The short version: Meta’s updated Commercial Terms take effect October 30, 2026, and they govern every business that uses Facebook, Instagram or WhatsApp for work. The coverage this week says the new terms let Meta crawl your website and “train” its products on it, with no way out. We read the crawl clause on Meta’s own preview page on October 16. The clause never uses the word “train,” or “AI.” The stated purpose is Meta’s advertising and business products, plus security. That narrower wording can still reach Meta’s AI business agents, and the clause adds a permission most coverage skipped: Meta may create test logins to reach your pages. The control you actually have sits in a different Meta document. Its crawler page names one bot, meta-externalagent, whose job is training foundation AI models, and one line in your website’s robots.txt file turns it away without touching your Facebook link previews.
The story broke through Nieman Lab, which asked three legal experts about the clause and framed it around newsrooms, nearly all of which run a Meta business account. The same clause applies to the plumber with a Facebook Page, the bakery that runs Instagram ads and the salon that books through WhatsApp Business. If your page links to your website, this is about your website.
What do Meta’s October 30 Commercial Terms actually say?
The current Meta Commercial Terms carry an effective date of March 6, 2024, and a banner announcing the update. The new version lives on a separate preview page dated October 30, 2026. The new language sits under the heading “Licenses & Rights You Provide Meta,” and the crawl sentence opens with “You authorize us.”
In plain terms, you authorize Meta, or anyone acting for it, to use automated software (the terms list “web scrapers, bots, robots, spiders, crawlers, and user agents”) to access, index, cache and crawl the domains, pages and URLs “associated with your products or services,” and to “periodically pull updates” from them. The purposes are spelled out: to provide, develop, improve, research and maintain “advertising and business products,” and to keep Meta’s products secure.
Two phrases in that sentence matter more than the headlines suggest.
“Create test credentials.” The authorization covers using automated software “and create test credentials to access” your pages. If your site has a login, such as a customer portal, a member area or a booking account, the terms permit Meta to make an account to get behind it. We found no Meta documentation describing when or how it does this. It is worth knowing the permission exists before a sign-up with an odd name appears in your customer list.
“Made available through your or users’ use.” The clause does not stop at the website on your Page. It also reaches URLs made available through your use of Meta’s products or your customers’ use of them. A link a customer drops in a comment or a WhatsApp chat fits that description.
Does the clause let Meta train AI on my website?
Not in those words. On October 16 we searched the preview page for “train,” “training,” “AI at Meta” and “opt out.” None of them appear. Several outlets reported that the terms let Meta “train” its products. That word is not on the page Meta published. Reports that “Products” includes “AI at Meta” may trace to the separate Meta Products help page the terms link to for their definition, which did not load for us, so we cannot confirm or rule that out.
That does not make the experts’ concern wrong. The terms bring in Meta’s AI business tools by reference, including the Meta Business Agents and Platform Terms and the Meta AI Business Assistant Supplemental Terms. “Develop” and “improve” business products, when the business products include AI agents that answer customers, is wide enough to cover AI work without the word ever appearing. Matt Topic, a media and IP attorney at Loevy & Loevy, told Nieman Lab that publishers should assume the clause would be enforceable, even though it is unclear whether a court would agree. Meta has described the update as a consolidation of existing terms that does not change how it crawls.
Read narrowly, the contract is about ads and business products. Read broadly, it is a license with room in it. Plan for the broad reading, because the clause offers no carve-out: the only exit the terms describe is to stop using Meta’s products for business.
How do I block Meta’s AI training crawler?
This is where a small business has more control than the coverage implies. Meta publishes a web crawlers page listing its bots by name, and each one has a different job. Read on October 16, it lists five:
- facebookexternalhit fetches your title, description and thumbnail when someone shares your link. Block it and your posts lose their previews. Meta says it may bypass robots.txt for security checks.
- meta-webindexer improves search results for Meta AI. Meta says allowing it helps Meta AI cite and link to your content in its answers.
- meta-externalads crawls for advertising and other business products, the same purpose the new clause names.
- meta-externalagent crawls “to train foundation AI models” or to index content directly. This is the training bot.
- meta-externalfetcher fetches a page when a user asks Meta’s AI to, and Meta says it may bypass robots.txt because the request comes from a person.
To turn away the training bot and leave the rest alone, add these two lines to the robots.txt file at the root of your site:
User-agent: meta-externalagent
Disallow: /WordPress, Wix and Shopify all let you edit robots.txt, through a setting, an SEO plugin or a template file. Meta’s page says its crawlers may cache your robots.txt for up to 24 hours, so give it a day before you check your server logs.
What robots.txt cannot do
A robots.txt line is a request, not a contract. It tells a well-behaved crawler to stay out; it does not take back the license you grant by using Meta’s products for business after October 30. Meta has told reporters that content owners can still use robots.txt to state their preferences, and its own crawler page shows the rule above. Meta says two of its five bots may skip robots.txt in some cases, and neither is the training crawler.
If your website content is your product (original recipes, a paid course, years of how-to guides), robots.txt is the floor, not the ceiling. A written carve-out is the only thing that changes the contract, and that is a conversation for your lawyer before October 30, not after.
Should a small business leave Meta over this?
For most owners, no. Facebook and Instagram are where customers find you, and the crawler list shows the choice is finer than stay or go. You can let Meta AI cite and link to your services through meta-webindexer, which can send people your way, while turning away the bot that trains foundation models. Being found by AI and being used to build it are separate switches, and Meta’s own documentation hands you both.
This is the same trade we saw when Meta priced its models in dollars or data, and the same lesson as the Personal Agent Protocol defaults on Shopify: the settings that decide how AI uses your business are already set, and most of them are set to yes. If you use Meta’s AI to answer customers, our guide to Muse for Small Business approvals covers the other half of the relationship.
Frequently Asked Questions
When do Meta’s new Commercial Terms take effect?
October 30, 2026. The preview page carries that effective date, and the only exit the terms describe is to stop using Meta’s products for business. Keeping your Page, ads or WhatsApp Business account running after that date means you have accepted them.
Do Meta’s new Commercial Terms say Meta will train AI on my website?
Not in those words. On October 16, 2026, the preview page did not contain “train” or “training.” The crawl clause names advertising and business products and security as its purposes, but Meta’s business products now include AI agents, so the wording is broad enough that you should plan as if AI use is covered.
Will blocking meta-externalagent hurt my Facebook posts?
No. Link previews come from a different crawler, facebookexternalhit, and citations in Meta AI answers come from meta-webindexer. A robots.txt rule naming only meta-externalagent leaves both of those working, and Meta says the change can take up to 24 hours to apply.
Does robots.txt cancel the license in Meta’s terms?
No. Robots.txt is a request that well-behaved crawlers follow, and Meta says it still honors those preferences, but it does not change the contract. If your website content is what you sell, ask a lawyer about a written carve-out before October 30.
Does your website have anything on it you would not want inside an AI model, and had you ever thought of your Facebook Page as the thing that decides that?
