A clause added to Meta’s Commercial Terms, effective October 30, 2026, authorizes the company to send bots to the websites associated with your products or services. It also lets Meta create test credentials to get in, collect the content and use it, among other things, to “train” its products. These terms govern business use of Facebook, Instagram and Meta’s other services. There’s nothing to sign: keep managing your Page, ads or product catalog after that date and you’ve accepted them.
Meta notified business accounts in early October through Meta Business Suite and a blog post, according to Nieman Lab. The site made it a story on October 15, publishing three legal experts’ take on the terms and a response from Meta, which points to robots.txt. Our article on AI crawlers and robots.txt explains what that file can and can’t do.
The clause, word for word
The new paragraph sits in the “Licenses & Rights You Provide Meta” section of the updated Commercial Terms, posted as a preview with an effective date of October 30, 2026. Here it is in full:
“You authorize us (or any entity acting on our behalf) to use automated software (such as web scrapers, bots, robots, spiders, crawlers, and user agents) and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl the domains, web pages, or URLs (and any content available through them) that are associated with your products or services, or that are made available through your or users’ use of Meta Company Products and services, and to periodically pull updates from such domains, web pages, or URLs. Meta may use any content from such domains, web pages, or URLs to provide, develop, improve, research, train, and maintain the integrity of, the Meta Company Products, services, and features provided under these Commercial Terms and any other applicable supplemental terms.”
The paragraph right before it covers the content you post on Meta’s services, such as photos or videos. Meta may use that content to “provide, develop, improve, research, and maintain” its products; “train” appears only in the paragraph about websites. The text offers no exception and no way to limit the crawling, and it never mentions robots.txt.
The scope is broad. The Commercial Terms apply to the use of Meta’s products “for a business or commercial purpose”: ads or marketing messages, selling or listing products, developing apps, a product catalog, managing a Page or a Group, Ads Manager, Meta Business Suite and measurement services. A bakery that runs its own Facebook Page is covered just like an online store that buys ads.
Advertisers already grant part of this right
The current version of the Self-Serve Ad Terms, in effect since August 22, 2025, says that by placing an ad order, you grant Meta “the right to access, index, cache, analyze or crawl the content available through your domains, webpages or URLs,” including for “research and training.” The Commercial Terms that have applied since March 6, 2024, contain no such clause.
On October 30, that right expands from advertisers placing orders to any business use of Meta. The new text also names the means: automated software, test credentials and periodic pulls of updates.
The new version of the Self-Serve Ad Terms, which takes effect the same day, repeats the clause for advertisers. It also says you are “solely responsible” for your ads, even when Meta’s automated features generate or select the creative, and that its AI features “may make mistakes.” We covered the ad-side changes in our article on product browsing, turned on by default on October 28, and the tools involved in our rundown of Meta’s AI ad tools.
How three US legal experts read it
Nieman Lab, the journalism site of Harvard’s Nieman Foundation, asked three legal experts to review the text. Its article, published October 15, 2026, focuses on news publishers, but the clause applies to any business use of Meta.
Matt Topic, a media and intellectual property attorney at Loevy & Loevy, called it “a remarkable provision to bury in [the] terms of service,” given that it “would give Meta access to material that would likely cost many millions of dollars in a licensing market.” He said it’s unclear whether a court would enforce it, but “publishers should assume that it would be enforceable.”
James Grimmelmann, a professor of digital and information law at Cornell Law School, reads it as permission to train AI on any content from a publisher’s site, and possibly to deploy some of it in competition with that publisher. He said test credentials would technically let Meta “sign up as a fake user” to get past a registration wall. The experts also said the wording gives Meta an opening to argue that its terms supersede a site’s blocking instructions.
Benjamin Sobel, a law professor at the University of Wisconsin, compared the move to “tying,” an antitrust concept: to use the Meta products covered by these terms, you also have to accept the crawling of your site. These readings all rest on US law, where lawsuits over AI training are still working their way through the courts.
