TL;DR: What do Meta's new Commercial Terms mean for your website?
From 30 October 2026, anyone who uses Facebook, Instagram, Messenger or WhatsApp for business agrees that Meta may crawl the websites "associated with" their products, create test credentials to get in, and use that content for Meta products. The first text said "train"; after a backlash, Meta removed that word from the US English version on 17 October and limited the use to "advertising and business products". The permission to crawl stays. There's no opt-out: Meta's notice says that if you don't agree, you should stop using its products for business. Meta told Nieman Lab you can still control access with robots.txt, so block its AI training crawler, meta-externalagent, now if you don't want your content in Meta's AI.
If you run a Facebook Page, an Instagram shop or a few Meta ads for your startup, you probably clicked past a notice about "updated terms" this month. It's worth going back to it.
Buried in the update is one paragraph that turns your business account into permission for Meta to crawl your website and use what it finds for its products, a clause that first listed AI training. For bootstrapped founders whose content is their main marketing asset, that's a real trade-off, and you have until 30 October to decide how you handle it.
Update 17 October: what did Meta change in the AI training clause?
Meta's new terms for scraping business sites still let it crawl your website from 30 October, and on 17 October Meta changed what it says it will do with the content. After two days of criticism from publishers, Meta removed the word "train" from the US English version of the clause, The Next Web reported. According to a check of the preview terms by Pebblous on 19 October, the revised text lets Meta use the crawled content to "provide, develop, improve, research, and maintain advertising and business products", plus the integrity and security of Meta Company Products. Update: on 23 October Meta pushed the start date to 20 November 2026 in every edition, with the crawling clause unchanged. Update, 31 October: Meta has since paused the rollout pending a consultation with industry groups, and the UK CMA has opened a competition case into the terms; femaleswitch.org explains what the CMA investigation and Meta One paid links mean for small businesses.
- What stayed the same. The authorisation to crawl domains "associated with" your products, the 30 October start date and the all-or-nothing choice. The terms still say nothing about robots.txt.
- What Meta says. A spokesperson said the crawling terms "only applied to our ads and business products" and that the update does not change how Meta uses web crawlers, as quoted by Let's Data Science.
- What critics say. The News/Media Alliance told The Next Web that training was taken out of the listed uses but not expressly banned.
- Which version you get. Pebblous found the UK English edition still listed "train" on 19 October, so read the version Meta shows your account before you accept.
Our advice stays the same. "Advertising and business products" is also how Meta's crawler documentation describes meta-externalads (see the table below), while meta-externalagent is the crawler Meta says collects content for training foundation AI models. Block meta-externalagent if you want your content kept out of Meta's AI training, and save a copy of the terms you accept. For the complaints publishers and advertisers filed with the European Commission and the UK regulator on 22 October, and a checklist for small businesses, see what Meta's new Commercial Terms mean for small businesses. On 30 October, Google, Microsoft, OpenAI and Anthropic backed a shared robots.txt token for opting out of AI training; Meta wasn't among them, so keep your meta-externalagent rule.
What happened
Meta is replacing its Commercial Terms, the contract that covers anyone who uses its products "for business or commercial purposes": running ads, selling products, managing Pages, building apps or using business tools. The current version dates from 6 March 2024. The new version takes effect on 30 October 2026.
The key paragraph as first published, in Meta's own words:
"You authorize us (or any entity acting on our behalf) to use automated software (such as web scrapers, bots, robots, spiders, crawlers, and user agents) and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl the domains, web pages, or URLs (and any content available through them) that are associated with your products or services […]. Meta may use any content from such domains, web pages, or URLs to provide, develop, improve, research, train, and maintain the integrity of, the Meta Company Products […]."
Here's how it came out:
- 2 October: Stephen Beale, founder and editor of The Steampunk Explorer, saw a notice about the update in Meta Business Suite. He compared the old and new terms in Microsoft Word, and the crawl paragraph "immediately jumped out".
- 14 October: Beale published the clause and asked Meta to show where the language already existed. A Meta spokesperson said the update just consolidates existing terms; after three emails, Beale was still waiting for proof.
- 15 October: Nieman Lab had three legal experts read the terms. Their verdict: as written, the terms could be used to argue Meta may scrape news sites and train its AI on them.
Why lawyers are worried
"This is a remarkable provision to bury in [the] terms of service," Matt Topic, a media and IP attorney at Loevy & Loevy, told Nieman Lab. "It's not clear whether a court would enforce this, but publishers should assume that it would be enforceable."
James Grimmelmann, a professor of digital and information law at Cornell Law School, said it "clearly represents permission to Meta to train AI on any content from their sites". He also pointed at the "test credentials" wording: technically, it would let Meta "sign up as a fake user" to get past a registration wall. Meta wouldn't say whether that includes paywalls.
Three things make the clause broader than it first looks:
- "Associated with" isn't defined. It could mean your website, your shop, your app's pages, or anything you link to. A lawyer told Beale that "any content" could, on a broad reading, include e-books, videos and music on platforms like Amazon or Bandcamp, though a narrower reading is also possible.
- There's no opt-out. The only opt-out in the new terms is for the arbitration clause. For crawling, the choice is all or nothing. Meta's update notice says: "If you do not agree to the updated terms, please stop all access or use of our Products for business or commercial purposes."
- Robots.txt isn't mentioned. The new terms don't refer to it at all. The experts told Nieman Lab this gives Meta an opening to argue the contract overrides your blocking instructions.
Benjamin Sobel, a law professor at the University of Wisconsin, compared it to "tying" in antitrust law: to use Meta's business products, "you have to also acquiesce to the scraping and crawling permissions". He drew a parallel with Google, where appearing in normal search results now also means your content can be used in AI Overviews and AI Mode.
