Protect Your ISP With A Strong AUP (Acceptable Use Policy)

When you sell a service, you have the right to define the terms on which that service is provided. Doing this properly is a key to a relatively headache-free ISP experience.

by Christopher Knight [October 25, 1999]

Your Acceptable Use Policy (AUP), also referred to as Terms of Service (TOS), is not a luxury or an optional document, but rather a critical building-block of your business. It is the basic textbook educating your subscribers about the realities of life as users of your Internet service.

There's an ongoing debate in the ISP community as to whether you need to get this document signed in ink for it to be legally binding. These days, most ISPs have abandoned that approach in favor of a button on their sign up page-like a software license validation, which states that the subscriber-to-be accepts the AUP terms as stated and agrees to be bound by them as part of the sign-up process.

Here are the components of a strong AUP, along with brief explanations of why each is included:

Introduction: Explains why the AUP exists, how it protects your subscribers and protects your ability to run a fast, high availability network without hassles. In this section, you also outline what will happen to subscribers who abuse or violate any of your standard policies.

Warranties/Disclaimers: This is where you establish that anyone who uses your service, is doing so "as is" with no guarantees, no warranty of any kind. It also points out that you have no intention of being financially liable to any customer for any harm that may occur through their use of your services, regardless of whose fault it might be. Your total economic obligation to your client should never exceed the total amount of dollars paid to you by your client.

Security: Here we talk about customer passwords and how you are not guaranteeing that any communication or use of your services is truly secure, that although confidential information will be kept as secure as possible, the customer has no enforceable right to total privacy from a data packet standpoint. From a customer/vendor standpoint, they do have a fundamental right: that you will not disclose any confidential information that they give you. But this section is more about how your network runs, from a data standpoint.

Personal Files: This section establishes that the ISP is not responsible for back ups of subscribers' personal files and other information, and that you have a right to delete their information after they are no longer a customer of your ISP.

Nontransferability of Account: A customer may not have more than one login session per account at any time, unless they have paid for multiple login accounts. Nor may customers transfer or give out their dialup ID and password for use by friends or others. Account sharing is a violation of the terms of this section.

Network Address Ownership: Any IP addresses assigned to your customers are considered loaned to your customers, and not given. They will revert back to the ISP, after the customer leaves.

Compliance with All Laws: This paragraph states that customers will not violate any laws while using the services of your ISP, and that customers will "hold the ISP harmless" in any claim against same.

Unacceptable Conduct: This is a deep section, in which you will list many items that constitute unacceptable conduct-such as: excessive posting or otherwise abusing USENET sending unsolicited emails (spam) using your ISP to do anything with spam harassing other individuals mail bombing impersonating or falsifying any information violating anyone's privacy use of IRC bots network-unfriendly activity or hacking that causes interference with normal network operations attempts to gain unauthorized root access to the ISP's servers participating in chain letters any other attempt to use your ISP as a staging ground to hurt others in any way.

Right to Disconnect Nondedicated Accounts: This gives you the right to shut down connections that are idle for a specified period, or where subscribers are in any way attempting to use a nondedicated account as if it were their own personal dedicated 24x7 account.
[Click here to read more about 'unlimited' versus 'dedicated' accounts and the abuse of 'nonmetered' accounts.]

Excess Utilization of System or Network Resources: This is a policy from "yesteryear" that gives you the right to disconnect someone who is "overusing" your services for any reason you deem as unacceptable.

Compliance with Rules of Other Networks: Your subscribers agree to not hurt other folks' networks, so that you can keep good relations with your competitors.

Monitoring and Privacy: How your ISP takes your subscribers privacy seriously, and to what extent your subscribers should realize the privacy protection that you deliver.

Cooperation with Authorities: This is more of a warning section that states you are serious about getting the law involved for any illegal egress or transaction that your subscribers may attempt while using your services.

ISP's Right to Suspend or Cancel Accounts: While you know that your ISP is a private business, your customers may think you are required to provide them service whether you like it or not (as you would be if you were a telecom carrier). This simply is not the case. In addition to clarifying that point, this section covers a number of collateral issues:

• Your policies regarding folks who don't pay on time [Click here to read more about dealing with late paying or nonpaying customers.]
• That your subscribers are responsible for informing you of address changes or other new contact information
• Your termination policy
• (A key point): That refunds from cancellation of prepaid account are only available on a prorated basis, as if they were month-to-month clients, rather than based on the discount they received for prepaying their account.

Rights to Damages: This states that you, the ISP, have a right to claim economic damages from your subscribers if they violate your AUP and cause your ISP significant economic harm.

Right to Modify or Change Service: Establishes your right to update and change this AUP as you need or see fit. It essentially says that if your customer ever disagrees with your AUP, then their sole recourse is to cancel service with you.

Note that whenever you do change your AUP, you have an obligation to promptly inform your subscribers about any such changes. (You know, credit card companies do this all the time.) Any customer who has not written within 30 days to protest the change has tacitly agreed to abide by your new rules.

Lastly, put this at the end of your AUP . . .

"If you've got questions, email them to: ceo@your-isp-name.net."

. . . so that if anyone has any questions or suggestions about your AUP, they can get them answered or give their input.

To Your ISP-AUP "Protected" Success!

Christopher Knight
Founder & Managing Editor of the ISP-Lists Discussion Community

—End

Read about the ways many ISPs screw up their AUPs