Meta to scrape business websites for AI training under new terms
Meta’s October 2026 commercial terms update grants the company rights to crawl and use website content from business customers for AI model development.
Key points
- New commercial terms take effect on October 30, 2026, allowing Meta to scrape associated business websites.
- The definition of "business customer" is broad, covering ad users, app developers, and page managers.
- The News/Media Alliance states there is no opt-out mechanism for this data collection.
Meta plans to implement changes to its commercial terms that grant the company the right to scrape websites associated with its business customers. According to Security Affairs, the new language takes effect on October 30, 2026. The update allows Meta to collect content from these domains to train artificial intelligence models and improve its products, a move that affects every company advertising or selling through its platforms.
The updated contract explicitly authorizes Meta to use automated tools to access, index, and analyze web pages linked to customer services. Meta defines "business customer" broadly, including anyone who uses ads, sells products, develops apps, manages a Page, or runs a business Group. This definition encompasses users of tools such as Ads Manager and Meta Business Suite, meaning the scope of affected entities is extensive.
Scope of Data Collection
Meta’s commercial terms specify that the company can use web scrapers, bots, spiders, crawlers, and user agents to access domains associated with customer products. The agreement permits Meta or its partners to create test credentials to retrieve content and periodically pull updates from these sites. The collected material may be used to provide, develop, improve, research, train, and maintain the integrity of Meta’s products and services.
The News/Media Alliance highlights that there is no way for customers to opt out of this arrangement. Nieman Lab notes that almost every news publisher has at least one Meta business account, suggesting widespread exposure. At least one million businesses already use Meta’s AI agents in WhatsApp and Messenger, indicating a growing integration of these services into daily operations.
Impact on Business Customers
The broad definition of a business customer means that many organizations will be subject to these scraping rights without explicit consent for each action. The terms allow Meta to revisit sites regularly to collect updates, ensuring a continuous stream of data for its AI training purposes. This includes content available through the use of Meta Company Products and services, extending the reach of the data collection beyond static pages.
The lack of an opt-out clause raises concerns for organizations that wish to control their digital footprint. The News/Media Alliance emphasizes that the current contractual language leaves no room for negotiation or exclusion. This situation affects a wide range of entities, from small businesses using ads to large publishers managing multiple accounts.
What should you do?
Organizations should review their current Meta business accounts and assess the content exposed on associated domains. Security teams should monitor for unauthorized access or scraping activity that may violate existing security policies. Legal departments should evaluate the implications of the new terms on data privacy and intellectual property rights. Companies should also consider implementing technical controls to limit the exposure of sensitive information on public-facing pages.
What to do and how to stay safe: Meta
- Audit all web domains associated with Meta business accounts to identify sensitive content that may be scraped.
- Review current security policies to ensure they address the risks of automated data collection by third parties.
- Consult legal counsel to understand the implications of the new commercial terms on data privacy and compliance.
- Implement technical measures such as robots.txt directives or access controls to limit exposure, though these may not override contractual terms.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When do Meta's new commercial terms take effect?
The new commercial terms take effect on October 30, 2026.
Who is considered a business customer under the new terms?
A business customer includes anyone who uses ads, sells products, develops apps, manages a Page, runs a business Group, or uses tools like Ads Manager or Meta Business Suite.
Can businesses opt out of having their websites scraped?
No, the News/Media Alliance states there is no way out, and the terms do not provide an opt-out mechanism.
