Meta’s new commercial terms grant the company sweeping rights to scrape any website associated with your business profile to train its AI models. There is no opt-out button. Here is what the new rules actually mean for your business.
Starting October 30, 2026, Meta’s updated Commercial Terms grant the company sweeping legal permission to crawl, index, and train AI models on any external website linked to your business account.
Combined with the recent two-links-per-month limit, many creators now pay for a subscription just to let Meta harvest their sites for free.
A few weeks ago, Meta decided that a basic web hyperlink – the foundational building block of the open internet – should be treated like a paid luxury feature.
They introduced the Facebook two links a month limit, telling every unpaid Facebook Page owner that sharing a third link in thirty days requires opening your wallet for a monthly Meta One subscription.
We all thought that charging up to £400 a month just to paste your own web address was the peak of American corporate greed. We were wrong.
Now comes the second half of the trap. On October 30, 2026, Meta is rolling out a quiet, sweeping update to its Commercial Terms. When you put these two policies together, the sheer arrogance of Menlo Park takes your breath away.
First, Mark Zuckerberg forces you to buy a monthly Meta One subscription just to share links to your website. Then, the moment you paste those links, the new terms of service grant Meta legal permission to send automated bots to your website, bypass your login walls, and scrape your entire archive to train their artificial intelligence for free.
You are literally paying a multibillion-dollar advertising company a monthly fee so they can rob your digital house without paying for a licence. Does that sound like a healthy business partnership to you? Or does it sound like a protection racket run by people in fleece vests?
What do Meta’s new October 30 commercial terms actually mean for you?
Meta’s new Commercial Terms require anyone running a Facebook Page, Instagram professional account, WhatsApp channel, or Meta Business Suite dashboard to let Meta’s web crawlers harvest all content from their external websites.
There is no opt-out button. Your only choice is to accept the scraping or stop using Meta for business.
Until now, the unwritten rule of social media was already bad enough. We accepted that anything we uploaded directly to Facebook or Instagram – our photos, captions, and comments – would eventually be fed into Meta’s machine learning algorithms.
That was the price of sitting inside their walled garden. Keep your best work on your own domain, we told ourselves, and only put teasers on Facebook.
As discovered in recent analyses by Nieman Lab and Ars Technica, Meta is now reaching right over the garden wall. The new rules say that simply having a business presence on Meta gives them the right to follow your links back to your independent website and take whatever they find there.
Why is Meta doing this right now? Because training large language models like Llama requires oceans of human writing, and the legal bills are coming due.
Right now, major news organisations and book publishers are dragging OpenAI and Meta through federal courts over copyright infringement. In a normal market, tech giants have to pay millions of dollars in licensing fees to train AI on professional journalism and archives.
Meta looked at those multimillion-dollar licensing fees and thought: why pay for the cow when we can force the farmer to sign over the milk in page fourteen of our terms of service?
As Matt Topic, a media and intellectual property attorney at Loevy & Loevy, told Nieman Lab, burying this provision in the terms of service gives Meta free access to material that would normally cost millions in a licensing market.
And while legal analysts are rightly worried about major newspapers, make no mistake about who else is in the crosshairs. Virtually every independent blogger, local craft shop, photographer, indie author, and small business uses Meta Business Suite or a Facebook Page.
If you use a Page to tell customers when your bakery opens, or to share your latest essay, you are bound by these Commercial Terms. Can you click a button to decline this website scraping?
Of course not. Meta’s notice states it with cold corporate simplicity: “If you do not agree to the updated terms, please stop all access or use of our Products for business or commercial purposes.”
| Feature or right | Old Meta business reality (pre-October 2026) | New Meta reality (from October 30, 2026) |
| Sharing outbound links | Unlimited free links (though algorithmically suppressed). | Capped at 2 links per month unless you pay for Meta One (£12 to £400/month). |
| Scope of AI data training | Restricted mostly to posts, photos, and videos uploaded directly to Meta apps. | Expanded to include your external website, subpages, and linked URLs. |
| Website crawling consent | Limited to specific ad-generation tools or e-commerce seller catalogues. | Mandatory for all business accounts across Pages, Groups, Ads, and Business Suite. |
| Bypassing login walls | Crawlers only saw publicly visible landing pages. | You authorise Meta to create “test credentials” (fake accounts) to crawl behind registration walls. |
| Opt-out mechanism | Simply avoid using generative AI ad features. | None. Leave Facebook, Instagram, and WhatsApp business tools entirely. |
What does the exact legal text say – and how is Meta spinning it?
