A method for detecting abuse of zero-rated data includes monitoring usage patterns of a group of users for a particular data type, including zero-rated data usage by the group of users and setting a zero-rated data-usage threshold for the particular data type based at least in part on the monitored usage. The method also includes continuing to monitor the usage patterns of the group of users for the particular data type during a period of time, including the zero-rated data usage of the group of users. The method further includes determining whether a zero-rated data usage for the particular data type by a user in the group during the period of time satisfies the zero-rated threshold, and in response to determining that the zero-rated data usage by the user during the period of time satisfies the zero-rated threshold, flagging an account associated with the user as a potential abuser.