Did Meta really drop its AI scraping terms for good?

What did Meta remove from its commercial terms?

Meta deleted a sentence from its updated commercial terms. That sentence said it could use any content from websites linked to business accounts to "provide, develop, improve, research, train, and maintain the integrity of" its products. The edit came on October 17, 2026, less than two weeks before the new terms take effect on October 30. The first draft went a long way. It let Meta, or anyone acting for it, use scrapers, bots, spiders and crawlers to access, index, cache and collect content from domains tied to businesses on Facebook, Instagram, WhatsApp and Messenger. It even let Meta create test credentials to get in.

The backlash started when three legal experts read the clause and said it could be used to argue that Meta may train its AI on news sites. One law professor said that for news publishers, it clearly gave Meta permission to train AI on their content. Meta's head of communications called that reading false. The company said the update was about pulling accurate product information from sellers' websites for ads and recommendations inside its apps. It also said the crawling rules apply only to its advertising and business products and that its crawlers would behave the same as before. Its statement said the update was "not about scraping news sites" and didn't give Meta new rights that override site owners' robots.txt preferences.

Here's our take: the edit is real, but it's small. The word "train" is gone, and the uses are now tied to advertising and business products. The right to crawl hasn't changed at all. You still accept the terms just by continuing to use Meta's apps for business after October 30, and the only way to refuse is to stop using them for business. The bigger lesson isn't about one word. Terms that can be rewritten in two weeks under public pressure can also be rewritten later with much less attention. If your business depends on a platform, keep a dated copy of the terms you agreed to and check the changelog now and then. It takes ten minutes, and nobody else will do it for you.

What do Meta's terms still allow for small businesses?

Meta can still use automated tools to crawl websites linked to your business on its platforms. It can use what it collects for its advertising and business products. The revised terms also define "business use" broadly. Running a Page, sending marketing messages, keeping a product catalogue, and using Ads Manager or Meta Business Suite all count. So if you run a bakery with a WhatsApp catalogue, or a consultancy whose Instagram bio links to your site, you're covered. That's the part of the story that matters to you. You're probably not a news publisher, but your homepage, price list and product descriptions are exactly what these crawlers are built to collect.

That isn't automatically bad. If you sell online, you probably want Meta to show accurate prices in ads rather than last season's numbers. The problem is that "advertising and business products" is a wide category. You have no say in how that category grows over time. One analysis of the change pointed out that removing the clause doesn't, on its own, prove that every kind of automated website access has been taken out of Meta's contracts. So read the revised terms as a narrower promise about what Meta does with the data. They're not a promise that nothing gets collected. If something on your site shouldn't feed someone else's ad system, don't count on a contract clause to protect it.

You can still act through your robots.txt file, which tells crawlers what they may and may not read. Meta documents separate crawler tokens for AI training and for Meta AI search. Its AI training crawler is called meta-externalagent. Meta says it respects these preferences and that the new terms don't override them. If your website builder lets you edit robots.txt, it takes a few minutes. If it doesn't, ask whoever manages your site. We've written up how to block Meta's AI crawler step by step, including which pages most small businesses should leave open so their ads keep working.

Does Meta train AI on what you share through WhatsApp Business?

The clause in the news applies to websites, not your WhatsApp chats. Personal WhatsApp messages are end-to-end encrypted, and Meta has said publicly that it doesn't use the content of private messages to train its AI. What you type to Meta AI is a different matter. Meta treats that as a conversation with its AI, not a private message between two people. So the rule of thumb is simple. A message to your supplier is protected by encryption. A question you put to an AI chatbot is shared with whoever runs that chatbot. That's true whether the AI belongs to Meta or to anyone else.

