Acceptable Use Policy: build a starting draft free, or have me draft the one you can actually enforce

People treat Section 230 as a single shield. It is two provisions with different subjects. 47 U.S.C. 230(c)(1) says that “no provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider,” which is about leaving content up. 47 U.S.C. 230(c)(2)(A) says no provider or user “shall be held liable on account of… any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected,” which is about taking content down. Neither one is about your subscription agreement.

Verified against 47 U.S.C. 230 at uscode.house.gov and law.cornell.edu on 2 August 2026.

Generated policies copy the notice-and-cure structure out of commercial contracts, where it belongs, and apply it to abuse, where it does not. If your policy says you will give thirty days’ written notice and an opportunity to cure before terminating, then for thirty days the spam keeps sending, the fraudulent listings keep converting, the scraper keeps running, and your infrastructure and your reputation keep paying. That is not a hypothetical risk, it is a multiplication: cure days times your cost per day, times the number of accounts like it per year, which is exactly what the calculator above computes.

The temptation with a generated policy is to accept a long, impressive prohibited-conduct list that nobody at the company has ever checked against. That creates two problems at once. The regulatory one: 15 U.S.C. 45(a)(1) declares unlawful “unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce,” and a published policy is a representation to your users about how your service operates. The contractual one is nearer term and more likely: a terminated customer whose lawyer finds three accounts doing the same thing that you left running has the beginning of a selective-enforcement argument, which is not a winning claim in itself but is enough to turn a clean termination into a negotiation.

Verified against 15 U.S.C. 45(a)(1) at uscode.house.gov on 2 August 2026. Quoted here as the operative statutory sentence; whether any particular enforcement practice is unfair or deceptive is a fact question I am not answering on a public page.

Two carve-outs in the statute change what your policy has to do. 47 U.S.C. 230(e)(2) provides that “nothing in this section shall be construed to limit or expand any law pertaining to intellectual property,” which is why a copyright complaint runs on its own track and why a DMCA notice-and-takedown process is a separate mechanism from an acceptable use policy rather than a paragraph inside one. And 230(e)(5), added by FOSTA in April 2018, removes the protection, other than the good-faith filtering protection in 230(c)(2)(A), for civil claims under 18 U.S.C. 1595 predicated on section 1591 conduct and for state criminal charges predicated on sections 1591 or 2421A.

Verified against 47 U.S.C. 230(e)(2) and 230(e)(5) at uscode.house.gov on 2 August 2026. Subsection (e)(5) added by Pub. L. 115-164, sec. 4(a), April 11, 2018.

An acceptable use policy on its own does almost nothing. It is a list of conduct. The power to suspend an account, terminate a subscription, withhold a refund, and disclaim liability for doing so lives in the agreement the customer actually signed or clicked. Three things have to be true for the policy to work: the agreement has to incorporate the policy by reference, the agreement has to give you the right to modify the policy and say how notice of changes is given, and the termination and refund clauses in the agreement have to match the enforcement ladder in the policy. When those documents are written months apart, by different people or different models, that last one is the one that fails.