Acceptable use policy for a platform

An acceptable use policy is the part of the terms that users are most likely to read, because it is the part enforced against them. It has to say what content and conduct are prohibited, protect the service from misuse, deal with user content and the rights of others, provide the reporting and complaints routes that online safety law now expects, and set out enforcement that is proportionate and can be explained. It also has to be incorporated into the terms of service so that it binds. I draft those policies for a fixed fee of £995, delivered in five working days.

Who this is for

Platforms, marketplaces, communities, SaaS products with shared or public features, and any online service in England and Wales whose users can post, share, message or interact, who need an acceptable use policy that their terms of service incorporate and their moderation team can apply.

What matters in an acceptable use policy

Prohibited content and conduct

The policy should list the content and conduct the platform does not allow: illegal content, harassment, hate, threats, sexual content involving children, content that infringes others' rights, spam and deceptive practices, and whatever the platform's purpose makes unsuitable, drafted in plain terms that a moderator can apply and a user can understand. Under the Online Safety Act 2023 a service that hosts user content and allows interaction has duties to assess and act on illegal content, and the policy is where the platform's rules are published.

Security and misuse of the service

The policy should prohibit unauthorised access, probing and testing without permission, interference with the service, circumventing limits and controls, automated access and scraping beyond what is allowed, and malware, and should say that unauthorised access and interference are offences under sections 1 and 3 of the Computer Misuse Act 1990 that the platform will report. A separate security disclosure route for researchers avoids the policy being used against people trying to help.

User content, rights and the licence

The policy should say that users are responsible for what they post, warrant that they have the rights to post it and that it does not infringe copyright under the Copyright, Designs and Patents Act 1988 or other rights, grant the platform the licence it needs to host and display the content, and provide a route for rights holders to report infringement and for users to respond. The platform's own removal of infringing content on notice is part of how it manages its exposure.

Reporting, complaints and the online safety framework

The Online Safety Act 2023 requires in-scope services to provide users with tools to report content and to make complaints, including about the platform's own moderation decisions, and to have terms that say how the service protects users. The policy should provide the reporting route, say how reports are handled and in what timescale, provide a complaints and appeal route for users whose content is removed or whose accounts are restricted, and say that illegal content is removed and, where required, reported to the authorities.

Enforcement, proportionality and reasons

The policy should set out the enforcement steps (removal of content, warnings, restrictions, suspension, termination), say that the platform decides which applies with regard to the seriousness and repetition of the breach, that users are told the reason unless the law or safety prevents it, and that the platform may act immediately for serious breaches. Against consumers the enforcement terms must be fair under Schedule 2 to the Consumer Rights Act 2015, which favours reasons, a right to be heard and proportionate sanctions over unexplained discretion.

Investigation, cooperation and how the policy binds

The policy should allow the platform to investigate suspected breaches, to preserve and review content and account data for that purpose in accordance with its privacy notice under the UK GDPR, to cooperate with law enforcement where the law requires or permits, and to update the policy on notice. It should be incorporated into the terms of service expressly, with the terms' liability and governing law provisions applying to it, because a policy that is not part of the contract is guidance rather than a rule.

What it costs

SaaS terms of service, £995. Your standard customer-facing terms. Five working days.

Buying online forms the engagement on payment. The scope is what the saas and technology contracts page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A bespoke contract drafted for how your product is sold, delivered and supported
• Service levels you can meet, with remedies that are proportionate rather than aspirational
• A liability position that is defensible and will survive enterprise procurement
• IP and data provisions that fit together rather than contradicting each other
• A commercial note on where you will get pushback and what is worth conceding
• One round of amendments

What is not included

• Negotiating individual enterprise deals, which I quote separately
• Advice on the law of jurisdictions outside England and Wales
• Technical security certification or audit
• Regulatory advice for regulated sectors such as financial services or health

Questions I am often asked

A user is complaining that we removed their post without saying why. Do we have to give reasons?

For consumers, fairness expects reasons and an appeal route, and the online safety framework expects a complaints process. The policy provides both, with an exception where the law or safety prevents an explanation.

Does the Online Safety Act apply to our small platform?

It applies to services that host user content and allow interaction, with duties scaled to size and risk. The policy provides the reporting and complaints routes the framework expects, and the platform should assess which duties apply to it.

Can we terminate an account immediately for a serious breach?

If the policy provides for immediate action for serious breaches and says what counts as serious, yes. Record the reason; the appeal route then does its job.

Related guidance and services

• SaaS and technology contracts, £995, the service this page describes
• Contract review, £495
• Data protection agreements and privacy terms, £795
• Terms and conditions for an online community or forum
• API terms of use

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.