Why do I need an acceptable use policy?

Depending on the actual language included in your employer’s Acceptable Use Policy, using company equipment for personal use outside of working hours may be a violation of terms. As well, the consequences should be outlined in the AUP. Here, the wording of the clause itself matters and should be reviewed by an attorney. I’m happy to take a look if you like. Hope this helps!

This is a very common concern, especially as more employers implement digital oversight tools. Generally speaking, a company can legally monitor and restrict employee internet usage through an Acceptable Use Policy (AUP), provided certain conditions are met. 1. Private Employers Have Broad Discretion In most states, private-sector employers are allowed to monitor internet usage on company-owned systems and networks, including: Websites visited Emails sent and received via company email Time spent online during working hours Downloads or uploads of content As long as the company owns the devices or network being used, courts typically uphold their right to control and monitor usage—especially when the employee has received advance notice through a written policy like an AUP. 2. Employees Have Limited Expectation of Privacy at Work Courts have generally held that employees do not have a strong expectation of privacy when using employer-provided devices or networks. However, an employer should: Clearly inform employees of monitoring in writing Apply the policy consistently across the workforce Avoid overreaching into private communications (e.g., personal email on personal devices) 3. Content Filtering and Restrictions Are Permitted Employers can legally block or restrict access to websites that: Are unrelated to work (e.g., social media, video streaming, shopping) Pose security risks (e.g., downloading pirated software) Violate workplace policies (e.g., inappropriate or offensive material) 4. Federal and State Considerations While there are few federal laws restricting workplace internet monitoring, employers must still comply with laws such as: The Electronic Communications Privacy Act (ECPA) – allows monitoring of communications when done in the ordinary course of business or with employee consent State privacy laws – some states may have broader protections; however, most defer to employer rights on company property What You Can Do: Review the AUP carefully to understand what is being monitored and why Confirm whether you acknowledged the policy in writing If you are concerned about overreach, you may want to speak with HR or request clarification about what personal activity (if any) may be affected If you would like assistance reviewing the policy for reasonableness or compliance with state and federal law, I’d be happy to help.

Hi, Your employee handbook may have the answer to this and is worth a review with a qualified attorney. Attorneys skilled in intellectual property may be able to give you more insight as well.

Generally, the answer to your question is "yes, a company can restrict employee's personal use of a company-owed device" as the company's have the right to restrict access, use of their own property and further, they have a right to protect proprietary property that may be affected by the personal use of a device which the company owns. Another question that your question raises, is, does a company actually achieve the restriction of its company-owned device in its Acceptable Use Policy. The policy itself needs to be examined by an attorney highly familiar with contract drafting, revision, etc.

You're smart to be thinking about legal liability when you're building a platform that hosts user-generated content. The good news is that U.S. law gives you some strong protections, as long as you set things up correctly. If you take the right steps early, you can limit your legal exposure while still giving users the freedom to share and interact. Your Best Legal Defense: Section 230 The main legal protection you'll be relying on is Section 230 of the Communications Decency Act. It basically says you're not legally responsible for what your users post. If someone uploads something defamatory or inappropriate, the law treats them as the publisher, not you. This covers a wide range of potential issues under state law like defamation, privacy violations, harassment, and even some negligence claims. You also have full control over how you moderate. Whether you decide to remove content or leave it up, that's your call. The law protects both your choice to moderate and your choice not to. What Section 230 Doesn't Cover Now, Section 230 is powerful, but it's not bulletproof. There are a few key areas where it doesn’t apply: Federal criminal law: If your platform knowingly facilitates criminal activity, you could be held liable. Courts generally require proof that you knew and intended to assist the illegal behavior, but it’s still something to watch out for. Intellectual property: Section 230 doesn’t shield you from copyright or trademark claims. This is where DMCA compliance becomes critical. Your own content: If you're directly involved in creating illegal or harmful content, you can’t hide behind Section 230. Stick to providing the platform, and stay out of shaping or producing the actual user content. How to Protect Yourself From Copyright Claims (DMCA) Copyright infringement is one of the biggest risks platforms like yours face. Fortunately, the DMCA gives you a way to protect yourself if you follow the right steps: Register a designated agent with the U.S. Copyright Office. This person (or company) receives official takedown notices. Registration costs $6 and has to be renewed every three years. You’ll also need to post the agent’s contact info clearly on your site. Set up a takedown system. If a copyright owner sends a valid notice, you’re required to remove the allegedly infringing content promptly. Create a repeat infringer policy. You don’t have to go hunting for violations, but if someone keeps uploading infringing content and it's brought to your attention, you need a policy in place and you need to enforce it. A Legal Landscape That’s Evolving in Your Favor In recent years, the courts have leaned even more in favor of platform operators. In 2024, the Supreme Court made it clear that content moderation decisions are protected by the First Amendment. That means you have the right to decide what stays up or gets removed, just like a newspaper editor can decide what gets published. At the same time, there's a new federal law to be aware of. The TAKE IT DOWN Act, passed in May 2025, requires platforms to give users a way to report non-consensual intimate images. Once you get a valid report, you have 48 hours to take it down. A few states like Texas and Florida have tried to pass laws limiting how platforms can moderate content. So far, the courts have mostly ruled those laws unconstitutional. The Supreme Court has suggested that forcing platforms to stay neutral on all content likely violates free speech protections. The Legal Foundation You Need First, make sure you’ve set up your company as a legal entity, like a Texas LLC or corporation. That gives you basic protection for your personal assets. Next, your Terms of Service should clearly state that users are responsible for what they post. Include clauses that ban illegal behavior and copyright violations, and make sure you have indemnification language that puts the legal burden back on users if their content causes issues. You'll also want Community Guidelines that spell out what kind of content is allowed or prohibited. Even though you're not required to moderate, having clear rules helps with consistency, sets expectations, and can make moderation easier if it becomes necessary. And whatever moderation systems you use, whether manual or automated, be sure to document decisions and user reports. This helps show that you’re acting in good faith if a dispute ever comes up. What This Means for You If you get these systems in place early, you’ll be in good shape. Big platforms rely on the same legal framework to operate safely at scale. It’s been tested in court over the last 25 years, and it works if you stick to the rules. Your day-to-day legal responsibilities will mostly involve handling DMCA takedown requests, removing clearly illegal content once you’re aware of it, and keeping your copyright agent registration up to date. It becomes routine once your platform is up and running. The bottom line is this. The legal framework was designed to protect innovation while still giving people ways to address serious harms. If you follow it properly, you can focus on growing your platform instead of worrying about getting sued for something a user posted. Most legal problems happen when a platform skips the setup or tries to cut corners. Investing a bit of time and legal advice upfront will pay off by keeping you protected in the long run.