Free Terms & Privacy generator
Acceptable Use Policy
The rules of the road for your platform, setting out what users may not do and what happens when they cross the line.
What is an Acceptable Use Policy?
An Acceptable Use Policy sets the rules of the road for your platform. It tells users what they may not do and what happens when they cross the line.
Any platform, app, or service where users can act, upload, message, or transact, and especially one with accounts, hosting, APIs, or user content.
Acceptable Use Policy template, current for 2026
Adds the current abuse vectors: AI/scraping for model training, automated account creation, prompt-injection and jailbreak attempts against AI features, crypto/deepfake fraud, and API rate-limit circumvention. It pairs with the Terms of Service and gives you a documented basis to suspend bad actors.
How HDAi does this differently
Unlike a static form, HDAi runs a guided interview and assembles your Acceptable Use Policy as you answer. When you want it finished, a licensed Hart David Carson attorney reviews it and tailors it to your facts before you sign. The interview and the first draft are automated. The judgment belongs to an attorney.
What you’ll be asked
A short interview in plain language that asks only what this document needs.
- Which company or entity publishes and enforces this Acceptable Use Policy? This is the operator of the platform/service whose rules these are. Its legal name and details populate the document throughout.
- What short name should we use for the operator throughout this policy (the defined "we/us")? A concise reference name for the operator, used dozens of times in the document (for example, the first word of the company name or a brand short-form). If your legal name is Acme Technologies, Inc., a good short name is Acme.
- What is the name of the platform, product, website, or service this policy governs? The commercial name users know. Used to refer to the covered offering throughout the policy.
- What website domain(s) or app store listings does this policy cover? Defines the scope of what the policy applies to so users know exactly which properties are covered.
- In one or two sentences, describe what the Service does. A short functional description anchors the policy's context and helps interpret ambiguous conduct rules.
- What is the effective date of this policy? The date the policy takes effect. Shown in the header and used for versioning.
- Which US state's law governs this policy? Sets the governing law and interpretation framework. Usually matches your Terms of Service and where the company is organized or headquartered.
- What county/city and state should be the exclusive venue for disputes? The forum where any court or arbitration proceedings must be brought, if this policy carries its own venue clause.
- Is this policy incorporated into a broader Terms of Service / User Agreement? Most AUPs are an annex to the main Terms. If yes, we reference that agreement and defer dispute mechanics to it. If no (standalone), we add a full dispute-resolution section here.
- What is the exact name of that governing agreement? So the cross-references name the right document. Only asked if this AUP is incorporated into a broader agreement.
- For this standalone policy, how should disputes be resolved? Only asked for a standalone policy (when it is not incorporated into your Terms). Arbitration adds a binding-arbitration clause with a class-action waiver, a jury-trial waiver, and a one-year limitation on claims. Courts keeps disputes in court with an exclusive-venue, jury-trial-waiver, and limitation-of-actions clause.
- Which arbitration provider should administer arbitrations? The administering body whose rules govern the arbitration. Only asked if you selected binding arbitration. Leave blank to default to the American Arbitration Association.
- Who is bound by this policy? Defines who counts as a 'User' so the obligations reach everyone who touches the Service.
- Can users post, upload, transmit, or share content on the Service? Determines whether we include content standards, prohibited-content rules, and DMCA notice-and-takedown mechanics.
- Which categories of content should be expressly prohibited? These become the enumerated content prohibitions. Only asked if the Service hosts user content.
- Which technical / conduct abuses should be expressly prohibited? The 'don't attack or misuse the system' section. Pick everything relevant to your architecture.
- Does the Service include AI, machine-learning, or automated-generation features? If yes, we add AI-specific misuse rules (no training competing models, no deceptive synthetic media, no prompt-injection/jailbreak attempts, no automated decisions on protected classes).
- Which AI-specific restrictions apply? Tailors the AI-use rules. Only asked if the Service has AI features.
- Does the Service offer an API, SDK, or developer integrations? If yes, we include developer/API-specific rules: rate limits, credential security, no caching beyond limits, no sublicensing.
- What is your stance on commercial or resale use by users? Controls whether users can monetize or resell access to your Service.
- Should the policy include export-control and sanctions compliance obligations? US export laws and OFAC sanctions apply to most software/online services. Recommended if you have any international users.
