--- title: Legal experts warn Meta's new terms still grant broad... description: Meta revised its upcoming commercial terms of service for business accounts, removing the word "train" and narrowing listed use cases to "advertising and... canonical: https://daily.dev/posts/legal-experts-warn-meta-s-new-terms-still-grant-broad-scraping-permissions-hp1lpiva6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Legal experts warn Meta's new terms still grant broad scraping permissions | daily.dev og:description: Meta revised its upcoming commercial terms of service for business accounts, removing the word "train" and narrowing listed use cases to "advertising and... og:url: https://daily.dev/posts/legal-experts-warn-meta-s-new-terms-still-grant-broad-scraping-permissions-hp1lpiva6 og:image: https://api.daily.dev/og/posts/HP1lPiva6.png og:image:alt: Legal experts warn Meta's new terms still grant broad scraping permissions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Legal experts warn Meta's new terms still grant broad scraping permissions **[Hacker News](https://daily.dev/sources/hn)** · 7 min read · 0 upvotes · 0 comments ## Summary Meta revised its upcoming commercial terms of service for business accounts, removing the word "train" and narrowing listed use cases to "advertising and business products" rather than all Meta products, after Nieman Lab reporting exposed that the terms would permit broad scraping of websites associated with business accounts. Legal experts, including James Grimmelmann and Benjamin Sobel, say the revision does little to limit Meta's scraping rights, since "develop...advertising and business products" and "associated with your products or services" remain broad enough to cover entire sites and potentially AI training. Meta claims robots.txt preferences are still respected, but no such language appears in the revised terms, and compliance with robots.txt is voluntary, not legally enforceable. The new terms take effect October 30 with no opt-out, and publishing trade groups in the US, UK, and EU have condemned the change and called for regulatory intervention. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does Meta's revised commercial terms of service still allow it to scrape news publisher websites? Yes. Although Meta removed the word "train" from its terms and narrowed the stated use cases to "advertising and business products," legal experts say the remaining language, letting Meta "develop" business products using content from sites "associated with" a business account, is still broad enough to cover scraping entire news sites and potentially feed AI training. The terms take effect October 30 with no opt-out option. _Publishers weighing platform data risk follow terms-of-service changes like this one on daily.dev._ ### Does Meta's terms of service say it will respect robots.txt files when scraping business-associated websites? No specific language about respecting robots.txt appears in Meta's revised commercial terms, despite a company spokesperson claiming such preferences are honored. Law professor Benjamin Sobel notes robots.txt only signals a voluntary preference, not a legally enforceable right, comparing it to a sign saying "don't look at my house" that carries no binding force. _Developers evaluating crawler compliance and site-blocking tactics track cases like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 52 comments across hackernews (as of 2026-10-23). **TL;DR:** Commenters largely dismiss Meta's revised terms as a cosmetic fix, with discussion focused on how robots.txt is unenforceable and on technical countermeasures (blocking by ASN/TLS fingerprint, serving fake or junk data) rather than legal recourse; a sizable side-thread vents general distrust of Meta and its leadership. **Sentiment:** 2% positive · 13% mixed · 85% skeptical **The pushback** - Robots.txt is only a voluntary signal, not a binding or enforceable block, so it offers no real protection. - Simple UA-based blocking is already ineffective since scraper traffic rotates across non-Meta ASNs. - Removing the word 'train' is seen as a PR move since 'develop/improve' broad language still covers AI training. - Feeding scrapers false or poisoned data is debated as possibly ineffective or even more resource-intensive than serving real data. **By community** - hackernews (skeptical): Most believe the terms change is a meaningless PR tweak and robots.txt provides no real protection, with discussion drifting into technical countermeasures and broader anti-Meta sentiment. **Hottest debate:** Whether technical countermeasures like serving fake/poisoned data to scrapers are actually effective or just as costly as serving real data. **Open questions** - Is it actually possible to meaningfully poison or mislead AI training with fake data? - What effective technical or legal recourse do website owners have if contractual terms permit scraping regardless of robots.txt? **Highlights** > TLDR; The Danger List Your robots.txt "Do Not Scrape" signs become legally useless: robots.txt is just a voluntary preference, not a law. While Meta says in PR statements that it will respect robots.txt, it left that promise out of the binding legal contract. By keeping your business account active, you are signing a contract that legally authorizes Meta to ignore your site’s block-lists. - Meta can create fake accounts to bypass registration walls: The terms explicitly authorize Meta to "create test credentials" to crawl your site. Legal experts warn this gives Meta permission to sign up as a fake user to scrape gated content behind login screens or basic paywalls that anonymous bots usually can't see. - Your entire domain is fair game, not just links you post: Because the terms cover any domain "associated with your products or services" (or shared by regular users on Meta), Meta isn't just scraping the specific landing pages you run ads for—it has a green light to crawl your entire website from top to bottom. - AI training is still allowed through a backdoor: Removing the word "train" is a PR smokescreen. The contract still lets Meta scrape your site to "develop, improve, and research... advertising and business products." Because "business products" isn't strictly defined—and Meta builds AI tools for businesses "developing" legally covers training AI models on your proprietary articles, data, and work. - Third-party companies get the same access: The terms grant these scraping rights to "any entity acting on our behalf," meaning external contractors or third-party scraping vendors hired by Meta also have legal cover to harvest your site. - It is a non-negotiable hostage situation (Zero Opt-Out): There