Your web filter decides what a device can reach. Your acceptable use policy decides what a person may do — and what happens when they don't. This guide walks through every section a modern school AUP should contain, from 1:1 device terms to AI tools, and shows how the document anchors your CIPA internet safety obligations. A ready-to-adapt outline is included below.
An acceptable use policy (AUP) is the written agreement between a school and the people who use its technology — students, staff, and often parents as co-signers. It states, in plain language, what school networks, accounts and devices are provided for, which behaviors are expected, which are prohibited, and what consequences follow a violation.
Signed at enrollment or at the start of each year, it turns "everyone knows the rules" into a document everyone has actually agreed to. A good AUP is short enough to be read and specific enough to be enforced.
It is not a technical manual, and it is not a scare document. The strongest policies read like a code of conduct for the digital parts of school life: they assume most students want to use technology well and define the boundaries clearly.
Every district receiving E-Rate discounts is already required to adopt an internet safety policy under the Children's Internet Protection Act. The AUP is where most schools carry that requirement, alongside the technical protection measure — the web filter itself.
If you are still evaluating that technical half, our guides on web filtering software for schools and how to choose a school web filter cover it in depth.
A filter without a policy produces confusion: students hit block pages with no shared understanding of why, and staff improvise consequences case by case. A policy without a filter is worse — it asks children to self-enforce rules against content designed to be compelling, and it leaves the school unable to certify the technology protection measure CIPA requires.
Together they divide the work cleanly. The filter handles the categories no student should reach at school — obscene material, content harmful to minors, malware. The AUP handles everything a filter cannot judge: tone in a class forum, honesty in submitted work, respect for other people's accounts and property. Neither can do the other's job.
Structure varies by district, but a complete acceptable use policy for schools covers these areas. Each card below becomes a clause in the outline further down the page.
Why the school provides technology, who the policy applies to — students, staff, volunteers, guests — and which systems it covers: networks, accounts, school-issued and personal devices used at school.
The positive case first: technology is for learning, research, collaboration and communication connected to school purposes. Naming the expected behaviors makes the prohibitions read as boundaries, not suspicion.
Accessing or attempting to access blocked material, harassment and cyberbullying, impersonation, plagiarism, sharing credentials, tampering with settings, and any attempt to bypass the filter — stated concretely, with examples.
Care and charging responsibilities, loss and damage procedures, whether devices go home, and the key disclosure: school-issued devices remain school property and stay filtered and managed wherever they connect.
Which uses of generative AI are permitted, which count as academic dishonesty, and a warning against pasting personal information into unapproved tools. The newest section — and now one of the most read.
When and how social platforms may be used at school, expectations for representing the school online, and the line between personal expression and conduct that disrupts school or targets its members.
Plain disclosure that activity on school networks and accounts is filtered, logged and may be reviewed — and, just as clearly, what the school does not monitor, such as personal devices on cellular data.
A graduated ladder — restorative conversation, loss of privileges, disciplinary referral — with escalation reserved for safety-related violations. Predictable consequences are what make a policy fair.
Student and parent signature blocks, staff acknowledgment, the effective date, and a named owner responsible for the annual review that keeps the document current.
When the policy says "prohibited content is blocked," this is what does the blocking — and what produces the records that prove it.
An AUP written by one administrator over a weekend gets ignored. One built through this short process gets followed.
Pair the technology director with teachers, a principal, and ideally a student representative. Teachers know where rules will collide with instruction; students know where a rule will simply be ignored.
The policy should describe what the filter genuinely does — which categories are blocked per grade band, how exceptions work. A policy that promises enforcement your system doesn't perform is a liability in both directions.
Counsel checks the monitoring disclosures, disability and equity implications, and state-specific requirements. Board adoption gives the document the formal status CIPA's internet safety policy expects.
Publish a full version for high school and staff, and a shortened, plain-language version for younger students. A second grader can honestly agree to five clear promises; nobody honestly agrees to four pages of legal prose.
Gather student, parent and staff acknowledgments at enrollment, then spend one class period walking through the policy — which also advances CIPA's requirement to educate students on appropriate online behavior and cyberbullying awareness.
Name an owner, put a date on the calendar, and revisit the document each spring. The AI section alone will need updating annually as tools and classroom practice evolve.
Below is a working skeleton drawn from the sections above. Replace the bracketed items, cut what doesn't apply, and keep the whole document under four pages — brevity is a feature, because a policy only works if people actually read it.
Districts sometimes split this into two documents — a student-facing responsible use pledge and a longer board policy. That's a fine structure, as long as the two never disagree with each other and both point to the same filtering practice.
Our bundled AI-tools blocklist tracks 16,328+ AI-tool domains across 18 categories, updated daily — so the line your AUP draws on paper is the same line the filter draws on the network.
AI tools. A blanket "no AI" clause fails twice: it bans legitimate instructional uses teachers are already assigning, and it's unenforceable on paper alone. Write the clause by category instead — permit approved tools with citation, prohibit essay-writing and homework-solving services for graded work, and ban deepfake, voice-cloning and companion-chat tools outright on safety grounds. Then mirror those exact category decisions in the filter.
