Do Meta's new terms let it train AI on your website?

What do Meta's new terms say about training AI on your website?

Meta's updated Commercial Terms take effect on October 30, 2026. They give Meta permission to crawl websites associated with any business that uses its platforms commercially, and to use what it collects to develop, improve, research and train its products, AI included. If you run a WhatsApp Business account, an Instagram shop or a Facebook page with ads, that very likely means you. The clause got attention in mid-October, when a journalism trade outlet asked three legal experts to read the new wording. They agreed it plausibly lets Meta scrape news sites and other business websites for AI training, with no licensing fee and no opt-out button. Meta told businesses about the update earlier in October in a blog post and a notice inside Meta Business Suite. Few people read either.

The wording is wide. Businesses authorize Meta, or anyone acting for it, to use automated software such as scrapers, bots, spiders and crawlers. That software can access, index, cache, analyze, collect, retrieve and crawl the domains, pages and URLs associated with their products or services, and come back regularly for updates. The terms also mention creating "test credentials". One law professor said that could technically let Meta sign up as a user to get past a registration wall. Meta wouldn't say whether that includes paywalled content. The old terms were much narrower. They covered website links supplied with ads and tied their use to advertising. The new version cuts that tie and reaches anything "associated" with what you sell, which is a much bigger net.

Meta says nothing dramatic is happening. It told reporters the update only consolidates existing language, doesn't change how it crawls publishers and keeps robots.txt controls in place. That's reassuring as far as it goes. But terms of service outlast press statements, and a lawyer reads the contract, not the quote. The real catch is the exit clause. If you don't agree, Meta says you should stop all access to or use of its products for business or commercial purposes. You can't accept the rest and turn down the crawling. For a bakery that takes half its orders over WhatsApp Business, "just leave" isn't a real option. That's why the practical details below matter more than the outrage online.

Which websites count as "associated" with your business?

The terms don't include a tidy list. The honest answer is that any domain or page tied to the products or services you promote on Meta's platforms is probably covered. In practice that most likely includes the website in your Instagram bio or on your Facebook page, the landing pages your ads point to, product links in a catalog or shop, and any URL in your WhatsApp Business profile or marketing messages. The exact phrase is "domains, web pages, and URLs associated with your products or services", which is broader than "links you gave us". Your blog, a price list you host as a PDF, or a booking page on another platform could arguably count too. A plain reading says they're all associated with what you sell.

The clause applies to business use. Meta's commercial terms cover accounts that manage pages and groups, run ads, send marketing messages or use the business dashboard on Facebook, Instagram, WhatsApp and Messenger. A personal profile full of holiday photos isn't the target. A WhatsApp Business account that your florist uses to confirm orders and send "Your bouquet is ready" messages almost certainly is. This is the part most small business owners miss. You don't have to spend a cent on Meta ads to fall under its commercial terms. If you keep managing your page or business account after October 30, you're accepting the new rules, whether or not you ever opened the notice about them.

Publishers are protesting loudest, and with good reason. Their content is their product, and AI answers built on it can compete with them directly. A European publishers' group has already asked the European Commission to step in. But the same clause also covers the dental clinic with a detailed pricing page, the consultant whose blog took years to write and the online shop with original product photos and descriptions. If your business's value sits on your website as menus, recipes, how-to guides or detailed price lists, assume Meta can read it and use it. If your site is a contact form, a map and three photos of the shopfront, the stakes are much lower, and your attention is better spent elsewhere.

Can you block Meta from using your website for AI training?

Partly. You can tell Meta's AI training crawler to stay off your site in your robots.txt file, and Meta says it will keep following those instructions. What you can't do is opt out of the terms and keep using its business tools. The crawler that collects content for AI training identifies itself as meta-externalagent. Add two lines to the robots.txt file at the root of your site: "User-agent: meta-externalagent" and then "Disallow: /". That asks the crawler to skip every page. Most website builders let you edit robots.txt in their SEO or advanced settings, and a web developer can do it in five minutes. It's the cheapest and fastest step in this article, so do it this week, before the October 30 deadline.

