Meta’s new business terms let it crawl your website and train AI on it

Meta’s updated commercial terms give the company permission to send scrapers, bots and crawlers to any website “associated with” a business that uses Facebook, Instagram, Messenger or WhatsApp, and to use whatever they collect to “train” Meta products. The same clause lets Meta create “test credentials” to get in. If you run ads, manage a Page or answer customers from a WhatsApp Business account for a shop, a clinic, a restaurant or a newsroom, you accept all of it simply by carrying on as usual, and there is no box to untick.

The scope is what alarmed lawyers. Nieman Lab, which learned about the change from a reader tip, asked three legal experts to read the text, and all three said it could be used to argue that Meta may scrape news sites and feed them to its AI. “For news publishers, this clearly represents permission to Meta to train AI on any content from their sites,” said James Grimmelmann, a professor of digital and information law at Cornell Law School. Meta’s own terms of service list “AI at Meta” among the products the clause covers.

The phrase “test credentials” worries them most. Grimmelmann told Nieman Lab it would technically let Meta “sign up as a fake user” to get past a site’s registration wall, and Meta declined to say whether it would use such accounts on paywalled or subscriber-only pages. Matt Topic, a media and intellectual property attorney at Loevy & Loevy, called it “a remarkable provision to bury in [the] terms of service”, given that the material it unlocks would likely cost many millions of dollars in a licensing market.

Meta says that reading is wrong. Andy Stone, its vice president of communications, called the reports false and said the update is meant to pull accurate product information from sellers’ websites for ads and recommendations inside Meta’s apps, not to scrape news sites. Daniel Roberts, another spokesperson, told The Verge the company is merging its commercial and self-serve ad terms and that its use of web crawlers is not changing. Meta also told Nieman Lab that the crawling language used to be scattered across several documents and that “content owners can still manage how their content is accessed by using robots.txt.”

That reassurance is not in the contract. The clause in Meta’s published preview never mentions robots.txt, the file a site uses to tell bots which pages are off limits, and it does not restrict crawling to product or catalogue pages. Eric Goldman, a law professor at Santa Clara University, told The Register that the language “doesn’t expressly say that Meta will respect those robots.txt instructions.” The experts Nieman Lab consulted said Meta could argue that a contract the business accepted outranks a text file on its server. And nothing in the terms settles whether training AI on scraped articles is legal at all. That still turns on fair-use cases moving through US courts, including a class action that five large book publishers filed in May accusing Meta of pirating millions of books to train its Llama models.

The reach goes well beyond media. The terms cover anyone who uses Meta’s tools for business: Pages and Groups, ads, marketing messages, product catalogues and the Business Suite dashboard. The Register notes that at least a million businesses use Meta’s AI agents in WhatsApp and Messenger alone. Nothing in the clause as quoted limits it to one country, so a bakery selling through Instagram faces the same choice as a national newspaper. Benjamin Sobel, a law professor at the University of Wisconsin, compared the setup to what antitrust law calls “tying”: to keep the business tools, you have to accept the scraping. The timing stings, too. Meta One, the company’s new paid subscription, limits how many external links some Facebook and Instagram accounts can post without paying, which means Meta now charges some users to share links to the same pages it wants permission to crawl for free.

The updated terms take effect on October 30, 2026. Meta announced them in early October in a blog post and inside Meta Business Suite, and the notice tells businesses that disagree to stop using its products for business or commercial purposes. Until then, the one practical lever is the one Meta points to. Its developer documentation describes a crawler called Meta-ExternalAgent that collects web content for uses such as training foundation AI models, and site owners can disallow it by name in robots.txt. According to crawler guides, link previews on Facebook come from a separate Meta bot, so blocking the training crawler does not have to break how your links look when people share them. Whether Meta would treat that block as binding once the new terms apply is a question the company declined to answer.

Stephen Beale, who runs the site The Steampunk Explorer and tipped off Nieman Lab after spotting the notice in his dashboard, told the outlet he is seriously considering shutting down his accounts before the deadline. His readers, he said, are “totally entrenched on Facebook.” For a business like his, the only way out of the crawling clause is to leave the place where the audience lives.

Tags: meta, privacy, instagram, AI training, facebook, WhatsApp, web scraping