The question gets harder when a third tool joins the conversation. When you add an AI assistant to a group, or forward it a PDF, that assistant can read whatever you send it. Encryption protects messages while they travel between phones. It doesn't stop the recipient from reading them, and an AI assistant you message is a recipient. This isn't a reason to panic. It just means each assistant you use is a separate trust decision. If an assistant sits in your team group, it can see your team's messages too, and they never agreed to that. We cover the consent side of AI in group chats in more detail, including a few simple rules to follow before you add one.

Here's the contrarian view: for most small businesses, Meta crawling your homepage is the smaller risk. Your website is public by design. The real exposure is the stuff you forward without thinking twice. Picture sending "Summarise this lease and flag the break clause" with a twelve-page PDF attached. That PDF has your landlord's name, your rent, your guarantor's details and maybe a bank account number. An invoice you forward to check the totals shows supplier pricing you've worked hard to negotiate. None of that is on your website. All of it ends up wherever your AI assistant stores it. So that's where your privacy questions should start.

What should you ask an AI assistant before handing it business admin?

Before you trust an AI assistant with your admin, ask it five things. What does it read? What does it keep, and for how long? Does it train on your content? Can it act without your approval? Whose name does it use when it contacts people? A good assistant answers all five in plain words. Fuzzy answers are an answer too. Ask before you forward anything sensitive, not after. Once a contract is in someone else's system, deleting it there depends on their policy, not on you. And whatever's in the marketing copy, the privacy policy is the document that counts.

Start with reading and keeping. Some assistants only see the messages you send them. Others want access to your inbox, your calendar or your whole chat history. Less access is better unless you have a real reason to grant more. Then ask about memory. An assistant that remembers your preferences is useful, but you should know what it's storing and how to check. Training comes next. Does your content help improve someone's model, and can you opt out? These questions apply to cloud assistants and local ones alike. We compare the two in our guide to running admin on a local model or a cloud assistant, including what each one can't do.

The last two questions matter most once an assistant starts doing things for you instead of just answering. Can it send messages, book things or reply to people on its own? Does it show you a draft first, or only report back afterwards? When it contacts someone, does it pretend to be you, or does it say it's your assistant? An assistant that messages your clients from your own number in your voice can damage a relationship with one bad sentence. If you want a longer list for agents that act on your behalf, we've put together a plain-English trust checklist that sorts tasks into the ones you can delegate freely and the ones that need your sign-off every time.

How does Agent Sonic answer those questions?

Agent Sonic reads what you send it in WhatsApp, and that's all. It sees your messages, your voice notes, and the PDFs, contracts, invoices and spreadsheets you forward. In a group, it sees the groups you add it to. Send it "Summarise this lease and flag the break clause" with the PDF attached, and you'll get the key terms, dates and risks back in the same chat. Our page on reading a contract in one WhatsApp message shows what that looks like. Sonic also has a memory you control. Say "Remember our VAT number is…" and it keeps that note. Ask "What do you remember about the Cohen account?" and it tells you what it has saved.

Acting on your behalf is where Sonic is most careful. With outreach tasks, Sonic messages people for you, for example "Ask Dana when the invoice will be ready and let me know." Before anything goes out, it shows you the exact first message, and nothing is sent until you reply "yes." It writes from its own WhatsApp number and always introduces itself as your assistant. It never pretends to be you. It follows up at most once if an answer is vague, and it never contacts anyone who has said stop. Outreach is a Pro feature in Beta that may be paused from time to time. It's limited to one task at a time and up to 3 people a day. The outreach tutorial walks through the whole flow.

As for retention and training, we're not going to summarise a privacy policy for you in one line on a blog. That's the kind of shortcut this article warns against. If you plan to forward leases, payroll sheets or client contracts, ask us directly what's stored, for how long, and what happens to it. Hold us to the same five questions you'd put to Meta or anyone else. If you like the answers, get access to Sonic: leave your details, and you'll get Sonic's number and a short onboarding. After that, it's just another WhatsApp contact. There's nothing to install and no dashboard to check. Your first message can be as simple as "Remind me to check Meta's terms again on November 1."

Frequently asked questions