Acceptable Use Policy Template and How to Draft One (2026)

What is an acceptable use policy? An acceptable use policy (AUP) is a document that tells users what they may and may not do with a service, a website, a network, or company IT. It protects the provider by setting clear rules, giving a basis to suspend or remove an abusive user, and reducing legal and security risk. You will see an AUP in three common places: as part of the terms for an online service or app, as a website policy for visitors, and as an internal policy for employees using a company's systems. An AUP is not the same as the main terms of service or a privacy policy. The terms of service form the contract, the privacy policy explains how personal data is handled, and the AUP focuses on conduct: what counts as misuse and what happens when someone crosses the line. The template below works for a website or an online service; the notes explain how to adapt it for internal employee use. This template is a strong starting point, not a one-size-fits-all document, and some rules depend on local law. For a regulated or high-risk service, have a lawyer review it. ## An acceptable use policy template you can copy ```

ACCEPTABLE USE POLICY Effective date: [date] Applies to: [service / website / network name], operated by [company]. 1. PURPOSE AND SCOPE This policy sets out the acceptable use of [the Service]. It applies to every user who accesses or uses [the Service]. By using [the Service] you agree to this policy. It forms part of our [Terms of Service]. 2. ACCEPTABLE USE You may use [the Service] only for lawful purposes and in line with this policy and all applicable laws. 3. PROHIBITED CONTENT You must not upload, post or transmit content that is: a. unlawful, defamatory, obscene, or harmful to minors; b. infringing of any intellectual property or privacy right; c. hateful or that incites violence or discrimination; d. false or misleading in a way likely to deceive. 4. PROHIBITED CONDUCT You must not: a. gain or attempt unauthorised access to any system, account or data; b. introduce malware, or interfere with or disrupt [the Service]; c. probe, scan or test the vulnerability of [the Service] without consent; d. send spam, bulk or unsolicited messages; e. scrape or harvest data except as expressly permitted; f. impersonate any person or misrepresent your affiliation; g. use [the Service] to breach any law or third-party right. 5. SECURITY AND ACCOUNTS You are responsible for your account credentials and for all activity under your account. You must notify us of any suspected breach at [contact]. 6. FAIR USE AND RESOURCE LIMITS [Describe any usage limits, rate limits, or fair-use expectations, e.g. API call limits, storage caps, or bandwidth.] You must not place an unreasonable load on [the Service]. 7. USER CONTENT AND RESPONSIBILITY You are responsible for the content you submit. We may, but are not obliged to, review content and may remove anything that breaches this policy. 8. MONITORING AND REPORTING We may monitor use of [the Service] to enforce this policy and comply with law. To report a violation, contact [abuse contact]. 9. CONSEQUENCES OF BREACH If you breach this policy we may, with or without notice as appropriate: a. remove or disable the offending content; b. suspend or terminate your access or account; c. report the matter to law enforcement where required. 10. CHANGES TO THIS POLICY We may update this policy from time to time. The effective date above shows the latest version, and continued use means you accept the changes. 11. CONTACT Questions about this policy: [email / address].

- **Tailor the prohibited lists to your real risks.** The lists above are generic. A payments app adds fraud and money-laundering rules; a developer platform adds rules on reverse engineering and API abuse; a community site adds harassment and content rules. Delete what does not apply and add what does.
- **Set real resource limits.** If you offer an API or storage, state the actual rate limits or caps, or at least the fair-use expectation, so you can act on abuse without argument.
- **Make the consequences proportionate and clear.** Spell out the ladder: remove content, suspend, terminate, report. Say when you will give notice and when a serious breach allows immediate action.
- **For an internal employee AUP, change the audience and add work-specific rules.** An employee AUP covers company devices, email, internet use, personal use limits, software installation, data handling, and bring-your-own-device rules, and it should sit alongside the employment terms and the data protection policy. State clearly what monitoring the employer carries out, since monitoring of employees is regulated.
- **Keep it readable.** An AUP that nobody understands does not change behaviour. Short sentences and plain lists do more work than dense legal prose. ## Website, online service and internal AUP: what changes | Feature | Website / app AUP | API or platform AUP | Internal employee AUP |
|---|---|---|---|
| Audience | Visitors and users | Developers, integrators | Employees and contractors |
| Core focus | Content and conduct | Rate limits, scraping, reverse engineering | Device, email, data, personal use |
| Enforcement | Remove content, ban account | Throttle, revoke API keys | Disciplinary process |
| Sits with | Terms of service | Developer terms | Employment and IT policies |
| Monitoring | Light, abuse reports | Usage logs | Regulated employee monitoring | ## Legal and jurisdiction notes - **It forms part of a contract.** An AUP is most enforceable when it is incorporated into the terms of service the user agreed to. A policy linked in a footer that nobody accepted is weaker.
- **Monitoring and data rules vary by jurisdiction.** Monitoring users or employees engages privacy and data-protection law, which differs across India, the UK, the EU and elsewhere. Say what you monitor and why, and keep it proportionate.
- **Content rules follow local law.** What counts as unlawful content, and your duties to remove it, depend on the country and on intermediary or platform rules. Confirm the position where your users are. *This template is general information, not legal advice. Enforceability, monitoring and content rules vary by jurisdiction, so have a qualified professional review the policy for a regulated or high-risk service.* ## Where a contract workspace helps An acceptable use policy is rarely a standalone document. It sits with the terms of service, the privacy policy, developer terms, and, for employees, the IT and HR policies. Keeping them consistent, versioned, and up to date as the service and the law change is the work that outlasts the drafting. Drafting an acceptable use policy and then keeping it aligned with your terms of service, privacy policy and internal IT rules can run inside one AI workspace tuned to your service. [Adira](https://adiralaw.com) is designed around it: it drafts a policy from a template matched to your service, flags gaps and one-sided or missing clauses, lets you edit wording in plain language, and holds every version and its effective date in one place. The template above is enough to prepare a policy on its own; a workspace just keeps it in step with the documents it belongs to.