Anthropic Usage Policy: Sept 2025 vs Nov 2026 - what changed Old version: effective September 15, 2025 [1] New version: effective November 12, 2026 [2] Section names are given so you can Ctrl+F them on each page. New sections and rules (not in the old version) “Do Not Engage in Deceptive Campaigns or Artificial Activity”
- brand new section. Bans sockpuppets, astroturfing, fake media outlets, hidden sponsorship of influence content, networks of fake “independent” sites, seeding search engines or AI systems with content that fakes its origin, and building or selling tools for any of this. “High-risk Physical Actions”
- new rules for models connected to hardware (vehicles, drones, robots, machinery, medical devices, industrial plants, safety systems). Requires a human who can stop the equipment at any time, fail-safe behavior if the connection drops, and safety limits enforced outside the model. Cruelty to the model
- new bullet under “Cruel, Abusive, or Psychologically Harmful Conduct” bans “sustained and needless abusive or cruel behavior toward our models”. NCII
- new explicit ban on non-consensual intimate imagery, including AI-generated material and tools to make it. Data brokering
- new bullet under “Privacy or Identity Rights” bans compiling personal data from multiple sources into profiles for sale or disclosure. Doxxing
- new bullet under “Surveillance” bans unmasking anonymous people or compiling dossiers to harass, intimidate, or harm. Platform abuse additions
- stolen or fraudulent payment methods, evading payment, faking the sign-up or login process, and reselling or proxying Claude through unauthorized means “including services that route requests through consumer subscriptions or misrepresent the product or client being used”. Verification programs
- new Cyber Verification Program and Life Sciences Verification Program let users apply for adjusted real-time safeguards. Also new: hitting a real-time block “does not by itself indicate a violation”. Enforcement
- new version adds “warn” and “limit” to the list of possible actions (old: throttle, suspend, terminate).
Scope clarified
- new version explicitly covers app users, API developers, cloud provider customers, and end users of products built on Claude, and states the policy is about how Claude is used, not which industry uses it. Sections that got stricter or more detailed Weapons
- grew from 4 bullets to 6. Now covers weapons systems and their software (targeting, fire control, engagement), weaponizing drones or autonomous platforms, export control violations, fissile material and enrichment, and modifying bio or chem agents for lethality, transmissibility, or persistence. Surveillance and law enforcement
- “make or suggest decisions” now includes investigating, charging, arresting, prosecuting, and release decisions (old: only parole and sentencing). Tracking now covers property, biometrics, movements, online activity, associations, and analysis of previously collected data. New bullet bans building or improving surveillance tools. Surveillance carve-out (new)
- consented tracking, fraud and AML screening, aggregated or anonymized analysis, content moderation, authorized security research, legal research by law enforcement or courts, and journalism are explicitly allowed. Cyber
- section renamed to add “Without Authorization”. Adds privilege escalation and actually conducting DoS attacks (old only banned developing DoS tools). New carve-out for security research on systems you own, with owner authorization, or under a bug bounty or vulnerability disclosure program. Self-harm and eating disorders
- old version had one bullet. New version spells out soliciting methods, instructions for hiding behavior, pro-ED content, restriction, purging, compensatory exercise, and shaming or ranking bodies. Hate
- caste and disability added as named protected attributes. Fraud
- adds extortion, social engineering, phishing sites that mimic real pages, buying or selling fake financial or employment records, and misrepresenting professional credentials. Child safety
- adds “facilitate the creation of” CSAM and “other sexually exploitative content involving minors”. Reporting to authorities now also covers scenarios where a minor may be at imminent risk, not just detected CSAM. Critical infrastructure
- adds emergency services and transportation systems; “voting machines” replaced with “election systems”.
