The Acceptable Use Clause Explained (2026)

What is an acceptable use clause? An acceptable use clause sets out how a customer and its users are allowed to use a product or service, and what they must not do with it. It is most common in software-as-a-service (SaaS), cloud, hosting, telecom and platform contracts, where one party gives many users access to a shared system. The clause either lists the rules inside the main agreement, or points to a separate Acceptable Use Policy (AUP) that is incorporated into the contract by reference. Either way, the effect is the same: the permitted and prohibited uses become binding contract terms, and a breach of them becomes a breach of the agreement. In short, the acceptable use clause answers one question for both sides: what counts as fair, safe and lawful use of this service, and what happens if a user crosses that line. ## What does an acceptable use clause actually do? A well-drafted acceptable use clause does four things at once. 1. It defines prohibited conduct. It lists uses the provider will not tolerate, such as sending spam, uploading malware, breaking security controls, infringing intellectual property, posting unlawful content, scraping data, or reselling the service without permission.

2. It allocates responsibility for users. The customer is usually made responsible for everyone it allows onto the service, including its employees, affiliates and end users. If one of them misbehaves, that is the customer's breach to answer for.
3. It gives the provider a remedy. It lets the provider suspend an account, throttle usage, remove content or terminate the contract when the rules are broken, often without having to prove wider damage first.
4. It protects the provider's wider obligations. Providers have their own duties to upstream suppliers, regulators and other customers. The clause lets them pass those constraints down to the people actually using the system. ## Why the acceptable use clause matters For the provider, the clause is often the only documented basis for acting against misuse. Without it, a provider may have no clear contractual right to stop a customer who is, say, scraping the platform at scale or using it to send bulk unsolicited mail. The clause turns a vague expectation of good behaviour into an enforceable rule. For the customer, the clause matters because it defines the edge of what the customer is paying for. A clause that is broad or vague, or that the provider can change at any time, creates real operational risk: a legitimate use today could be recast as a prohibited use tomorrow, with suspension as the consequence. Customers who depend on a service for live operations need to know the rules are stable and that suspension will not arrive without notice. Both sides therefore have an interest in a clause that is specific, fair and predictable rather than a one-line catch-all. ## A sample acceptable use clause The wording below is a neutral, general-purpose example for a SaaS agreement. It is a starting point to adapt with legal advice, not a finished clause for any particular deal. > Acceptable Use. Customer shall not, and shall ensure that its Users do not, use the Service to: (a) violate any applicable law or regulation; (b) infringe the intellectual property or privacy rights of any third party; (c) transmit any virus, worm or other malicious code; (d) send unsolicited bulk communications or engage in phishing; (e) attempt to gain unauthorised access to, probe or disrupt the Service or its underlying systems; (f) use the Service to build a competing product or to resell access without the Provider's prior written consent; or (g) use the Service in excess of the limits set out in the Order. Customer is responsible for all use of the Service under its account. If Customer or a User breaches this clause, Provider may suspend the affected access on notice and, where the breach is material and not cured within [X] days, terminate the Agreement in accordance with the termination clause. Where the rules live in a separate policy, the clause usually reads: "Customer's use of the Service is subject to the Provider's Acceptable Use Policy at [URL], as updated from time to time, which forms part of this Agreement." ## Acceptable use clause vs acceptable use policy These two terms are related but not identical, and it is worth keeping them apart. - The acceptable use clause is the provision inside the contract that makes the rules binding and sets the consequences of breach.

• The acceptable use policy (AUP) is often a standalone document, listing the detailed do's and don'ts, which the clause pulls into the contract by reference. Many contracts use both: a short clause in the agreement plus a longer policy hosted online. The practical risk sits in the link between them, especially the phrase "as updated from time to time," which can let the provider change the rules after signing. ## Points worth negotiating The acceptable use clause is usually presented as non-negotiable boilerplate, but several points reward attention, especially for the customer. - Specific, not open-ended. Prefer a defined list of prohibited uses over a catch-all such as "any use the Provider considers inappropriate." Vague standards give the provider wide discretion over your access.
• Notice and cure before suspension. Ask for prior notice and a short period to fix a problem before the provider suspends or terminates, except for genuine emergencies such as an active security threat.
• Proportionate response. Suspension should target the offending account or content, not the customer's entire service, where that can be avoided.
• Control over policy changes. If the clause incorporates an external AUP that can change "from time to time," negotiate for reasonable notice of material changes and, ideally, that changes will not reduce the customer's rights during the current term.
• Responsibility scoped fairly. Being responsible for your own users is reasonable. Being responsible for the acts of unrelated third parties you cannot control is not.
• Clear consequences. Tie the clause to the main termination and liability provisions so the outcome of a breach is predictable, not improvised. ## How the clause differs by jurisdiction The core idea of an acceptable use clause travels well, but enforceability varies. - In India, the clause operates against the backdrop of the Information Technology Act, 2000 and the intermediary rules, which already impose their own obligations on platforms and users; a MAC-style unilateral right to change terms may be read narrowly if it is seen as one-sided. Mark specific enforceability questions to verify with Indian counsel.
• In the United Kingdom and the EU, consumer and unfair-terms rules can limit how far a provider may rely on broad discretion or unilateral change clauses against consumers and, in some cases, small businesses.
• In the United States, enforceability turns largely on contract formation and notice, and incorporated-by-reference policies are generally upheld where the customer had reasonable notice. Where the law differs, say so in the contract rather than assuming one global answer. This explainer is general information, not legal advice. ## Bringing drafting, review and enforcement into one place The work behind a good acceptable use clause is the same work that runs across a whole contract: drafting it to match how your company actually sells or buys, checking the version you receive for one-sided terms, keeping track of which policy version was in force on the day you signed, and acting when something changes. Today much of that is done by hand across templates, email and shared drives. An AI contract workspace is built to hold those steps in one place: draft from a catalogue tuned to your company, see per-clause risk flagged as favourable, neutral or unfavourable, edit a clause in plain English, and keep a live timeline of every version and change. If you want to see how that idea works end to end, Adira is one example of a single workspace for drafting, review, tracking and governance. ## Key takeaways - An acceptable use clause makes the rules for using a service binding and sets the consequences of misuse.
• It protects providers by giving them a clear right to act, and protects customers only if it is specific and predictable.
• Watch catch-all language, unilateral policy changes and suspension without notice.
• Enforceability varies by jurisdiction, so name the differences rather than assume one answer fits all.