What Is An Acceptable Use Policy? 2024 Update

Key Takeaways

• An AUP sets rules for network or service use and protects organizations from legal risk.
• It outlines acceptable and prohibited activities, user responsibilities, and privacy standards.
• AUPs help prevent misuse, promote responsible use, and maintain cybersecurity.
• Violations are addressed through defined sanctions and reporting procedures.
• Content is developed collaboratively with administrators, HR, and legal counsel to ensure compliance.

What is an Acceptable Use Policy (AUP)? 2024 Update

An Acceptable Use Policy (AUP) (also known as a Fair Use Policy) is a set of rules applied by the owner, creator, or administrator of a network, website, or service that restricts how the network, website, or service may be used and sets guidelines as to how it should be used.  Similar to a Terms of Use Agreement, AUPs are legal documents that help protect organizations from users taking potential legal actions against them. For businesses that operate online, this sits naturally within Internet Law.

AUPs typically cover:

• Internet Access: Proper usage guidelines, including acceptable and unacceptable online activities.
• Employee Behavior: Acceptable and unacceptable conduct for employees while using company resources.
• Penalties: Consequences for violating the AUP.
• Security: Measures to promote company security.

Organizations often require employees or students to sign an AUP before granting network access. AUPs help:

• Prevent Misuse: Avoid unauthorized access and inappropriate use.
• Ensure Responsible Use: Promote responsible use of resources.
• Reduce Legal Risks: Mitigate the risk of legal issues.
• Create a Productive Environment: Foster a positive and efficient technology environment.

Who uses AUPs & Why are they necessary?

Entities that typically utilize AUPs include schools/universities, corporations/businesses, internet service providers, and website owners.  It is commonplace for organizations such as these to require that users sign an AUP prior to being granted access to the network.  With the internet growing in complexity, it is essential to have users sign an AUP so that they are explicitly aware of what they are and are not allowed to do while connected to an organization’s network.

AUP’s can: help to prevent cyber security threats, ensure that users are avoiding illegal activity and help users focus on productivity.

What is the main purpose of an Acceptable Use Policy?

An acceptable use policy sets the rules for how people can use a company’s systems, websites, and tools. It gives the business a clear line on permitted use, prohibited use, and consequences for misuse. In a legal context, it also helps protect the company from security incidents, privacy problems, and user behavior that crosses the line. For a broader context, this sits inside Internet Law, which governs how businesses manage online conduct, platforms, and digital systems.

Included in a standard AUP are clauses specifying the purpose and scope of the policy, the user’s rights and responsibilities, acceptable uses, prohibited uses, and privacy standards. This will help ensure users are only using internet access for appropriate tasks.  Having a good AUP in place will help bolster your organization’s reputation and productivity, all while shielding you from lawsuits brought by users (i.e., an unfair dismissal lawsuit from firing an employee for misuse of the company internet can be avoided with a clearly written AUP). 

Stipulations you may find in an AUP:

• Avoid violating the law while using the service
• Do not attempt to hack the security of the network or users on the network
• Do not attempt to send spam or junk mail
• Do not attempt to crash a website’s server with spam or mass emails
• Report any suspicious behavior you may see on the network

Penalties for violating the policy

• Warning
• Loss of network or system access
• Disciplinary action
• Termination of employment or access
• Legal action where the facts support it

Key elements of a standard AUP

1. Preamble: Explains why the policy is needed, its goals, and the process of developing the policy. 
2. Definition section: Defines key words used in the AUP. Terms such as Internet, computer network, education purpose, and other possibly ambiguous terms need to be defined clearly.
3. Policy statement: Should state what services are covered by the AUP and under what circumstances they may be used. 
4. Acceptable use section: Should clearly outline what is considered acceptable use and provide examples 
5. Unacceptable use section: Should clearly outline what is considered unacceptable use and provide examples
6. Violations/ sanctions section: Should outline how to report violations and whom they should contact regarding  questions about policy application

What to Consider When Creating an AUP

Acceptable Internet Use

Internet use policies can help ensure your employees are staying on task during working hours. The level of access employees have should be determined by their role and job scope. For example, creative teams and marketing teams may need greater access to certain social media websites to look for trends. Some websites that companies tend to restrict are : 

• Social media
• Streaming
• Shopping
• News
• Personal email/communications
• Pornography
• Gambling
• Illegal activity

Cybersecurity and Private Information Protection

One of the biggest aspects of AUP’s is cybersecurity. It is imperative to clarify the at-risk behaviors that employees should avoid when using your network. Data breaches cost your business time and money. Common security policies include:

• Keep all passwords private, and change them frequently
• Do not use public Wi-Fi on company devices
• Never open email attachments or links that you are not expecting. When something appears suspicious, contact the IT department
• Sign up for two-factor authentication
• Social media is only allowed for business purposes

Confidential information needs to be sent to one another securely. Your AUP should outline how team members can safely send, view, and store company data. Your AUP should also detail how team members should handle any data breaches that may occur.  How they should report an incident, who to report it to, and any other important protocols.

Employee AI use and internal controls

If employees use AI tools at work, the policy should name approved tools, bar sensitive data inputs, assign review of AI output, and require human approval before use in high-stakes work. Those rules give the business control over confidentiality, accuracy, and compliance, and they fit cleanly within a broader AI governance policy.

Guest Users

Most businesses have a separate guest network that is just for guests to use. This network should have less access, ensuring guests can not access internal files or internal information. You should also have guest users sign an AUP before use. 

Who determines the content of an AUP?

Content of AUPs is assembled through the collaboration of owners, creators, administrators, human resource executives, and lawyers. You may also want to consider getting feedback from both managers and employees at every level. They can assist with items that may have been forgotten or even have better ideas for the AUP. There could also be cases where something in the proposed AUP prevents a team member from doing their job. Transparency and collaboration throughout your business are key. Before introducing your AUP to employees, you’ll want to review it with human resources and your lawyer to prevent breaking employment or state/federal laws.

If you are an organization in need of an AUP, contact Traverse Legal today so that one of our skilled Attorneys can assist you in drafting an AUP that fits your particular needs.

*Article updated May 2026