Editing Acceptable use policy

{{Short description|Set of rules of a computer network website}}
{{redirect|Fair use policy|the concept in copyright law|Fair use|the Wikipedia's fair use policy|Wikipedia:Non-free content}}
{{multiple issues|
{{more citations needed|date=August 2012}}
{{Original research|date=February 2009}}
{{Globalize|article|United Kingdom|United States|date=October 2013}}
}}


An '''acceptable use policy''' ('''AUP''')—also referred to as an acceptable usage policy or, in certain commercial contexts, a '''fair use policy (FUP)'''—is a formal set of guidelines established by the administrator, proprietor, or operator of a [[computer network]], [[website]], [[Computing platform|digital platform]], or [[information system]].<ref>{{Cite web |title=Acceptable Internet Use Policy {{!}} Virginia Department of Education |url=https://www.doe.virginia.gov/programs-services/school-operations-support-services/safety-crisis-management/internet-safety/acceptable-internet-use-policy |archive-url=http://web.archive.org/web/20250306185710/https://www.doe.virginia.gov/programs-services/school-operations-support-services/safety-crisis-management/internet-safety/acceptable-internet-use-policy |archive-date=2025-03-06 |access-date=2025-04-30 |website=www.doe.virginia.gov |language=en}}</ref> The policy delineates the conditions under which access is granted and specifies the behaviors that are permitted, restricted, or prohibited. AUPs function as [[Regulation|regulatory instruments]] intended to ensure the responsible use of [[information and communications technology]], to mitigate [[Legal liability|institutional liability]], and to safeguard the [[rights]] and [[Computer security|security]] of both users and [[System administrator|system owners]].<ref>{{Cite web |title=What Is an Acceptable Use Policy (AUP)? |url=https://www.business.com/articles/acceptable-use-policy/ |access-date=2025-04-30 |website=business.com |language=en}}</ref>

The term “fair use policy,” though occasionally employed in industry settings (e.g., by [[Internet service provider|internet service providers]] to define usage thresholds), is conceptually distinct from [[fair use]] as defined in [[copyright law]].<ref>{{Cite web |last=Rollins |first=Alison |title=Learning Resource Center: Copyright & Fair Use: Copyright & Fair Use |url=https://usuhs.libguides.com/copyright |access-date=2025-04-30 |website=usuhs.libguides.com |language=en}}</ref> The latter constitutes a statutory doctrine governing the lawful reproduction and transformation of protected works; the former reflects privately enforced contractual norms.<ref>{{Cite web |title=17 U.S. Code § 107 - Limitations on exclusive rights: Fair use |url=https://www.law.cornell.edu/uscode/text/17/107 |access-date=2025-04-30 |website=LII / Legal Information Institute |language=en}}</ref>

AUPs commonly address issues such as [[unauthorized access]], distribution of illicit or harmful content, [[copyright infringement]], violations of [[information privacy]], and misuse of [[communications infrastructure]].<ref>{{Cite web |title=Policy and Security |url=https://www.educause.edu/focus-areas-and-initiatives/policy-and-security |access-date=2025-04-30 |website=EDUCAUSE |language=en}}</ref> They may also outline the procedural and disciplinary consequences of policy violations. In transnational environments, AUPs are increasingly shaped by regional legal frameworks, including [[General Data Protection Regulation|data protection regulations]] (e.g., the [[General Data Protection Regulation]] in the [[European Union]])<ref>{{Cite web |date=2018-11-07 |title=What is GDPR, the EU’s new data protection law? |url=https://gdpr.eu/what-is-gdpr/ |access-date=2025-04-30 |website=GDPR.eu |language=en-US}}</ref> and national [[cybersecurity standards]] (e.g., [[National Institute of Standards and Technology|NIST]] guidelines in the [[United States]]).<ref>{{Cite web |title=Publications {{!}} CSRC |url=https://csrc.nist.gov/publications |access-date=2025-04-30 |website=csrc.nist.gov}}</ref>