The updated Commercial Terms explicitly authorise Meta to deploy bots and create “test credentials” to crawl any domain associated with your business or shared by users, using that data to “train” Meta products. Despite Meta’s spokesperson claiming this merely “consolidates” old rules, legal experts warn it is an aggressive expansion of power.
Corporate lawyers love writing sentences so long that normal human beings fall asleep before reaching the verb. Do not let them bore you into submission. Read the exact passage from Meta’s Commercial Terms preview that takes effect on October 30:
“You authorize us (or any entity acting on our behalf) to use automated software (such as web scrapers, bots, robots, spiders, crawlers, and user agents) and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl the domains, web pages, or URLs (and any content available through them) that are associated with your products or services, or that are made available through your or users’ use of Meta Company Products and services, and to periodically pull updates from such domains, web pages, or URLs. Meta may use any content from such domains, web pages, or URLs to provide, develop, improve, research, train, and maintain the integrity of, the Meta Company Products, services, and features provided under these Commercial Terms and any other applicable supplemental terms.”
Let us translate this Menlo Park dialect into plain English.
First, notice that the word “AI” does not appear in that paragraph. Instead, they slip in the single word “train”. Elsewhere in Meta’s legal labyrinth, they conveniently define “AI at Meta” as one of the company’s core products. By agreeing to let them “train” their products on your website, you are signing a blank cheque for their AI models.
Second, look at the phrase “create test credentials”. What on earth does that mean for a small publisher or membership site?
As James Grimmelmann, a professor of digital and information law at Cornell Law School, pointed out to Nieman Lab, this clause technically gives Meta permission to sign up as a fake user on your website to bypass registration walls and scrape content you locked behind a login.
When journalists asked Meta if these “test credentials” would be used to jump over paywalls, Meta simply refused to answer. Instead, a Meta public affairs spokesperson sent out a masterclass in gaslighting:
“Language around crawling was previously scattered across different terms of use, including terms about using generative AI in ads, and this update consolidates them in one place… Content owners can still manage how their content is accessed by using robots.txt.”
Another spokesperson told Ars Technica that “there is no change to how Meta uses web crawlers” and called any suggestion to the contrary “false”.
How honest is that statement? When Ars Technica actually checked the old documents, they found that crawling permissions were previously strictly limited. If you used Meta’s generative AI tool to build an advertisement, you let Meta crawl your landing page for the sole purpose of making that ad. If you used their e-commerce Seller Agreement, they checked your URL to optimise your shop listing.
Now, Meta has taken a tiny permission meant for optional ad tools and forced it onto every single business account to train their entire company’s product line. Calling that “consolidation” is like a burglar telling the police he is merely consolidating your television into his van.
Even worse, Professor Grimmelmann warns that on the broadest reading, Meta could train its AI on your site and then deploy that content directly on Meta platforms in competition with you.
Imagine running a niche travel blog or a specialist repair website. Meta scrapes your ten years of careful guides. Next month, when a user asks the Meta AI search bar a question on Facebook, the bot spits out your exact knowledge inside the blue app – while restricting you to two links a month so you cannot even get the visitor.
In antitrust law, as University of Wisconsin law professor Benjamin Sobel noted, this is called “tying”. Meta uses its monopoly over social distribution to force you into handing over an unrelated asset – your website’s data.
Common fears and questions: what happens to your website now?
When a tech giant changes the rules by force, small business owners and creators naturally start looking for defensive loopholes. Having watched how platform anxiety works for over two decades, I know the exact questions running through your head right now. Let us go through them honestly, without the corporate PR spin.
1. Will Meta or Facebook own the copyright to my works under the new TOS?
No, Meta does not take legal ownership of your copyright, so you remain the rightful owner of your articles, photographs, and products. However, by agreeing to the Commercial Terms, you grant Meta a sweeping, royalty-free licence to copy, analyse, and train AI models on your work without paying you a penny.
People often confuse copyright ownership with licensing. Meta does not want to own your copyright – ownership comes with liability and paperwork.
What Meta wants is much smarter and more cynical. They let you keep the shiny paper title to your work while forcing you to grant them permanent, free permission to extract all the commercial value from it. You still own your book or your blog post, and you can still sell it elsewhere. You just cannot sue Meta for copyright infringement when their bots swallow your work whole, because their lawyers will point to the October 30 terms and say: Look, Your Honour, they authorised us to do it.
