Meta's revised terms still allow broad website scraping for business products

Meta has updated its commercial terms of service after facing backlash over provisions that allowed broad scraping of websites associated with business accounts. The company removed explicit references to using scraped data for AI training, yet legal experts argue the revised language remains dangerously vague and expansive.

The changes come just days before the new terms are scheduled to take effect on October 30, 2026. Despite the edit, major media organizations and legal scholars contend that Meta retains significant authority to crawl and utilize content from domains linked to its business users, potentially bypassing traditional web standards like robots.txt files.

What happened

Following a report by Nieman Lab on Thursday, October 17, 2026, which highlighted that Meta’s initial terms permitted the use of scraped website content to train AI models, the tech giant issued a revision on Friday afternoon. The original text explicitly stated that Meta could use content from associated domains to "provide, develop, improve, research, train, and maintain" its products. In the updated version, the word "train" was removed, and the scope of usage was narrowed to "advertising and business products" rather than all Meta Company Products.

However, the core authorization for automated access remains intact. The new terms still grant Meta the right to use bots, spiders, and crawlers to access, index, cache, analyze, and collect data from any URLs associated with a business’s products or services. This includes domains made available through the use of Meta platforms such as Facebook, Instagram, WhatsApp, Threads, and Messenger. Since virtually every news organization and many businesses maintain at least one Meta business account to manage their presence, this clause effectively opens a wide range of external websites to Meta’s scraping infrastructure.

A Meta spokesperson stated that the revision was intended to clarify that the crawling terms only apply to ads and business products, not general AI training. The spokesperson also claimed that news sites and other content owners retain the ability to disable crawlers via robots.txt flags, asserting that this capability has not changed. Yet, the revised legal text does not include specific language guaranteeing respect for robots.txt preferences, leaving the enforcement of these preferences voluntary rather than contractual.

How it works

The mechanism relies on the definition of "associated with your products or services." When a business uses Meta Business Suite or similar tools to link their website to their social media profiles, they create a digital association between that domain and their Meta account. Under the new terms, this association serves as the legal basis for Meta to deploy automated software to crawl those linked domains.

Previously, such scraping permissions were often limited to specific features, such as optimizing ad creatives using generative AI. By consolidating these terms into the general commercial agreement, Meta expands the potential use cases. The term "develop" in the context of "business products" is interpreted by legal experts as sufficiently broad to encompass the creation and improvement of AI models, even if the word "train" is absent. This allows Meta to ingest content for analysis and feature development under the umbrella of maintaining and improving its advertising ecosystem.

Robots.txt files function as a voluntary standard where website owners indicate which parts of their site should not be accessed by automated crawlers. However, as noted by legal scholars, these files do not constitute a legally binding contract. Without explicit contractual language in the terms of service requiring compliance, Meta can technically ignore these signals without breaching the agreement, relying instead on the authorization granted by the business account holder.

Key details

• The revised terms remove the word "train" but retain permission to scrape content to "develop" advertising and business products.
• The new terms are set to go into effect on October 30, 2026, with no opt-out option for existing business accounts before that date.
• Legal experts note that the phrase "business products" is undefined and could reasonably include AI tools used for commercial purposes.
• Meta’s statement claims robots.txt preferences are respected, but the actual legal text lacks any clause enforcing this respect.
• The European Publishers Council, UK News Media Association, and US News/Media Alliance have publicly condemned the terms and called for regulatory intervention.
• Scraping permissions now apply to any domain associated with a business’s Meta presence, including Facebook, Instagram, WhatsApp, Threads, and Messenger.

Why it matters

For software developers and technical leads, this shift represents a significant change in how platform dependencies are managed. Linking a corporate website to a Meta business account is a common practice for analytics and marketing, but it now carries the implicit risk of granting broad data access rights. Engineers responsible for data privacy and intellectual property protection must recognize that standard technical barriers like robots.txt may not offer legal protection against platform partners who hold contractual scraping rights.

The ambiguity surrounding "business products" creates uncertainty for companies building their own AI solutions or protecting proprietary content. If Meta interprets "develop" to include model training, competitors could benefit from ingesting proprietary data without explicit consent beyond the initial business account linkage. This dynamic forces businesses to weigh the marketing benefits of Meta’s ecosystem against the potential loss of control over their web content.

What you can do

• Audit all domains currently linked to your Meta business accounts to identify sensitive or proprietary content exposed to scraping.
• Review your internal data governance policies to determine if linking websites to Meta platforms aligns with your IP protection strategy.
• Monitor official communications from Meta leading up to the October 30 implementation date for any further clarifications or opt-out mechanisms.
• Consult with legal counsel specializing in intellectual property and digital law to assess the specific risks posed by the "develop" and "business products" language.
• Consider implementing additional server-side protections or access controls for critical content, recognizing that robots.txt may not be enforceable in this context.
• Engage with industry trade associations like the News/Media Alliance to stay informed about collective legal challenges or regulatory responses.