Social media. CIPA does not require schools to block social media, so this section is a genuine policy choice rather than a legal mandate. Most districts land on a middle path: blocked or time-limited for students during the school day, open for staff accounts that represent the school, with conduct expectations that apply regardless of where a post was written.
A quick reference for where each real-world situation belongs. If a scenario appears in neither column, your AUP has a gap.
| Situation | AUP (people & conduct) | Filter (technical control) |
|---|---|---|
| Student tries to open an adult site | Defines it as prohibited; sets consequence for repeated attempts | Blocks the request across every categorized domain |
| Student installs a VPN to bypass blocks | Names circumvention as a serious violation | Blocks known proxy/VPN categories and logs the attempt |
| Cruel messages in a class chat | Cyberbullying clause and consequence ladder apply | Cannot judge tone inside an allowed app |
| Essay submitted from an AI writer | Defines it as academic dishonesty | Blocks essay-writer domains on school devices |
| Chromebook comes home for the year | Sets care, charging and return terms | Keeps policy enforced on the home network |
| Brand-new harmful site launched today | Paper can't react in real time | New domains are classified as they appear |
CIPA asks E-Rate-funded schools and libraries for three things: a technology protection measure that blocks obscene material, child sexual abuse material and content harmful to minors; an adopted internet safety policy; and monitoring of minors' online activity along with education on appropriate online behavior, including cyberbullying awareness.
The filter satisfies the first requirement. A board-adopted AUP is the most common vehicle for the second, and its signature, disclosure and instruction requirements carry much of the third.
In practice, the AUP is also what makes compliance demonstrable. When a question arises — from a parent, a board member or an E-Rate review — the district can produce a dated, adopted policy, signed acknowledgments, evidence of student instruction, and category-level filtering reports.
Each piece strengthens the others; none is sufficient alone. For the full picture of the law, see our plain-English guide to what CIPA is.
A policy stricter than your practice is as risky as no policy. If the AUP promises that certain content is blocked, your filtering configuration and its reports need to show exactly that.
Reviewing the two side by side once a year — ideally when you review your filtering plan and category settings — keeps the paper and the practice telling the same story.
CIPA requires educating students on appropriate online behavior, including cyberbullying awareness. Walking students through the AUP during enrollment satisfies this requirement while building genuine understanding.
Guides and tools that connect to your acceptable use policy work.
A plain-English guide to the law behind your internet safety obligations, E-Rate requirements and technology protection measures.
Category-based filtering across 120M+ domains, covering the technical half your AUP references.
Evaluation criteria, feature comparison and questions to ask vendors before selecting the filter your policy will point to.
16,328+ AI-tool domains across 18 categories — the enforcement layer behind your AUP's AI clause.
Step-by-step checklist covering every CIPA requirement, from adopted policy to certified filtering.
The broader policy framework your AUP sits within — monitoring, education and board adoption requirements.
If your school or library receives E-Rate discounts, CIPA requires an adopted internet safety policy, and an AUP is the standard way districts meet it. Even outside E-Rate, an AUP is strongly advisable: it documents expectations, supports fair discipline, and gives parents clear notice of monitoring on school systems.
Mostly framing. A responsible use policy emphasizes positive expectations and digital citizenship, while a traditional AUP leads with rules and prohibitions. Many districts now write an RUP-style student document backed by a fuller board policy. The name matters less than coverage: purpose, expectations, prohibitions, devices, AI, monitoring notice, consequences and signatures.
Yes, in an age-appropriate form. A simplified pledge for elementary students builds the habit of agreeing to expectations, while parents co-sign at every level. For middle and high school, signing the full document supports accountability when a violation has to be addressed later.
It should. Generic prohibitions on "cheating" leave too much ambiguity about paraphrasers, homework solvers and chatbots, and they say nothing about safety issues like deepfake tools or students sharing personal data with AI services. A category-based AI clause — enforced by a matching AI-tools blocklist on the filter — removes the guesswork for students and teachers alike.
No. The categories CIPA obligates a filter to block are obscenity, child sexual abuse material, and material harmful to minors — social platforms as such are not on that list. Your AUP's social media stance is a local decision; many districts restrict student use during instructional time while keeping staff and communications accounts open.
Review annually, with board re-adoption when substance changes. The AI section, device terms and monitoring disclosures age quickest. Tie the review to your yearly filtering-policy review so the document and the configuration are always aligned.
Follow the graduated consequences the policy itself promises: a documented conversation for a first minor violation, restricted privileges for repeats, disciplinary referral for serious cases, and immediate escalation for anything involving safety. Filter logs help establish what happened; the signed policy establishes that the student knew the rule.
An AUP sets the rules — our category-based filtering across 120M+ domains, with a daily-updated AI-tools blocklist, makes them real on every school device, on campus and at home.