2. What happens if I remove my website’s domain from my Facebook About page?
Removing your domain from your Facebook Page’s “About” section is not enough to revoke scraping permission on its own. The terms cover any URLs associated with your products or made available through your or other users’ use of Meta services, including links in posts, stories, bios, and messages.
Many creators think that deleting yourwebsite.com from the contact field on their Page profile before October 30 will sever the legal link. Unfortunately, Meta’s lawyers wrote the net much wider than a single profile box.
Look back at the wording: the terms apply to domains and URLs “that are associated with your products or services, or that are made available through your or users’ use of Meta Company Products”.
If you delete your domain from the About tab, but your Page still exists and you occasionally share a link, or your followers paste links to your articles in the comments, or you mention your URL on Instagram or WhatsApp Business, the legal hook remains active.
3. Will Meta scrape my entire site based on links I shared in the past, even if I remove my domain today?
Technically, Meta’s crawlers already have your domain mapped from every link you shared over the past fifteen years. However, the new legal permission to scrape your site for AI training only binds you if you continue using Meta’s business tools on or after October 30, 2026.
This is the fear that keeps independent publishers awake at night. If you shared five hundred blog posts on your Facebook Page between 2014 and 2026, those URLs are permanently stored in Meta’s social graph. You cannot un-ring that bell.
Here is the legal distinction: Terms of Service are not a time machine unless you stay in the seat. Meta states that if you do not agree to the new terms, you must stop using their products for commercial purposes before October 30.
If you shut down your business account or convert away from commercial tools before the deadline, you do not enter into the October 30 contract. However, if you keep your Facebook Page open on October 31 – even with an empty About section – Meta can argue that every historical post sitting on your Page timeline is a URL “made available through your use of Meta Company Products”. And notice how the clause grants permission to crawl “the domains, web pages, or URLs”. Sharing a single subpage URL gives them contractual cover to crawl the root domain.
4. If I replace my website domain with a Linktree (or similar link directory), will Meta freely scrape all domains listed inside it?
Yes, using a Linktree or bio-link directory as a shield on an active business account will not stop Meta from scraping your destination websites. Because the terms cover any content “available through” your provided URLs, and your destination domain remains “associated with your products or services”, the legal permission passes straight through.
Let us look closely at this popular workaround. The logic makes intuitive sense at first: I will remove my domain from Facebook, put a linktr.ee/myname link in my bio instead, and let Linktree take the hit from Meta’s bots.
From a purely contractual and technical perspective, Does this fix the problem if you keep running a Meta Business account? No. Here is why the Linktree shield leaks:
- The “associated with” trap: The new terms allow Meta to crawl domains “that are associated with your products or services”. Notice it does not say “domains typed directly into the Facebook website box.” If you run a Facebook Page for Smith’s Leathercraft, and your Linktree points to
smithsleathercraft.com, that domain is undeniably associated with your products and services. - The “available through” clause: The terms explicitly grant permission to crawl the URLs you provide (and any content available through them). A web spider takes less than ten milliseconds to parse a Linktree page and follow the outbound
<a href>links to your real website. - User-shared links: Even if you only ever post a Linktree URL, what happens when a single reader shares one of your actual articles on Facebook or sends it via Messenger? Under the terms, that URL was “made available through… users’ use of Meta Company Products”, and because you hold an active business account, you have already signed away your right to object.
When is a Linktree or static directory actually useful? Only when you combine it with closing your commercial Meta presence (switching to a personal ghost profile) and hardening your server’s robots.txt firewall. We will break down how to do that in the next section.
5. What if I stop posting myself, can Meta still scrape my website if my readers share my links on Facebook?
If you maintain an active Meta business account after October 30, yes. The updated terms explicitly cover URLs made available through “users’ use of Meta Company Products”. If you do not have a Meta business account, a random reader sharing your link cannot legally bind your website to Meta’s commercial contract.
Think about how sneaky that phrasing is: “your or users’ use”.
If you completely abandon Meta and delete your Business Suite and Pages before October 30, you are no longer a party to Meta’s Commercial Terms. Basic contract law applies here: a stranger pasting your blog post onto their personal Facebook wall cannot sign a legal contract on your behalf.
But if you keep a dormant Facebook Page alive “just in case”, you remain bound by the Commercial Terms. Every time a loyal reader shares your latest article on Facebook or Instagram, that act triggers your contractual consent for Meta to crawl the link and pull updates from your domain.