==Terminology==
An [[Acceptable use policy|acceptable use agreement]]—also referred to in institutional contexts as an [[Access control|access agreement]], [[Terms of service|user agreement]], or [[Terms of service|terms of use]]—is a policy instrument that codifies the rights, obligations, and restrictions of individuals accessing a designated [[information system]], [[computer network]], or [[Digital data|digital resource]].<ref>{{Cite web |title=Wayback Machine |url=https://home.army.mil/imcom/application/files/1515/6840/1867/Account_-_ACCEPTABLE_USE_POLICY_AGREEMENT.pdf |archive-url=http://web.archive.org/web/20250111090105/https://home.army.mil/imcom/application/files/1515/6840/1867/Account_-_ACCEPTABLE_USE_POLICY_AGREEMENT.pdf |archive-date=2025-01-11 |access-date=2025-04-30 |website=home.army.mil}}</ref> These agreements function as governance mechanisms, often embedded within broader contractual or institutional frameworks that regulate digital conduct and access permissions.<ref>{{Cite web |title=Industry News 2019 Five Steps for Effective Auditing of IT Risk Management |url=https://www.isaca.org/resources/news-and-trends/industry-news/2019/five-steps-for-effective-auditing-of-it-risk-management |access-date=2025-04-30 |website=ISACA}}</ref>

While terminology may vary across sectors—such as [[education]], [[government]], [[Business|commercial enterprise]], or [[public service]]<nowiki/>environments—the core objective remains the same: to formalize user responsibilities and delineate the scope of permitted activity.<ref>{{Cite web |title=HHS Policy for Rules of Behavior for Use of Information & IT Resources {{!}} CMS Information Security & Privacy Group |url=https://security.cms.gov/policy-guidance/hhs-policy-rules-behavior-use-information-it-resources |access-date=2025-04-30 |website=security.cms.gov |language=en}}</ref> In educational institutions, for example, access agreements may appear in student handbooks or technology use policies, whereas in commercial settings, they are commonly integrated into [[End-user license agreement|end-user license agreements]](EULAs) or general [[terms of service]].<ref>{{Cite journal |last=Robinson |first=Eric P. |last2=Zhu |first2=Yicheng |date=2020-01-01 |title=Beyond “I Agree”: Users’ Understanding of Web Site Terms of Service |url=https://journals.sagepub.com/doi/10.1177/2056305119897321 |journal=Social Media + Society |language=EN |volume=6 |issue=1 |pages=2056305119897321 |doi=10.1177/2056305119897321 |issn=2056-3051|doi-access=free }}</ref>

The substance of such agreements typically addresses matters such as [[Authentication|user authentication]], limits on data storage and dissemination, restrictions on the transmission of unlawful or harmful content, and the conditions under which the institution may monitor, restrict, or terminate access. Many agreements also incorporate references to external legal regimes—such as [[copyright law]], [[Data security|data protection]], and [[cybersecurity]] regulations—that inform both the behavioral norms and potential penalties for violation.<ref>{{Cite report |url=https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final |title=Security and Privacy Controls for Information Systems and Organizations |last=Force |first=Joint Task |date=2020-12-10 |publisher=National Institute of Standards and Technology |issue=NIST Special Publication (SP) 800-53 Rev. 5 |language=en}}</ref>

To ensure [[enforceability]] and [[informed consent]], acceptable use agreements frequently require explicit user acknowledgment, whether through signed consent forms, [[clickwrap]] acceptance during login, or periodic reaffirmation procedures.<ref>{{Cite journal |last=Solove |first=Daniel |last2=Hartzog |first2=Woodrow |date=2014-01-01 |title=The FTC and the New Common Law of Privacy |url=https://scholarship.law.bu.edu/faculty_scholarship/3042/ |journal=Columbia Law Review |volume=114 |pages=583 |doi=10.2139/ssrn.2312913}}</ref> Critics of current practice have noted, however, that these agreements are often written in legally dense or [[Opacity (philosophy)|opaque]] language, raising concerns about the transparency and actual informedness of user consent.<ref>{{Cite news |last=Stevenson |first=Seth |date=2014-11-17 |title=By Clicking on This Article, You Agree to … |url=https://slate.com/technology/2014/11/end-user-license-agreements-does-it-matter-that-we-dont-read-the-fine-print-we-encounter-on-the-web.html |access-date=2025-04-30 |work=Slate |language=en-US |issn=1091-2339}}</ref>

==Common elements of AUP statements==
[[Acceptable use policy|Acceptable use policies]] (AUPs) typically include a core set of provisions that address [[Compliance (law)|legal compliance]], [[Responsibility|user responsibility]], and institutional safeguards. According to guidance from the [[Virginia Department of Education]], an effective AUP should align with applicable [[Telecommunication|telecommunications]] laws and reflect broader regulatory expectations.<ref>{{Cite web |title=Acceptable Internet Use Policy {{!}} Virginia Department of Education |url=https://www.doe.virginia.gov/programs-services/school-operations-support-services/safety-crisis-management/internet-safety/acceptable-internet-use-policy |archive-url=http://web.archive.org/web/20250202003427/https://www.doe.virginia.gov/programs-services/school-operations-support-services/safety-crisis-management/internet-safety/acceptable-internet-use-policy |archive-date=2025-02-02 |access-date=2025-04-30 |website=www.doe.virginia.gov |language=en}}</ref> This includes reference to national legislation such as the [[Children's Internet Protection Act|Children’s Internet Protection Act]] (CIPA) in the [[United States]], which mandates certain [[internet safety]] measures in [[School|schools]] and [[Library|libraries]] receiving federal funding.<ref>{{Cite web |title=47 U.S. Code § 254 - Universal service |url=https://www.law.cornell.edu/uscode/text/47/254 |access-date=2025-04-30 |website=LII / Legal Information Institute |language=en}}</ref>

