Somewhere in your company, someone has already scrolled past the notice. It showed up in Meta Business Suite and in a Meta blog post in early October, framed as a tidy-up: fewer overlapping agreements, clearer terms. Nieman Lab only heard about it because a small publisher, Stephen Beale of The Steampunk Explorer, actually read it and sent in a tip.
It deserves more than a scroll. Meta’s revised Commercial Terms take effect on October 30, 2026. They add a paragraph in which every business using Meta’s products authorizes Meta, “or any entity acting on our behalf,” to use “web scrapers, bots, robots, spiders, crawlers, and user agents” and to “create test credentials” to access, index, cache, collect and crawl the domains and pages “associated with your products or services,” plus URLs “made available through your or users’ use” of Meta’s products. Meta may then use that content to “provide, develop, improve, research, train, and maintain the integrity of” its products.
Most of the coverage has framed this as a fight between Meta and news publishers, and it is one. But the clause does not care what kind of business you are. If you run ads, manage a Page, send marketing messages, list products or log into Ads Manager, your continued use after October 30 is the signature. At most brands, the person holding the pen is the media buyer.
That is the marketing consequence. Your ad account is now also a content license for your website, and the people who should decide what goes into that license have less than two weeks.
What you agree to by doing nothing
The mechanics are blunt. PPC Land compared the October 30 text with the March 6, 2024 version it replaces. The definition of business use now covers ads, selling products, managing a Page or Group, measurement services, marketing messages, listing products, product catalogs, and “any business product, such as Ads Manager or Meta Business Suite.” Keep using any of it after notice of an update and you have agreed. If you don’t agree, the terms say you “may stop all access or use” of Meta’s products for business. There is no partial opt-out from the crawling paragraph. No form, no toggle.
Two phrases carry the weight, and neither is defined. “Associated with your products or services” could mean your product detail pages. It could also mean your whole domain, because a brand’s buying guides, recipes, sizing charts, help center and blog are all associated with what it sells. The second prong, URLs “made available through your or users’ use” of Meta’s products, is wider still, since on its face it reaches links your customers share.
Then there is “test credentials.” The clause lets Meta create them to reach covered pages. Cornell law professor James Grimmelmann told Nieman Lab that this would technically let Meta “sign up as a fake user” to get past registration walls. Meta declined to tell Nieman Lab whether test credentials would be used on paywalls or other paid content.
How much of this is actually new
Advertisers should hear this part before they either panic or shrug. Search Engine Journal’s Matt Southern pointed out that Meta’s Self-Serve Ad Terms, dated August 22, 2025, already give Meta the right to crawl content on an advertiser’s domains when an ad order is placed, with listed uses that include “research and training.” Meta’s Seller Agreement already allowed test credentials for URLs that sellers provide. So if you buy Meta ads, some version of this permission has been sitting in your paperwork for a while.
What changes is the hook and the reach. The old ad language attached to an ad purchase and to domains or URLs the advertiser supplied. The new Commercial Terms attach to any business use, reach any page associated with your products, add the user-shared prong, and put test credentials and training in the same sentence for everyone. Ars Technica compared the versions and found that what Meta calls streamlining uses fresh language with broader grants. A brand that only runs a Facebook Page and never buys an ad is newly in scope. So is the B2B company whose real asset is a gated research library.
Meta’s reading versus Meta’s text
Meta’s position is that nothing changes in practice. In a statement reported by The Verge, spokesperson Daniel Roberts said “there is no change to how Meta uses web crawlers” and that content owners “can still use robots.txt flags to indicate their preferences.” Andy Stone, Meta’s vice president of communications, posted on X that the update is “designed to make sure we’re able to pull accurate information about products for sale on third-party websites when making on-platform ad and content recommendations, not about scraping news sites.”
I believe that is the current intent. It is also not what the paragraph says. The clause mentions no product limit, no catalog, no price. Neither the Commercial Terms nor the updated ad terms mention robots.txt, according to both PPC Land and Search Engine Journal. The three legal experts Nieman Lab consulted said the language gives Meta an opening to argue that its contract supersedes other blocking instructions. Matt Topic of Loevy & Loevy put it in operator terms: it’s not clear whether a court would enforce it, “but publishers should assume that it would be enforceable.” Swap “publishers” for “brands” and the advice still holds.
Intent is what a company says this week. The contract is what binds you after October 30. Plan around the contract.
Your site turns into supply
Stone’s explanation is the most useful thing Meta has said so far, because it tells you where this is going. Meta wants accurate product information from your site so it can make recommendations inside its own apps.