6. Will blocking Meta in robots.txt actually protect me, or do the new Terms of Service override it?
Right now, Meta claims its crawlers still respect robots.txt instructions. However, legal experts warn that by agreeing to the October 30 Commercial Terms, you are handing Meta a signed contract that could legally supersede your robots.txt file in court if Meta decides to ignore it later.
A robots.txt file is not a solid steel door. It is a polite “Please keep off the grass” sign placed at the edge of your lawn.
Today, Meta’s spokesperson tells Nieman Lab that publishers can still manage access using robots.txt. That sounds comforting until you ask a simple question: If Meta intends to respect robots.txt forever, why did their lawyers force millions of businesses to sign a binding contract explicitly authorising automated spiders and fake test credentials?
If you put a “No trespassing” sign (robots.txt) on your lawn, but then you sign a written contract with your neighbour saying “You are authorised to walk across my lawn whenever you want” (the Commercial Terms), guess which document wins in front of a judge?
7. Does this affect me if I only use a personal Facebook profile and never touch Meta Business Suite?
The Commercial Terms specifically govern business and commercial use of Meta products – such as running Pages, managing business groups, buying ads, or using Meta Business Suite and WhatsApp Channels. Standard personal profiles fall under Meta’s regular Terms of Service, unless you use a personal profile for commercial marketing.
If you are just an ordinary person sharing holiday snaps with your cousin, you are governed by the consumer terms (where Meta already scrapes your uploaded photos, unless you live in the EU or UK and successfully fought through their buried opt-out forms).
However, if you switched your personal profile to “Professional Mode” (which turns your personal account into a creator dashboard with analytics and monetisation), or if you are an admin on a company Page, you are standing squarely inside the blast radius.
Possible ways to stop Meta from scraping your website
To stop Meta from scraping your website after October 30, you must close your business account to revoke legal consent, block Meta’s crawler bots inside your robots.txt file, and activate a server firewall like Cloudflare to reject automated scrapers.
Simply hiding your domain behind a Linktree page while keeping an active business profile will not protect you, because Meta’s terms cover any domain associated with your business or shared by your readers.
Meta’s lawyers wrote the new rules as an ultimatum: accept the scraping, or stop using Facebook, Instagram, and WhatsApp for business. If you want to keep Mark Zuckerberg’s bots out of your server, half-measures will not work.
1. Update your robots.txt file (and add a real firewall)
Meta’s spokesperson insists that site owners can still control access using a robots.txt file. That is a simple text file on your server that tells bots to stay away. You should definitely add rules blocking meta-externalagent and FacebookBot today.
Do not trust a text file alone, though. A robots.txt file is just a polite “no trespassing” sign on your lawn. As legal experts warn, signing Meta’s new commercial terms might give the company a legal excuse to ignore that sign completely.
Put a real lock on the door by placing your website behind a free firewall like Cloudflare and turning on the toggle that blocks all known AI scrapers at the server level.
2. Watch out for fake user registrations
One of the sneakiest phrases in the new terms gives Meta the right to create “test credentials” on your site.
In plain English, you are giving Meta permission to register fake user accounts to slip past your registration walls or member-only sections. If you run a forum, a private newsletter archive, or a digital shop, turn on strict email verification and human security checks (like Turnstile) on your sign-up forms.
3. Walk away from Meta business tools
If you are tired of playing defence against a trillion-dollar company that treats your hard work like free AI food, take Meta’s own advice and leave.
As we covered in our look at why you should leave Facebook in 2026, staying on a decaying platform costs more than it brings back. Check our guide on three practical ways to leave Facebook to turn your profile into a quiet signpost and move on.
Conclusions
Take a step back and look at the deal Menlo Park is offering you right now.
First, they choke your organic reach and ask you to pay a monthly Meta One toll just to paste more than two links to your own website. The moment you pay up and share that third link, they claim the legal right to send bots to scrape your entire domain for free AI training.
Does paying an American tech monopoly so they can feed your life’s work into a machine built to replace you sound like a fair trade?
Silicon Valley executives call this “streamlining” their agreements. They hope you are too tired or too dependent on their walled garden to push back. They assume you will swallow every new rule because you are afraid of losing the audience you spent years building on their rented land.
What is the point of keeping a Facebook Page alive if the price of admission is handing your server over to Mark Zuckerberg’s crawlers?
Leave a Reply