AUPs also commonly include statements aimed at protecting [[Information privacy|user privacy]] and personal safety in digital environments. These provisions encourage secure and ethical behavior, discourage the disclosure of [[Personal data|personally identifiable information]], and often reference privacy-focused legislation, such as the [[Family Educational Rights and Privacy Act]] (FERPA) in the educational context.<ref>{{Cite web |title=FERPA {{!}} Protecting Student Privacy |url=https://studentprivacy.ed.gov/ferpa |access-date=2025-04-30 |website=studentprivacy.ed.gov}}</ref> More generally, these clauses are designed to prevent misuse of institutional systems that could expose individuals to harm or [[Data breach|data compromise]].

Another essential element is the emphasis on respecting [[copyright]] and [[intellectual property]] laws. AUPs typically prohibit unauthorized reproduction or distribution of protected materials and may include brief explanations of [[fair use]] principles, especially in contexts where users engage with instructional or research-based digital content.<ref>{{Cite report |url=https://eric.ed.gov/?id=ED244642 |title=Reproduction of Copyrighted Works by Educators and Librarians. Circular R21 |date=1978 |publisher=Superintendent of Documents, U |language=en}}</ref>

Many policies extend beyond these foundational areas to enumerate specific forms of [[Misconduct|prohibited conduct]]. These can include [[unauthorized access]] to restricted systems, installation of unapproved software, intentional distribution of [[Malware|malicious code]], or the use of institutional platforms for [[harassment]] or [[Discrimination|discriminatory behavior]].<ref>{{Cite web |title=Information Security Policy Templates {{!}} SANS Institute |url=https://www.sans.org/information-security-policy/ |access-date=2025-04-30 |website=www.sans.org}}</ref> AUPs often outline institutional rights to [[Computer and network surveillance|monitoring]] digital activity and enforce penalties for violations, which may range from temporary account suspension to formal [[Discipline (academia)|disciplinary]] or [[Lawsuit|legal action]].<ref>{{Cite web |title=Technology Acceptable use {{!}} Harvard John A. Paulson School of Engineering and Applied Sciences |url=https://seas.harvard.edu/office-human-resources/policies/technology-acceptable-use |access-date=2025-04-30 |website=seas.harvard.edu}}</ref> In some cases, policies also reserve the right to revise their terms unilaterally, allowing administrators to update acceptable use conditions without individualized notice to users.<ref>{{Cite news |last=Satariano |first=Adam |last2=McCabe |first2=David |date=2024-03-04 |title=Forced to Change: Tech Giants Bow to Global Onslaught of Rules |url=https://www.nytimes.com/2024/03/04/technology/europe-apple-meta-google-microsoft.html |access-date=2025-04-30 |work=The New York Times |language=en-US |issn=0362-4331}}</ref>

== See also ==
* [[Fair use]] – the U.S. copyright doctrine distinct from contractual “fair use policies”
* [[Terms of service]] – agreements often incorporating acceptable use language
* [[End-user license agreement]] – commercial licensing frameworks relevant to AUPs
* [[Children's Internet Protection Act]] – U.S. law that shapes school-based AUPs
* [[Family Educational Rights and Privacy Act]] (FERPA) – federal privacy law often cited in educational AUPs
* [[Computer and network surveillance]] – institutional enforcement mechanisms tied to AUPs
* [[Information privacy]] – a key concern addressed in most AUPs
* [[Cyberethics]] – ethical considerations related to digital behavior and policy
* [[Digital rights]] – user freedoms and constraints in digital environments

==References==
{{Reflist}}



<!-- Policies apply to applications (email, web, ...) 
     users do not sign up to use the communications network (internet)!
     and it's management, not users, that this article is for 
     See article 'User account policy'                                    -->

{{DEFAULTSORT:Acceptable Use Policy}}
[[Category:Information technology management]]
[[Category:Terms of service]]