Acceptable usage policy template

An acceptable usage policy (AUP) sets out the rules that govern how users can interact with a platform, network, or service. It's how businesses make their expectations explicit: what behavior is permitted, what isn't, and what happens when someone crosses a line.

Done well, an AUP does more than protect the platform. It creates clarity for users and gives the legal team a defensible basis for enforcement. Done poorly (or not at all), it creates ambiguity that's costly to resolve after the fact.

This page covers what an AUP should include, the common mistakes teams make when drafting one, and how to keep AUPs current as your platform evolves.

What is an Acceptable Usage Policy (AUP)?

An acceptable usage policy is a formal agreement between a service provider and its users that defines the boundaries of permitted use.

Users typically must accept the AUP before accessing the platform, which makes their acknowledgment of the rules a condition of access.

AUPs are most common in SaaS products, internal IT environments, online communities, and any platform where user-generated behavior can affect the experience or safety of others.

They're distinct from terms of service (which govern the commercial relationship) and privacy policies (which govern data handling), though all three often sit together in a platform's legal documentation.

The practical purpose of an AUP is twofold. First, it tells users what they can and can't do in plain terms. Second, it gives the platform a documented basis to suspend, restrict, or terminate access when those rules are violated. Without it, enforcement becomes much harder to justify.

What should an acceptable usage policy include?

The specific contents of an AUP will depend on the nature of the platform and its user base, but most effective AUPs address the following areas.

Purpose and scope. A short statement of what the policy covers, who it applies to, and why it exists. This framing matters: it orients the reader and signals that the policy is written for their benefit, not just the platform's protection.

Permitted uses. What users are allowed to do. This is often overlooked in AUPs that lead with prohibitions, but it's useful to define the intended use case, particularly where the platform has multiple potential applications.

Prohibited activities. This is the core of most AUPs. Typically covers things like unauthorized access to systems, uploading malware or harmful content, harassment or abusive conduct, misuse of third-party intellectual property, and any activity that violates applicable law. The list should be specific enough to be meaningful, but not so exhaustive that it reads as a long-form trap for users.

Enforcement and consequences. What happens when someone violates the policy. This should set out the range of responses available to the platform — warnings, temporary suspension, permanent termination — and note whether violations can give rise to legal action. Vague language here undermines the policy's deterrent effect.

Reporting mechanisms. How users can flag violations by others. Platforms with user communities benefit from clear, accessible reporting pathways, and including them in the AUP signals that enforcement is a shared responsibility.

Revision process. How the AUP will be updated, and how users will be notified of changes. This is important from a user trust perspective and has practical implications: if you update the policy materially, you may need to obtain fresh acceptance from existing users depending on your platform structure and applicable laws. Seek qualified legal advice on the right approach for your situation.

AUP vs terms of service: what's the difference?

These two documents are often confused, and sometimes bundled into a single document, but they serve different functions.

Terms of service govern the contractual relationship between a platform and its users: payment, liability, intellectual property ownership, dispute resolution, and so on. An AUP is narrower in scope. It focuses specifically on behavioral conduct and what users can do while they're on the platform. Terms of service tell users what they're buying; an AUP tells them how to behave while using it.

For consumer-facing platforms, the AUP is often incorporated by reference into the broader terms of service. For enterprise SaaS or internal IT environments, it's more common to see the AUP as a standalone document, particularly where organizations need to distribute it to employees or contractors separately from a commercial agreement.

If you're drafting documentation for a SaaS product, it's also worth reading up on service level agreements, end-user license agreements, and user agreements to understand how each fits into your overall documentation structure.

Common mistakes when drafting an AUP

1. Being too vague on prohibited conduct

‍Policies that ban "inappropriate behavior" without defining it are difficult to enforce and easy to challenge. The more specific the policy is about what constitutes a violation, the clearer the grounds for action.

2. Failing to define enforcement discretion

‍Platforms often retain the right to take action at their discretion. That's reasonable, but the policy should make clear that enforcement is not automatic and that the platform can respond proportionately. Policies that imply zero tolerance for minor infractions tend to either go unenforced or generate disputes.

3. Ignoring the update and notification question

‍Platforms change. A policy drafted at launch rarely reflects the platform two years later. Teams often neglect to revise the AUP as features or use cases evolve, or fail to think through how they'll obtain renewed acceptance when they do. Build a review cadence into your processes from the start.

4. Writing it only for lawyers

‍An AUP that users don't read or understand doesn't protect anyone. Plain language, logical structure, and appropriate length all affect whether users engage with the document or skip past it. For more on making legal documents readable, Juro's guide to writing a readable privacy policy covers principles that apply just as well to AUPs.

5. Treating it as a set-and-forget document

‍Regulatory requirements around user content, data handling, and online conduct continue to evolve. AUPs should be reviewed at least annually and updated whenever the platform adds significant new features or enters new markets. Consult qualified legal counsel to ensure your AUP reflects your current obligations.

Who drafts an AUP?

For most SaaS or platform businesses, the legal team owns the AUP. But it's rarely drafted in isolation. Product, security, and community or trust and safety teams all have relevant context: they know what users actually do on the platform, where the edge cases are, and what enforcement looks like in practice.

The most effective AUPs are drafted collaboratively. Legal brings the structure and risk framing; product and security teams bring the operational detail. The result is a document that's both legally sound and grounded in how the platform actually works.

For internal AUPs governing employee use of company systems, IT and HR typically have significant input alongside legal, since violations often need to be handled through an HR or disciplinary process.

Managing AUPs at scale with Juro

For businesses running a single platform with one version of an AUP, management is relatively straightforward. But as product complexity grows (multiple user tiers, enterprise customers with custom terms, or platforms operating across jurisdictions), AUPs can become harder to manage consistently.

The version control problem is particularly common. Teams end up with multiple iterations of an AUP stored across shared drives and email threads, no clear record of which users accepted which version, and no simple way to distribute updates at scale.

Juro's contract management platform gives legal teams a single place to maintain their template library, including policy documents like AUPs.

Templates can be locked to prevent unauthorized edits, updated centrally, and distributed programmatically through existing workflows. Rather than chasing acknowledgements over email, teams can send policy updates for digital acceptance and track completion from a central dashboard.

If you're managing a high volume of user-facing policies or internal IT agreements, see how Juro can help, or read more about contract management policy best practices.

Related templates

• User agreement template
• End-User License Agreement (EULA) template
• Software License Agreement template
• Service Level Agreement template
• Cloud Services Agreement template