Meta's answer: "consolidation"
Meta declined to answer Nieman Lab's questions. A spokesperson said the crawling language used to be spread across different terms, including those for generative AI in ads, that the new terms won't change how Meta crawls publishers, and that "content owners can still manage how their content is accessed by using robots.txt."
Part of that checks out. Meta's Ad Creative Generative AI Terms from 2024 already let it crawl the URLs you give it with your ads. But that permission is limited to use "in connection with your ads" and says nothing about training. Meta's announcement of the update, as quoted by Beale, describes it as folding the Product Catalog Terms into the Commercial Terms and the Ad Creative Generative AI Terms into the Self-Serve Ad Terms, to "reduce overlap between our agreements". As Beale notes, the Product Catalog Terms don't mention crawling.
Robots.txt still works, mostly
Meta publishes a list of its crawlers with robots.txt instructions. If you want to stay on Facebook and Instagram but keep your content out of Meta's AI training, this is your practical lever. Which one you block matters:
Sources: Meta for Developers, web crawler documentation, read 16 October 2026.
So the sensible default for most founders: block meta-externalagent, which is the training crawler, and leave facebookexternalhit alone, or your link previews on Facebook break. Keep meta-webindexer if you want a chance of being cited in Meta AI answers. That's the same trade-off we see across AI search: the bots that cite you and the bots that train on you are increasingly separate, as with ChatGPT traffic that now shows up as Direct. If you've never edited robots.txt, our technical SEO checklist for startup websites covers the basics.
You wouldn't be alone. The Known Agents tracker says 19% of top websites already block meta-externalagent. And Meta's crawling has grown fast: in Cloudflare's data, Meta's crawler went from 0.9% of AI and search crawler traffic in July 2024 to 7.5% in July 2025.
The catch: robots.txt is a request, not a contract. If Meta's terms say you authorised the crawl, nobody knows yet which one wins. That's untested.
The European angle
Meta hasn't said the update skips Europe, and its help-centre post about the change is also published in other languages, including Dutch. EU law gives you more to work with than US fair use does:
- Adopted: Article 4(3) of the EU Copyright Directive (2019/790) lets rightholders reserve their content from text and data mining, "such as machine-readable means" for content online. Many sites use robots.txt for this.
- Adopted: Since 2 August 2025, Article 53 of the AI Act requires providers of general-purpose AI models to have a copyright policy that identifies and complies with those reservations of rights.
- Open question: whether a business that accepted Meta's terms has still "reserved" its rights. No court has ruled on that.
Meta's track record in Europe doesn't make this simpler. It refused to sign the EU's code of practice for general-purpose AI in July 2025, and in 2025 it started training on EU adults' public posts with an objection form. We noted another Meta training default, "Contributor mode" in Muse Code, in our piece on Gemini 4 Argon and Meta Muse Wonder. The EU's own rules for small businesses are also in flux: the Digital Omnibus is still stuck in Council.
What this means for you
- Decide what your content is for. If your blog is marketing, being read by Meta's AI may cost you little and could get you cited. If your content is the product, such as courses, templates, research or a paid newsletter, it's a different calculation. Our guide to IP strategy for startups helps you sort out what's worth protecting.
- Block the training crawler. Add a robots.txt rule for meta-externalagent before 30 October. It's a two-line change and it's the mechanism Meta itself points to. On Cloudflare, check whether your AI bot settings already block it.
- Put real walls around paid content. Given the "test credentials" wording, don't rely on a free sign-up form to protect premium content. Use proper paid access.
- Check what's "associated" with your account. Look at the website on your Page, your ad URLs, your product catalog and any WhatsApp Business links. That's the most likely reading of what Meta can crawl.
- Don't quit in a panic. For many bootstrappers, Facebook and Instagram are still the cheapest way to reach customers. Stephen Beale told Nieman Lab he's seriously considering closing his accounts; most founders will be better off blocking the crawler and staying. If Meta matters less to you than search, ranking on Google without big budgets is the long-term hedge.
- Keep a record. Save a PDF of the terms you accepted on 30 October. If this ends up in court or in front of a regulator, the date and wording matter. For more of this month's changes, see our SEO news for October 2026 and AI news for October 2026.
Are you getting customers from AI search yet?
More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.
👉 Rank on ChatGPT
FAQ: Meta's new Commercial Terms and website crawling
When do Meta's new Commercial Terms take effect?
On 30 October 2026. If you keep using Facebook, Instagram, Messenger or WhatsApp for business after that date, you're bound by the new terms.
Can Meta train AI on my website content?
The first version of the new terms said Meta may use content from domains "associated with" your products to "train" Meta products. On 17 October Meta removed "train" from the US English text and limited the use to advertising and business products. Legal experts told Nieman Lab this could be read as permission to train AI on your site. Meta says content owners can still use robots.txt.
Can I opt out of Meta crawling my website?
Not within the terms. The only opt-out in the new terms is for arbitration. Your options are to block Meta's crawlers in robots.txt or to stop using Meta's products for business.
Which Meta crawler should I block in robots.txt?
meta-externalagent, which Meta says crawls for training foundation AI models. Don't block facebookexternalhit if you want link previews on Facebook, and keep meta-webindexer if you want Meta AI to cite you.
Does this apply to businesses in the EU?
Meta hasn't said Europe is excluded. In the EU, the Copyright Directive lets you reserve your content from text and data mining by machine-readable means, and the AI Act requires AI model providers to respect that. How this interacts with Meta's contract is untested.
Does Meta say the terms are new?
No. Meta says it consolidated crawling language from older terms. The 2024 Ad Creative Generative AI Terms did allow crawling of ad URLs, but only for your ads and with no mention of training.
About the Author
Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
