Can an Acceptable Use Policy be used to restrict employees' personal use of company-owned devices?

A well written AUP will provide your employees, staff, and users with clear guidelines regarding what they can use company resources for and what is inappropriate. There may be conduct that blatantly crosses the line, such as using the company logistics software to break the law, but an AUP will also address those circumstances that are less clear, such as using internal messaging to ask a co-worker out on a date or to pass along inappropriate comments. It should also address potential security and data privacy breaches that may result from using poor oversight of company databases, introducing insecure devices to the network, or visiting potentially compromised websites and responding to phishing emails.

Depending on the actual language included in your employer’s Acceptable Use Policy, using company equipment for personal use outside of working hours may be a violation of terms. As well, the consequences should be outlined in the AUP. Here, the wording of the clause itself matters and should be reviewed by an attorney. I’m happy to take a look if you like. Hope this helps!

This is a very common concern, especially as more employers implement digital oversight tools. Generally speaking, a company can legally monitor and restrict employee internet usage through an Acceptable Use Policy (AUP), provided certain conditions are met. 1. Private Employers Have Broad Discretion In most states, private-sector employers are allowed to monitor internet usage on company-owned systems and networks, including: Websites visited Emails sent and received via company email Time spent online during working hours Downloads or uploads of content As long as the company owns the devices or network being used, courts typically uphold their right to control and monitor usage—especially when the employee has received advance notice through a written policy like an AUP. 2. Employees Have Limited Expectation of Privacy at Work Courts have generally held that employees do not have a strong expectation of privacy when using employer-provided devices or networks. However, an employer should: Clearly inform employees of monitoring in writing Apply the policy consistently across the workforce Avoid overreaching into private communications (e.g., personal email on personal devices) 3. Content Filtering and Restrictions Are Permitted Employers can legally block or restrict access to websites that: Are unrelated to work (e.g., social media, video streaming, shopping) Pose security risks (e.g., downloading pirated software) Violate workplace policies (e.g., inappropriate or offensive material) 4. Federal and State Considerations While there are few federal laws restricting workplace internet monitoring, employers must still comply with laws such as: The Electronic Communications Privacy Act (ECPA) – allows monitoring of communications when done in the ordinary course of business or with employee consent State privacy laws – some states may have broader protections; however, most defer to employer rights on company property What You Can Do: Review the AUP carefully to understand what is being monitored and why Confirm whether you acknowledged the policy in writing If you are concerned about overreach, you may want to speak with HR or request clarification about what personal activity (if any) may be affected If you would like assistance reviewing the policy for reasonableness or compliance with state and federal law, I’d be happy to help.

Hi, Your employee handbook may have the answer to this and is worth a review with a qualified attorney. Attorneys skilled in intellectual property may be able to give you more insight as well.

What you have described appears to act as a liquidated damages clause. Typically liquidated damage clauses are unenforceable, or not enforced by courts in Massachusetts. However, there may be other methods that can be used to pursue this vendor. For example, a demand letter is one method of putting pressure on a vendor, and such a letter can be followed up with a suit if the matters in the letter are not addressed within 30 days.