Scope 3 emissions are indirect greenhouse gas emissions that occur in a company's value chain — not from its own operations (Scope 1) or purchased energy (Scope 2), but from everything upstream and downstream: suppliers, business travel, employee commuting, product use, and end-of-life disposal.

For digital businesses — software companies, SaaS platforms, digital agencies, and e-commerce operators — Scope 3 is often 70-90% of total emissions. And it is the most underreported. This guide explains which Scope 3 categories are most relevant to digital businesses and how to start measuring them.

The GHG Protocol Scope 3 Categories for Digital Companies

The GHG Protocol defines 15 Scope 3 categories, split between upstream (before your operations) and downstream (after your operations). Not all 15 apply equally to every business. For digital companies, the relevant categories are typically:

Upstream categories:

  • Category 1: Purchased goods and services — cloud hosting, software subscriptions, design assets, marketing services. For most SaaS companies, AWS/GCP/Azure emissions fall here.
  • Category 2: Capital goods — servers if self-hosted, laptops and hardware issued to employees
  • Category 5: Waste generated in operations — electronic waste from old hardware
  • Category 6: Business travel — flights, rail, accommodation for in-person meetings and conferences
  • Category 7: Employee commuting — daily travel to office locations
  • Category 8: Upstream leased assets — office space energy consumption if not under your direct lease

Downstream categories:

  • Category 11: Use of sold products — for SaaS: the server energy consumed when customers use your product. For digital agencies: the websites they build and their ongoing hosting energy.
  • Category 13: Downstream leased assets — rarely applicable for digital businesses

The Biggest Scope 3 Source for Most Digital Companies: Cloud Infrastructure

For the majority of SaaS companies, Category 1 (purchased goods and services) dominates Scope 3 — specifically the carbon footprint of cloud computing services. AWS, Google Cloud, and Microsoft Azure have all published emissions data and carbon intensity figures, but the data varies considerably in transparency and methodology.

How to estimate your cloud Scope 3 emissions:

  1. Download your cloud provider's emissions report: AWS Sustainability Dashboard, Google Cloud Carbon Footprint, and Azure Emissions Impact Dashboard all provide market-based emission estimates for your usage.
  2. Apply location-based vs market-based accounting: if your cloud region is in a high-renewable area (like GCP's Iowa data center), market-based accounting will show lower emissions. Location-based uses regional grid averages.
  3. Factor in embodied carbon: the manufacturing of physical servers contributes to cloud Scope 3 emissions but is often not included in provider dashboards. The Sustainable Web Design model includes a hardware manufacturing factor.

Category 11: Use of Sold Products — the Most Underreported

For SaaS companies, Category 11 represents the electricity consumed by customers when using your product. This is typically the largest Scope 3 category for software businesses, yet it is consistently underreported because it requires estimating end-user energy consumption.

The calculation framework:

  • Estimate average session duration and frequency per user
  • Apply a device energy consumption factor (laptop: ~30W, desktop: ~60W, mobile: ~5W)
  • Multiply by average grid carbon intensity in your user's regions
  • Scale by total user count

This is an approximation, but it provides an order-of-magnitude estimate that is more useful than zero. The GHG Protocol's Scope 3 Standard (2011) and the Technical Guidance for Calculating Scope 3 Emissions (2013) provide the methodological basis.

Employee Commuting and Business Travel: Still Significant

Categories 6 (business travel) and 7 (employee commuting) remain materially significant for digital businesses with hybrid or in-person teams. Post-pandemic normalization has increased business travel; the shift to hybrid work has reduced commuting but not eliminated it.

For employee commuting, the primary data collection method is an annual survey asking employees about their primary commuting mode and distance. This data feeds into emission factors from DEFRA (UK), EPA (US), or ADEME (France) depending on your employee locations.

For business travel, expense management system data typically provides the cleanest input: flight bookings, rail tickets, and hotel stays can be converted to emissions using standard factors. Tools like Sweep, Watershed, and Persefoni automate this conversion from expense data.

Website and App Carbon as Scope 3

Your own website and digital products consume energy on users' devices and in data centers — this maps to Category 11 for a digital service business. Our website carbon footprint calculator guide covers the methodology in detail. For CSRD reporting purposes, this is typically captured under Category 11 — use of sold products.

For digital agencies that build websites for clients, the ongoing hosting energy of client sites represents a downstream Scope 3 impact that progressive agencies are beginning to include in their carbon accounts. The CSRD reporting requirements for digital businesses increasingly expect this data.

How to Report Scope 3 in Practice

Most digital businesses beginning Scope 3 reporting follow this sequence:

  1. Identify material categories — not all 15 categories apply equally. Start with the 3-4 highest-emission categories for your business model.
  2. Use spend-based estimation for year 1 — convert supplier spend to emissions using environmentally extended input-output (EEIO) models. Less accurate, but achievable without detailed supplier data.
  3. Build supplier engagement for year 2+ — request actual emission data from key suppliers (cloud providers, major software vendors). This improves accuracy dramatically.
  4. Apply the materiality threshold — CSRD and GHG Protocol guidance allows excluding categories that represent less than 1% of total Scope 3. Focus on the significant sources.
  5. Disclose methodology clearly — specify which categories are included, which estimation methods were used, and where primary data vs secondary data was applied.

For businesses subject to CSRD mandatory reporting (EU large companies from 2025, listed SMEs from 2026), Scope 3 disclosure is now required. For others, voluntary disclosure via CDP, GRI, or aligned with TCFD remains the market expectation from investors and enterprise customers.