Don't block everything with Meta in the name, though. Link previews come from a separate crawler called facebookexternalhit. That's the little card with an image and a title that appears when someone shares your URL on WhatsApp, Facebook or Instagram. Block it and your links show up as bare text every time a customer forwards your menu to a friend. Guides to Meta's bots also list FacebookBot and meta-externalfetcher. The second one fetches a page when a user asks Meta's AI about a specific link. Blocking it is a judgment call. It keeps your pages out of AI answers, including answers that might have sent you a customer. These are the same trade-offs other sites face when deciding whether to shut AI agents out.

The uncomfortable part is that robots.txt is a polite sign on the door, not a lock. Legal experts warned that Meta could argue its commercial terms, which you've agreed to, override a blocking instruction in a text file. Meta says that's not its plan, and the question may never reach a court. For a firmer line, your host or content delivery network can reject any request whose user agent contains "meta-externalagent" and return an error instead of the page. Is that worth the hassle? For most small businesses, no. A robots.txt rule plus a hard look at what you publish covers most of the risk without the complexity. Save server-level blocking for when your content really is what you sell.

What should a small business do before October 30?

Set aside an hour for four things: read the clause yourself, add the robots.txt rule, check what's public on your site, and decide whether anything should come down. Start with the reading. Open the notice in Meta Business Suite or the update in Meta's business help center and find the section on crawling associated websites. You don't need a lawyer to get the gist. If your content is your income, as it is for publishers, course creators and photographers, an hour with one is cheap insurance. If legal language makes your eyes glaze over, you can have a WhatsApp assistant read the contract for you and send back the key terms in plain English. Then add the robots.txt rule and open the file in a browser to check it's live.

Next, look at your website the way a crawler would. Anything public is fair game. Go page by page and ask whether you'd be comfortable seeing it summarized in somebody else's chatbot. Look for staff names and direct mobile numbers, old price lists you no longer honor, client proposals uploaded "just for a day" years ago, and draft pages your site builder never unpublished. These are common, and you should remove them whatever Meta does. Remember the test-credentials wording, too: a free sign-up wall may not keep anything out. Truly confidential material like contracts, invoices and client files shouldn't be on a website at all, behind a login or not. Some owners go further and weigh local AI against a cloud assistant for handling that paperwork.

Last, make a deliberate choice instead of a default one. For most owners, leaving Meta's platforms isn't realistic. WhatsApp is where your customers already are, and losing it would cost far more than any crawler could take. That's fine, and staying is a reasonable decision once you understand the terms. What changes is your stance. Treat Meta as a partner whose interests overlap with yours without being the same, and keep your most valuable material under your own control. Plan to revisit this in six months. Pushback from publishers and European regulators could well force Meta to clarify the wording. The easy way to make sure you don't forget is a quick message: "Remind me on April 30 to recheck Meta's commercial terms."

What should you ask an AI assistant before giving it your chats and documents?

Ask the question Meta's terms just forced on you: what may this company do with what I give it? An AI assistant that reads your forwarded contracts, invoices and customer chats sees far more than a crawler on your homepage ever will. Before you hand one your admin, get plain answers to a short list. Does it use my messages and files to train AI models, its own or anyone else's? What can it actually read: only what I send, or whole group chats too? Where is my data stored, and for how long? Can I delete it whenever I like? Does it ever act on my behalf, such as sending a message, without my clear approval first? Our checklist for deciding whether to trust an AI assistant goes through each question in detail.

Good answers are specific and a little boring. "We don't train on your data" is a good start, but it should be written into the terms or privacy policy, not just a sales page. As Meta's update shows, the contract is what counts. Vague phrases like "to improve our services" deserve a follow-up: improve them how, and with what? If the assistant joins your WhatsApp groups, ask what it sees there. Your friends, staff and clients never agreed to anything, and consent in group chats is the part most people forget. Also find out whether the assistant can contact other people for you, and from whose number. If a vendor won't answer, or answers only with marketing copy, you've learned what you need to know.

We expect you to hold us to the same standard. Agent Sonic lives in WhatsApp and handles exactly the sensitive material this article is about. You forward an invoice and ask "Is this a duplicate of last month's?", or send a contract PDF and ask "What are the deadlines?". With outreach tasks (Pro plan, currently in Beta) it can message people for you. It shows you the exact first message for every person before anything goes out. It writes from its own WhatsApp number and always introduces itself as your assistant, never as you. The walkthrough of an AI assistant messaging people for you shows how that works. If you have questions about your data, get access to Sonic and put the checklist above to us directly.

Frequently asked questions