Meta's new commercial terms cover your website from 30 October

A physiotherapy clinic in Porto, our example for this post, posts treatment tips on Instagram, answers bookings on WhatsApp Business, and sends both to a website with its prices, its team and a booking form. On 30 October 2026 the clinic agrees to Meta's new commercial terms without signing anything, because continuing to use Meta's products for business counts as acceptance. The terms let Meta send crawlers to the websites "associated with your products or services" and pull updates from them on a schedule. Unless the clinic ran ads, Meta's contract with it has covered what it posted, not its website. From 30 October it covers the website too.

TL;DR: Meta's new commercial terms, in force from 30 October 2026, let Meta crawl the websites linked to any business account, ads or not, and create test logins to reach them. You cannot opt out and keep the account. You can decide, crawler by crawler, what your robots.txt file allows, and what you keep behind a real login.

What do Meta's new commercial terms say about your website?

Meta's updated commercial terms apply to anyone using Facebook, Instagram or WhatsApp for business, and the definition is wide: "managing a Page", "using ads or marketing messages" and "using any business product, such as Ads Manager or Meta Business Suite" all count. A clinic that never pays for an ad still qualifies.

The part about your website is a single sentence. You authorise Meta "to use automated software (such as web scrapers, bots, robots, spiders, crawlers, and user agents) and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl the domains, web pages, or URLs (and any content available through them) that are associated with your products or services", and to "periodically pull updates" from them. Read plainly, that covers your site, your price list and any page a customer reaches from a link you posted.

Part of this already existed. Search Engine Journal, a search industry publication, compared the documents: Meta's current commercial terms, dated March 2024, have no crawling clause, while its separate terms for self-serve advertising, dated August 2025, already let Meta crawl an advertiser's domains. The October version extends that permission from businesses that buy ads to every business that runs a Page.

The terms also say what happens if you object: "If you do not agree to the updated terms, you may stop all access or use of our Products for business or commercial purposes." No setting lets you accept the rest and refuse the crawling.

Did Meta drop AI training from the commercial terms?

Meta removed the word "train" from the crawling clause after the backlash, and the clause still allows crawling for its advertising and business products. When the journalism site Nieman Lab reported the terms on 15 October 2026, the text let Meta use content from your domains "to provide, develop, improve, research, train, and maintain the integrity of" its products. Two days later Meta told TechCrunch that "the crawling terms we consolidated only applied to our ads and business products, and we've clarified that in the terms themselves", and that the update "does not change how Meta uses web crawlers."

The text Meta has now published for 30 October limits the purpose to "advertising and business products", including tools that "help you create and deliver ads and other commercial content" and "provide users information about your products and services", plus maintaining "the integrity and security" of Meta's products. Meta's spokesperson Andy Stone said on X that the change is about pulling accurate product information for ad and content recommendations, and "not about scraping news sites."

For a small business, the narrower wording means Meta's systems may read your website to write or adjust ads about you, and to tell people on its apps what you sell, what it costs and when you open. If your prices page is two years old, that is the version Meta's tools can read.

Training still appears in Meta's crawling, under a different document. Meta's crawler documentation says its Meta-ExternalAgent crawler "crawls the web for use cases such as training foundation AI models or improving products by indexing content directly." Foundation models are the large AI systems behind assistants such as Meta AI. The terms set what you agree to; your robots.txt file is where you tell each crawler what it may visit.

Can robots.txt keep Meta's crawlers out of your website?

Robots.txt is a plain text file at the root of your domain (yourdomain.com/robots.txt) that tells crawlers which pages they may visit, and it is the control Meta itself points to. Its spokesperson told Nieman Lab that "content owners can still manage how their content is accessed by using robots.txt." The new terms never mention the file, which is what worries lawyers. Eric Goldman, a law professor at Santa Clara University, told the tech news site The Register: "the language doesn't expressly say that Meta will respect those robots.txt instructions."

So robots.txt is a request that Meta says it honours, with no promise in the contract. It is still worth setting carefully, because Meta's documentation lists five crawlers with different jobs:

• FacebookExternalHit builds the preview (title, description, image) when someone shares your link on Facebook, Instagram, Messenger or WhatsApp. Block it and your own links turn into bare addresses. Meta notes it "might bypass robots.txt when performing security or integrity checks", such as scanning a link for malware.
• Meta-ExternalAgent is the one documented for training foundation AI models.
• Meta-ExternalAds crawls "for use cases such as improving advertising and other business-related products and services."
• Meta-WebIndexer feeds the search inside Meta AI, the assistant in Meta's apps. Meta says allowing it "helps us cite and link to your content in Meta AI's responses."
• Meta-ExternalFetcher opens a page when a user asks Meta's AI to, and "may bypass robots.txt rules."

A blanket "block everything from Meta" hurts the business that writes it, because the link in your WhatsApp replies loses its preview. A rule per crawler lets you refuse training and keep the preview.