- Do users collect or process biometric data (face, fingerprint, voiceprint) through the Service? If yes, we add a state biometric-privacy overlay requiring written notice, consent, a retention/destruction schedule, and a no-profit rule, keyed to statutes such as the Illinois Biometric Information Privacy Act (BIPA).
- Which state's biometric-privacy law should the overlay name? The overlay references a named state biometric statute (for example, Illinois for BIPA, Texas, or Washington). Only asked if you include the biometric overlay. Leave blank to default to Illinois.
- Do you serve users or process personal data in the EU, EEA, or UK? If yes, we add an international overlay covering GDPR/UK GDPR lawful basis, the EU Digital Services Act statement-of-reasons and appeal mechanisms, and an EU representative reference in the notices block.
- Who is your appointed EU/UK representative for data-protection and Digital Services Act purposes? Named in the notices block so EU/UK users can reach your representative. Only asked if you include the EU/UK overlay; leave blank if none has been appointed yet.
- What enforcement actions do you want the right to take for violations? The graduated consequences you may impose. We reserve these while making clear enforcement is at your discretion.
- Do you want to reserve the right to act immediately (without prior notice) for severe violations? Severe abuse (CSAM, active attacks, legal risk) usually warrants immediate action. Most platforms reserve this.
- Do you want to include a mechanism for users to report violations? A reporting channel supports trust-and-safety obligations and DMCA/notice-and-takedown compliance.
- What email address should users use to report abuse or violations? The channel where abuse reports and trademark complaints are received. Only asked if you include a reporting mechanism.
- Who is your designated DMCA / copyright agent (name or title)? Required to invoke the DMCA safe harbor for copyright takedowns and counter-notifications. Only relevant if you host user content that could infringe.
- What email address receives DMCA / copyright notices? The address in your DMCA notice-and-takedown and counter-notification procedure. Only asked if you host user content.
- What is the minimum age to use the Service? Sets the age eligibility floor (COPPA makes under-13 special; many services set 13, 16, or 18). Used in the eligibility rules.
- At what URL will this policy be published? The canonical location users are directed to for the current version. Used in the amendment/notice section.
- What is the general legal/notices contact email? Where formal notices under this policy are sent. Populates the notices and contact sections.
- What is the company's mailing address for legal notices? The physical address for formal written notice. Populates the notices block.
- Do you want a signature/acknowledgment block at the end (for enterprise or click-through acceptance)? Enterprise deals often require a signed acknowledgment; consumer services rely on acceptance-by-use. Controls the closing block.
Frequently asked
About the Acceptable Use Policy and how HDAi works.
What is an Acceptable Use Policy? +
An Acceptable Use Policy sets the rules of the road for your platform. It tells users what they may not do and what happens when they cross the line. It suits any platform, app, or service where users can act, upload, message, or transact, and especially one with accounts, hosting, APIs, or user content.
Is HDAi's Acceptable Use Policy legally binding? +
A published policy takes effect when you post it and, where your terms require it, when users accept it. How far it binds depends on the way it is presented (an affirmative click beats a footer link) and on the laws of the places your users live. Have a licensed Hart David Carson attorney confirm the presentation and the jurisdictions before you publish.
Do I need a lawyer to use this Acceptable Use Policy? +
You can generate and download the Acceptable Use Policy in minutes, and it costs nothing. Before you publish it, a licensed Hart David Carson attorney can review it against your service and the places your users live, which no template does on its own.
What makes this Acceptable Use Policy current for 2026? +
Adds the current abuse vectors: AI/scraping for model training, automated account creation, prompt-injection and jailbreak attempts against AI features, crypto/deepfake fraud, and API rate-limit circumvention. It pairs with the Terms of Service and gives you a documented basis to suspend bad actors.
How long does the Acceptable Use Policy take? +
Estimated time about 18 min (36 questions), depending on how much you already know. The document assembles as you answer. Export it as PDF or Word, or send it to a Hart David Carson attorney for review.
Does this Acceptable Use Policy work in my state? +
HDAi's interview is state-aware. If you ask an attorney to finish the draft, a licensed Hart David Carson attorney confirms it against your state's requirements before you rely on it. Validity and required formalities vary by state.
Terms & Privacy
Related generators
Cookie Policy & Consent Notice · End-User License Agreement (EULA) · Privacy Policy (Multi-State + GDPR-Lite) · Email & Marketing Consent (CAN-SPAM + Opt-In) · All 124 →