Agentic use
- users are now explicitly responsible for actions their agents take “through tools, browsers, or connected systems”. Things that got narrower or were dropped High-risk use cases rewritten
- old version listed 7 broad domains (legal, healthcare, insurance, finance, employment/housing, academic testing, media/journalism). New version lists 11 “High-risk Areas” but defines each one narrowly as a specific recommendation or decision about a specific person. Example: Legal
- old: “use cases related to legal interpretation, legal guidance, or decisions with legal implications”. New: advising an individual on their rights, obligations, or liability in a specific matter, or preparing documents for them to sign or file. Media or journalistic content is no longer a high-risk use case. New “Exclusions” section
- general info and education, wellness content, explaining a decision a professional already made, internal drafting and research, carrying out a decision already made, and business operations not about a specific individual are all exempt. New “Favorable Decisions” section
- no human review needed before paying an insurance claim, approving coverage a clinician ordered, granting healthcare eligibility, or granting a public benefit. Disclosure
- no longer needs to identify Anthropic, Claude, or the model. Chatbot disclosure can be “in the product interface” instead of at the start of every session. Democratic processes
- dropped the ban on “personalized vote or campaign targeting based on individual profiles or data” and the standalone bullet on lobbying with false information. “Artificial or deceptive political movements” moved to the new Deceptive Campaigns section. Predatory lending
- old version named payday loans, title loans, and high-interest short-term lending. New version only says “predatory lending”. Multi-level marketing is no longer named, folded into “pyramid schemes”. Impersonating a human
- moved from “Privacy or Identity Rights” to “Disinformation”, now with a carve-out: “This does not prohibit clearly disclosed parody, satire, or fiction.”
Section renames
- “Misinformation” is now “Disinformation”; “Psychologically or Emotionally Harmful Content” is now “Cruel, Abusive, or Psychologically Harmful Conduct”; MCP Directory Policy replaced by a broader Software Directory Policy. Unchanged “Do Not Generate Sexually Explicit Content” is word for word identical.
- Supported regions, ban evasion, model distillation, plagiarism, jailbreaking, and the government customer exception all carry over with only minor wording changes. What stands out (my read) The subscription proxy ban is the one that bites regular users. Routing Claude through “consumer subscriptions” or misrepresenting “the product or client being used” is now a named violation. That is aimed directly at third-party tools and harnesses that run on a Pro or Max login instead of API keys. If you use one of those, you are now in the written policy, not a gray zone. High-risk rules got a lot more business friendly. The old version was vague enough that a legal intake form or a medical FAQ bot arguably needed a licensed human reviewing every output. The new version only triggers when Claude gives a specific person a specific recommendation, and it lists explicit exclusions for general info, internal drafting, and research. This is a loosening dressed up as more pages. Anthropic is clearly planning for robots. An entire physical actions section with fail-safes, kill switches, and independent safety limits does not get written for chatbots. Read it as a roadmap for where they expect the API to be used in the next year or two. Astroturfing is now its own category. Fake outlets, sockpuppet networks, seeding search engines and AI systems with fake “independent” sources, and selling tools for it. They are not just banning the content, they are banning the infrastructure and the business model. One rule got quietly weaker. The old ban on “personalized vote or campaign targeting based on individual profiles or data” is gone. Microtargeting voters with honest content now appears to be fine. Whether that is a cleanup or a concession, it is a real change. “Be nice to the model” is now policy. “Sustained and needless abusive or cruel behavior toward our models” is a bannable offense. Not defined, no examples, no stated enforcement. Expect this to be the most argued line in the whole document. Surveillance carve-outs widen the door for law enforcement. Monitoring in investigations is still banned, but “legal research and analysis by law enforcement agencies or courts” is now explicitly allowed. That is a narrow opening that did not exist before.
Verification programs replace blanket refusals. Cyber and life sciences users can apply for adjusted safeguards instead of being told no. Combined with the note that a block is not a violation, this is Anthropic admitting its filters have been hitting legitimate work. Net (imho): tougher on bad actors and gray market resellers, looser on ordinary business use, and written for a future where Claude controls hardware. The policy also tracks what people have been noticing in practice: Fable and Opus refuse far less than they used to. Work that used to trip the filters, like decompiling, reverse engineering, and binary analysis, now mostly just gets done. The new carve outs for security research and the verification programs read like Anthropic catching the paperwork up to how the models already behave. submitted by /u/k33bs
Originally posted by u/k33bs on r/ClaudeCode
You must log in or # to comment.