Robots.txt only works on a domain you control. If your booking page lives on a booking platform's own address, that platform's robots.txt decides what crawlers may read there, and you cannot change it. The rules you write cover the pages on your own domain, which is one more reason to keep prices, services and opening hours there.

On the sites we build, robots.txt is generated from the site's code alongside the pages, so a rule per crawler goes through the same review and release as any other change to the site.

What do "test credentials" mean for pages behind a login?

The terms let Meta "create test credentials" to reach the domains it crawls. Meta has not explained the phrase. Legal experts read it as permission to register an account on your site the way a customer would: James Grimmelmann, a professor of digital and information law at Cornell Law School, told Nieman Lab it would let Meta "sign up as a fake user" to get past a registration wall. Owners on Reddit's small business forum, r/smallbusiness, reached the same reading; one thread is titled "Meta gave itself permission to create accounts on your website".

Many local service businesses have a page like that: a members' price list, a client area for course material, a portal where patients download forms. If anyone can create an account with an email address, the page was never private, and the terms now put in writing that Meta's software may sign up as well.

What to do depends on the page. Content you would happily show anyone belongs on the public site, where you control how it reads. Content that is private needs access you grant per person, such as an invitation, a manual approval or a link sent after a booking, so that signing up alone is not enough.

What else do you accept on 30 October?

Two clauses matter for an owner who uses Meta's AI tools to write ads or posts. Section 5 of Meta's commercial terms says "AI features may make mistakes" and that "you are solely responsible for and assume any and all risks associated with such AI features and any resulting Content." If Meta's assistant invents a discount or a claim about your treatment and you publish it, the responsibility for that ad is yours.

Section 4 of the same terms caps what Meta owes you if something goes wrong at "the greater of one hundred dollars ($100) or the amount you have paid us in the past twelve months." For a clinic that spends nothing on ads, the cap is the $100.

Quitting Meta is rarely the right answer for a business whose clients live on Instagram and WhatsApp. The terms do show how the relationship works: Meta writes them and can change them with a notice, and your choice is to accept or leave. On your own website, the wording and the robots.txt rules are yours to set.

How to decide what Meta can read before 30 October

Set aside an hour, with access to your website and your Meta Business Suite.

1. List every Meta account the business uses for work: Facebook Page, Instagram professional account, WhatsApp Business, any ad account. Each one accepts the terms on 30 October if it stays active.
2. Open yourdomain.com/robots.txt in a browser. If the page is blank or missing, every crawler is allowed. On a hosted site builder, look for robots.txt in its SEO settings or help pages; some builders let you edit the file and some do not, and that tells you how much of this step is in your hands.
3. Decide per crawler. One middle ground: disallow Meta-ExternalAgent (training), allow FacebookExternalHit (link previews), and choose for Meta-ExternalAds and Meta-WebIndexer based on whether you want Meta to use your site for ads and for answers in Meta AI. Each rule is two lines, User-agent: meta-externalagent followed by Disallow: /, where the slash means the whole site.
4. Wait a day, because Meta says its crawlers may cache your robots.txt for up to 24 hours, then paste one of your pages into Meta's Sharing Debugger to confirm the preview still works.
5. Go through every page behind a login and ask whether a stranger with an email address could reach it. Move private material behind an invitation or a manual approval.
6. Read your public pages as if Meta's ad tools were quoting them tomorrow: prices, hours, services, team. Fix whatever is out of date.

Frequently asked questions

Can I opt out of Meta's new commercial terms and keep my business account?

No. The terms take effect on 30 October 2026, and continued business use counts as acceptance. Meta's only alternative is to stop using its products for business, which means no Page management, no ads and no Meta Business Suite. Your control sits on your own website, through robots.txt and how you protect private pages.

Will blocking a Meta crawler break my Instagram links or my ads?

Only if you block the wrong one. FacebookExternalHit builds the previews of links you share, so leave it allowed. A rule for Meta-ExternalAgent, documented for AI training, is separate from it. Blocking Meta-ExternalAds asks Meta not to crawl your site for its advertising products, so decide that one with your ads in mind.

Do EU rules change any of this for a European business?

Not yet. The terms say their disputes section does not limit your rights under the Digital Markets Act, the EU law for the largest platforms, and the European Publishers Council has raised the terms with the European Commission. Neither has moved the 30 October date, and robots.txt rules work the same in every country.

Set your website's rules before Meta's terms start

Meta's terms say they may be updated "from time to time", and each update arrives with a notice and one option: accept it or stop using the business tools. On your website you can do more than accept. Set a robots.txt rule for each Meta crawler, put private pages behind access you grant, and bring the public pages up to date, because from 30 October Meta's tools may be reading them.

If you want help reading your robots.txt and the pages behind your logins before 30 October, book a 30-minute call and we will go through them with you. If the site needs rebuilding, a conversion-first website from SharpHaw is built and maintained by the same engineer, and the Foundation plan covers the website and its upkeep.