Meta points to robots.txt
Meta declined to answer Nieman Lab’s questions, including whether test credentials would get past paywalls. A spokesperson said in an email that language about crawling had been scattered across several sets of terms, including the terms for generative AI in ads, and that the update consolidates it. He said the new terms won’t change how Meta crawls publishers, and that “content owners can still manage how their content is accessed by using robots.txt.”
Meta’s documentation on its web crawlers, updated May 21, 2026, lists five of them:
| Crawler (user agent) | Purpose, according to Meta | A robots.txt disallow |
|---|---|---|
| meta-externalagent | training foundation AI models or improving products by indexing content directly | blocks it |
| meta-externalads | improving advertising and other business products | blocks it |
| meta-webindexer | improving Meta AI search results, which can then cite and link to your site | blocks it |
| meta-externalfetcher | fetching a page at a user’s request, including for AI agents | may be bypassed |
| facebookexternalhit | building the preview of a shared link (title, description, image) | may be bypassed during security checks |
How exposed is a small business?
For an online store, product pages, prices and descriptions are already public, and any bot can read them. The difference is contractual: from October 30, any business that uses Meta’s tools gives it the right to crawl those pages and use them for training, among other purposes. The stakes are higher for a blog, a recipe site, a media outlet or a creator who makes a living from writing, because that content can have licensing value, the argument Topic makes for news publishers.
If you run an agency, the Commercial Terms already have you warrant that you have the authority to bind each client you use Meta’s tools for. Your clients should hear about the crawling clause from you before October 30, since it covers their websites. For the data their teams type into AI assistants, opt-outs are set tool by tool, as our guide to AI training settings shows.
Six checks before October 30
- Read the clause in the October 30 version of the Commercial Terms, and its counterpart in the Self-Serve Ad Terms if you advertise.
- Save a dated copy (PDF or printout) of the current and upcoming versions of both texts, in case the terms change again or a dispute comes up.
- Decide what to do about meta-externalagent, the training crawler: a “User-agent: meta-externalagent” group followed by “Disallow: /” in your robots.txt keeps it off your whole site. Do the same for meta-externalads if you don’t want your pages feeding Meta’s ad products, but leave facebookexternalhit allowed, or your shared links will lose their previews. Changes can take up to 24 hours to apply, since Meta’s crawlers may cache the file for that long. Meta says this setting still works, but the experts quoted above say the contract gives Meta an argument to override it.
- Put anything that must stay private, such as a paid newsletter, a client portal or an online course, behind manually approved accounts or a paywall. A free, automatic sign-up is the scenario Grimmelmann describes, and Meta hasn’t said whether its test credentials would get past a paywall.
- Agencies: give the clients whose Pages or ads you manage written notice, with a link to the clause.
- Keep in mind there’s no partial opt-out: “If you do not agree to the updated terms, you may stop all access or use of our Products for business or commercial purposes,” Meta writes.
Several questions remain open
The text doesn’t define the domains “associated with your products or services.” Is that only the website listed on your Page, or your other domains too?
No court has tested the clause. For businesses outside the US, the Commercial Terms send claims against Meta Platforms Ireland exclusively to the courts of Ireland, under Irish law. They also state that the disputes section doesn’t limit the rights and remedies businesses have under the EU’s Digital Markets Act (DMA), and they point business users to the alternative dispute settlement mechanism offered under its Article 6(12).
That leaves the gap the experts flagged between what Meta says it does and what its contract allows. Before October 30, watch for revised terms or a clarification from Meta.
Relying less on Meta
If Facebook and Instagram bring in most of your customers, walking away from Meta’s business tools is costly, and that’s what makes the clause hard to refuse. A website that ranks in search, an email list and other social networks reduce that dependence. Our complete guide to organic marketing covers the basics. If you’d rather have a team build those channels, see our organic marketing services.