Now look at the same fortnight. According to a Meta notice that media buyer David Herrmann shared on LinkedIn, and that PPC Land reported on October 15, Meta will add product browsing to existing Facebook and Instagram ads starting October 28 unless advertisers opt out. A tap on the ad may open an experience “on Facebook or Instagram with product info and personalized suggestions” before anyone reaches your site. Meta cites 3% more conversions from an August test across about 117,700 advertisers, without saying which conversions or where they were counted. PPC Land could not find a help page or changelog entry for the change.
Put the two dates side by side. On October 28, the tap stays in the app by default. On October 30, Meta’s contract lets it read your site and learn from it. Your website used to be where Meta sent people. It is turning into something Meta reads so people don’t have to leave.
For a retailer with a clean catalog, maybe that’s fine. Maybe it even converts. For a brand whose site does the persuading, the educating or the lead capture, it is a quiet transfer of the most valuable part of the funnel. The content you paid a team to write becomes material for answers and recommendations you don’t control, inside an app where your consent banner, your analytics and your post-click tests don’t run.
Robots.txt is the lever, and it’s a blunt one
Meta keeps pointing at robots.txt, so take it seriously and know its limits. Meta runs several crawlers, and blocking all of them is the wrong move.
Meta-ExternalAgent matters most here. Search Engine Journal, citing Meta’s crawler documentation, says it crawls for uses such as training foundation AI models and improving products by indexing content directly. PPC Land notes that one robots.txt token covers both jobs, so you cannot allow the indexing and refuse the training. Meta-WebIndexer builds Meta AI search results, and Meta says allowing it helps Meta AI cite and link to your content. FacebookExternalHit fetches your page to build the link preview when someone shares your URL. Block that one and every post carrying your link loses its card. Meta-ExternalFetcher fetches pages when a user asks for them and, per the same documentation, may bypass robots.txt. FacebookExternalHit may also bypass it for security or integrity checks.
So the realistic setup for most brands looks like this. Keep FacebookExternalHit open. Decide Meta-WebIndexer on purpose, because being cited in Meta AI is a real visibility question, not a reflex. Decide Meta-ExternalAgent section by section. Product pages you want reflected accurately might stay open. The gated research, the community forum, the help center articles that are your search moat, the pricing explainer your sales team leans on: those are the sections worth arguing about.
And remember what robots.txt is. It is a request that a well-behaved crawler honors. The contract does not reference it. Today Meta says it honors it. Write your rules anyway, because your rules are the only written record of what you did not want taken.
This lands on marketing whether marketing likes it or not
Legal will want to own this, and should review it. But legal does not decide who logs into Ads Manager on October 31. Marketing does. So does the agency that runs your Pages and catalogs on your behalf, which may be the one clicking past notices for a dozen clients at once.
There is no outside fix coming in time, either. The European Publishers Council is writing to the European Commission about the terms, according to Search Engine Journal. That is a track measured in months. Your deadline is a Friday at the end of this month.
What to do this week
- Find the notice and name an owner. Somebody saw it in Business Suite. Find out who, and put one person in marketing on the hook to bring this to a decision before October 28, not October 30.
- List everything that binds you. Every ad account, Page, catalog, WhatsApp channel and Business Suite login across your brands and your agencies. Each one is another way of saying yes.
- Map your domains by value. Product pages, editorial and guides, gated content, community, help center, staging and test sites. Mark which ones you would happily see inside Meta and which ones you would consider licensable.
- Write crawler rules per Meta agent. Keep link previews working. Decide Meta-WebIndexer and Meta-ExternalAgent per section. Have whoever owns the site confirm the file is live, then test it.
- Check your sign-up walls. If gated content is the product, ask security how new account creation is monitored and whether you would notice automated sign-ups. Then ask Meta, in writing, whether test credentials will be used on your domains.
- Get Meta’s narrow reading in writing. Ask your Meta rep to confirm by email that crawling under the new terms is limited to product information and honors robots.txt. Spoken comfort is worth less than a forwarded email.
- Decide product browsing on its own merits. Before October 28, use the opt-out or the per-ad setting in Advantage+ Creative and Destination for anything built for leads or bookings. Test it on purpose on catalog ads, and judge it by the orders that land in your own systems.
- Brief the agency. Tell them which accounts they may keep using after October 30, and who signed off on that.
None of this means quitting Meta. Most brands will keep running ads there, and should. It means noticing that the price of an ad account just grew a new line, and deciding what you are willing to pay it with.
