-to-one consent rule on 24 January 2025 in Insurance Marketing Coalition v. FCC and the FCC formally eliminated it by final rule in September 2025, but consent-revocation obligations are a separate requirement that the litigation did not touch, so do not read the vacatur as permission. Third, in Canada, CASL requires consent before sending commercial electronic messages, which reaches every nurture sequence run out of Canada; and, specific to this category and routinely missed, the Government of Canada's own CASL guidance states that a person installing a computer program on another person's device must first obtain the consent of the device's owner, with express consent inferable where conduct makes it reasonable to believe the person consents, and a carve-out for security patches and bug fixes. If you ship an installer, a desktop agent, a browser extension or anything that lands on a machine, that provision is yours, not your lawyer's problem alone.
Selling this without owning it
If you want to sell in this category without making the product, these are the routes that exist. The sourcing directory covers each in more detail.
What to measure
- Activation rate by source post, not signups. The share of new accounts that finish one real job inside the product in their first session, attributed back to the specific post or campaign that sent them. Signups are the vanity layer in this category and they are cheap to manufacture with entertaining content.
- Named-account reach and frequency against your target list. How many people from the accounts you actually want saw you this month, and how many times, read from page and campaign reporting rather than follower count. This is the leading indicator: it moves a quarter or two before inbound demos do.
- Forward and save behaviour on point-of-view content. Saves, shares and direct sends matter more than likes here, because in a committee purchase the forward is the mechanism. A post with modest likes and heavy sends is doing exactly the job you built it for.
- Branded and comparison search demand, plus direct traffic. Social demand creation surfaces as people searching your name and running "vs" and "alternative" queries. If your social numbers are climbing and this is flat, you are reaching an audience that is entertained rather than buying.
- Stage-death rate for social-sourced deals, particularly at security review and procurement. Measure how many die there and how long they sit. A high kill rate at that gate usually means your content is recruiting enthusiastic champions with no authority, which is a targeting problem dressed up as a sales problem.
- Cost per activated account by content type, and reversal rate if you run partners. Track reversals and clawbacks as their own line rather than netting them into revenue, because impact.com documents budget-cap reversals as a reason a performing partner goes unpaid, and a channel that looks profitable gross can be underwater net.
The mistakes that cost the most
- Building a shop or product-tag strategy for something that cannot be listed. Teams burn a quarter wiring up commerce surfaces before discovering that Meta's Commerce Policies bar digital subscriptions and TikTok Shop's US prohibited product list covers Services and Virtual Products. Plan for off-platform checkout on day one and spend the saved quarter on activation instead.
- Running the partner motion as paid affiliate ads on LinkedIn. LinkedIn prohibits affiliate advertising as a category, so that budget gets rejected and your account draws attention. Partners can post organically on LinkedIn all day. You cannot buy that reach as affiliate advertising, and discovering this after you have promised partners paid amplification is an expensive conversation.
- Managing the channel on signup volume. A funny clip produces a flood of free accounts that convert at nothing, and the failure mode is scaling spend against a falling signup cost while activation quietly collapses underneath it. By the time revenue reports it, you have spent a quarter's budget teaching the algorithm to find you non-buyers.
- Letting the logo do the talking. Software buyers follow practitioners rather than brand handles, so a programme run entirely from the company account underperforms and cannot be fixed with more posting. Named humans with real jobs, given permission to have opinions, are the asset. This is also why thought leader placements exist as a format at all.
- Buying reviews the way this category has always bought them. Gift cards for reviews on software review sites, conditioned however softly on a positive rating, sit inside 16 CFR Part 465, which reaches sentiment-conditioned incentives and insider reviews without disclosure. The FTC's first public enforcement step was warning letters to ten companies, announced 22 December 2025. This is a growth habit plenty of teams have never examined, and it now has civil penalties attached.
- Shipping autonomy claims with no substantiation, then answering the leads late. The FTC's Operation AI Comply sweep, announced 25 September 2024, targeted deceptive AI claims, and the announcement stated there is no AI exemption from the laws on the books, so "it does the work for you" needs a file behind it. Separately, teams build a DM funnel and then reply on day three, by which point Meta's policy has closed the response window and promotional messaging requires an approved tag or a sponsored message.
No major social platform checks out a software subscription for you, so stop counting reach and start counting how many strangers finished one real job inside your product this week.