Meta's Business Terms Let Its Crawlers Into Your Website From 30 October. It Dropped "Train", Not the Crawling
By Surya Pratap
October 19, 2026
8 min read
Startup Strategy
October 19, 2026
8 min read
One word out, the crawler staysHover to exploreMost founders have accepted Meta's business terms without reading them. You needed a Facebook Page, an Instagram business profile or an ads account, and the terms came with it. The version that takes effect on 30 October is worth reading, because one paragraph in it is about your website, not your Meta accounts.
This article is based on the text of the crawling paragraph as quoted by PPC Land, on Nieman Lab's reporting (first story, follow-up), and on coverage by MediaNama. I have not seen the full revised wording; the description of the change comes from that reporting. The reading from section 3 onward is mine, and it is not legal advice.
Meta's Commercial Terms apply to businesses that use its products commercially: Facebook Pages, Instagram business accounts, Meta Business Suite, advertising. The version due on 30 October contained this paragraph:
"You authorise us (or any entity acting on our behalf) to use automated software (such as web scrapers, bots, robots, spiders, crawlers and user agents) and create test credentials to access, index, cache, analyse, collect, retrieve or crawl the domains, web pages or URLs (and any content available through them) that are associated with your products or services, or that are made available through your or users' use of Meta Company Products and services, and to periodically pull updates from such domains, web pages or URLs. Meta may use any content from such domains, web pages or URLs to provide, develop, improve, research, train and maintain the integrity of, the Meta Company Products, services and features provided under these Commercial Terms and any other applicable supplemental terms."
Three parts of it matter:
On 15 October, Nieman Lab published the view of three legal experts that the paragraph, as written, could support an argument that Meta may scrape news sites and use the content to train its AI. Almost every news organisation has a Meta business account. Meta spokesperson Andy Stone called reports that the terms would allow scraping of news sites "false".
On 16 October, Meta revised the terms. According to the reporting, it:
A Meta spokesperson said: "We've heard you and want to clarify: the crawling terms we consolidated only applied to our ads and business products," adding that "content owners can use robots.txt to signal their preferences."
The revision changed what Meta says it will do with the content. It did not, by the reporting, change the permission to collect it:
Legal experts were not reassured. Cornell's James Grimmelmann told Nieman Lab the revised wording was still broad enough to cover AI training. The University of Wisconsin's Benjamin Sobel pointed out that robots.txt expresses a preference but does not create an enforceable right to stop scraping. European, UK and US publisher associations have called for regulators to step in.
Meta removed the word that described what it may do with your content. It kept the paragraph that lets it collect it.
This is not only a publishers' problem. If you have a Facebook Page, an Instagram business account or run Meta ads, you are a party to these terms, and your website is "associated with your products or services".
Map what is reachable. List the domains tied to your Meta accounts and ads: marketing site, docs, blog, help centre, app. Decide which of them you are comfortable having crawled, cached and analysed by a third party under contract terms you did not negotiate.
Separate marketing from product. Keep your product behind its own subdomain and authentication. A test account created by someone else's crawler should not be able to see customer data, pricing you negotiate privately or anything behind a sign-in you would not show a stranger.
State your preference anyway. Robots.txt is not enforceable, but it is the signal Meta itself points to. Set rules for Meta's published crawlers, and for AI crawlers generally, on the domains that matter. Then check your server logs to see what actually arrives.
Watch for unknown sign-ups. "Test credentials" means accounts. Look for registrations and logins that do not behave like customers, and decide in advance what you will do if they turn out to be automated.
Read the terms you clicked through
Set a reminder to read the business terms of every platform you depend on — Meta, Google, LinkedIn, your payment provider, your cloud — whenever they change. The clauses that matter for an AI-era startup are about crawling, content use and training, and they increasingly sit in terms you accepted to run ads, not in a contract you negotiated.
If your content is your product — a knowledge base, a data set, original research, paid articles — this matters more. Our GEO playbook is about being cited by AI systems; this is the other side of the same question, about being collected by them without being asked.
Some founders read this story from the other side. If your product depends on crawling other people's sites, notice what happened: a company with Meta's leverage wrote consent to crawl and train into terms its customers could not negotiate, and the backlash forced a change within a day.
The lesson is not about Meta's legal position, which lawyers dispute. It is that consent buried in platform terms is fragile, publicly and commercially. Training data you have licensed, or that owners have clearly opted in to, is slower to get and much harder to take away. And if a regulator asks, as the FTC has just asked OpenAI and Anthropic, how your claims match your practice, "the terms allowed it" is a weak answer.
That Meta is training AI on your website. Meta says the crawling applies only to ads and business products, and called reports of news-site scraping false. The terms set out what Meta may do, not what it does.
That the revised terms permit AI training. Some legal experts think the wording is still broad enough; Meta disagrees. No court has ruled on it.
That I know the final wording. The revised text is described here from reporting; check the terms Meta publishes before 30 October.
That robots.txt protects you. It signals a preference. As Sobel noted, it does not create an enforceable right.
From 30 October, every business using Meta's products authorises Meta to send scrapers and crawlers, and to create test credentials, to the websites associated with its products. Meta originally reserved the right to use that content to train its products; after Nieman Lab's reporting it removed "train" and limited the use to advertising and business products. The crawling, the test credentials, the broad scope and the absence of an opt-out remain, and legal experts say the revised wording is still broad.
For startups the practical point is simple. Your website's exposure is now partly set by terms you accepted to run a Facebook Page.
Before 30 October, list every domain tied to your Meta accounts, keep anything sensitive behind its own authentication, set your robots.txt preferences for Meta's and other AI crawlers, and start watching your logs and sign-ups for automated visitors.
Sources: PPC Land — the full text of the crawling paragraph as originally published for 30 October 2026, who is bound by it, and Meta declining to explain test credentials. Nieman Lab, 15 October 2026 — the three legal experts' reading. Nieman Lab — the revision and experts' view that it remains broad. MediaNama — the removal of "train", the narrowing to advertising and business products, the Meta spokesperson's statement on robots.txt, James Grimmelmann's and Benjamin Sobel's comments, the absence of an opt-out and publisher associations' calls for scrutiny. The 16 October revision date, Andy Stone's "false" comment and the near-universal use of Meta business accounts by news organisations are as reported in coverage of Nieman Lab's stories. The reading in sections 3 to 6 is mine and is not legal advice.
IdeaToMVP Academy
4-week live cohort for founders. Learn to ship AI agents, scope MVPs, and automate your business — taught by the same team that writes these guides.