is no toggle or form to reject this before the October 30 deadline. Your only legal way to decline is to completely delete your commercial presence across Facebook, Instagram, Threads, and WhatsApp—forcing you to choose between surrendering your content for free or losing access to your audience. The Bottom Line: Starting October 30, their updated terms give it sweeping permission to scrape entire websites linked to any Meta Business account (Facebook, Instagram, Threads, WhatsApp). Despite a last-minute wording tweak after backlash, legal experts warn the rules still let Meta harvest publisher content to build AI tools—with zero option to opt out. 1. What Exact Things Can Meta Do? If you have a Meta Business account, you authorize Meta (and its third-party partners) to: a) Deploy automated bots: Use web scrapers, crawlers, spiders, and user agents on your site. b) Bypass basic walls: Create "test credentials" to access, index, cache, analyze, and collect your content. c) Monitor continuously: Periodically pull updates from your domains, web pages, and URLs. 2. What is the Extent of the Scraping? - What gets scraped: Any domain, webpage, URL, or content "associated with" your business or shared by users on Meta platforms. Legal experts note this is broad enough to let Meta scrape entire websites, not just specific landing pages. - - Who it affects: Virtually every news organization and business that uses a Meta account to manage Facebook Pages, Instagram profiles, Threads, or WhatsApp channels. How it expanded: - Previously: Meta could only scrape your site if you specifically used its generative AI ad features, and only to "optimize your ads." - Now: It applies to all business accounts by default, and scraped data can be used for all "advertising and business products" (plus platform security/integrity). 3. Why Legal Experts Say Meta's "Fix" Changes Nothing After initial outrage, Meta revised the text on Friday to remove the word "train" and claimed it still respects robots.txt (the code websites use to block scrapers). Legal experts aren't buying it for three reasons: - "Develop" still means "Train": Meta replaced "train" with permission to "develop, improve, research, and maintain advertising and business products > — [ProofHouse on hackernews · 1 comments](https://news.ycombinator.com/item?id=50142584) > still have the ability to disable the crawler via robots.txt flags Never rely on robots.txt. Configure it, but do not rely on it. A bot will do what a bot can do. Their bots are trivial to spot so close the connection, bonus if done silently closing the socket and inhibiting first RST from web daemon and second RST from the OS. > — [Bender on hackernews · 3 comments](https://news.ycombinator.com/item?id=50140115) > Blocking by UA is pointless now, meta-externalagent rotates and a chunk comes off non-Meta ASNs. We matched on ASN plus TLS JA4 and that actually stuck. > — [Heronsunny on hackernews](https://news.ycombinator.com/item?id=50140676) > robots.txt can used as a reward mechanism. If an automated visitor that we would normally block begins by accessing robots.txt that's a good sign and we give that a plus score or whatever. If subsequent accesses from that visitor comply with robots.txt, we let them continue (perhaps with some rate checks). Conversely, if an obviously automated visitor does not fetch robots.txt, that can be an instant ban, kind of like a reverse honey pot, if you will. So it can have some nonzero value in the overall context; it's just silly to think of it as a blocking mechanism. In short, robots.txt documents what access is allowed; it states the policy. Enforcing it the job of something else. Someone you work for in this capacity shouldn't ask about robots.txt because that's the sort of detail for which they have you to deal with. > — [kazinator on hackernews](https://news.ycombinator.com/item?id=50142512) > I'm not convinced that it's possible to poison AI. Real data all correlates, fake data is all unique in its own way. I suspect feeding AI fake data is a waste of time. > — [post-it on hackernews](https://news.ycombinator.com/item?id=50141779) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50139692) · 179 points · 52 comments ## Similar posts on daily.dev - [Meta rolls out new AI content enforcement systems while reducing reliance on third-party vendors](https://daily.dev/posts/meta-rolls-out-new-ai-content-enforcement-systems-while-reducing-reliance-on-third-party-vendors-cxkvdjtie) · TechCrunch · 0 upvotes · 0 comments - [Your site, your rules: new AI traffic options for all customers](https://daily.dev/posts/your-site-your-rules-new-ai-traffic-options-for-all-customers-zrn0fx6z7) · Cloudflare · 0 upvotes · 0 comments - [We Overhauled Our Terms of Service and Privacy Policy — Zed's Blog](https://daily.dev/posts/we-overhauled-our-terms-of-service-and-privacy-policy-zed-s-blog-b4cuo4gyo) · Zed · 1 upvotes · 0 comments --- Tags: [#machine-learning](https://daily.dev/tags/machine-learning), [#crawling](https://daily.dev/tags/crawling) [View this post on daily.dev](https://daily.dev/posts/legal-experts-warn-meta-s-new-terms-still-grant-broad-scraping-permissions-hp1lpiva6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Legal experts warn Meta's new terms still grant broad scraping permissions","url":"https://daily.dev/posts/legal-experts-warn-meta-s-new-terms-still-grant-broad-scraping-permissions-hp1lpiva6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/legal-experts-warn-meta-s-new-terms-still-grant-broad-scraping-permissions-hp1lpiva6"},"datePublished":"2026-10-18T14:05:18.802Z","dateModified":"2026-10-23T16:20:48.957Z","description":"Meta revised its upcoming commercial terms of service for business accounts, removing the word \"train\" and narrowing listed use cases to \"advertising and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d849db134044453dcdb12e4f7ded8908?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d849db134044453dcdb12e4f7ded8908?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/legal-experts-warn-meta-s-new-terms-still-grant-broad-scraping-permissions-hp1lpiva6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"machine-learning,crawling","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Legal experts warn Meta's new terms still grant broad scraping permissions"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/legal-experts-warn-meta-s-new-terms-still-grant-broad-scraping-permissions-hp1lpiva6#faq","mainEntity":[{"@type":"Question","name":"Does Meta's revised commercial terms of service still allow it to scrape news publisher websites?","acceptedAnswer":{"@type":"Answer","text":"Yes. Although Meta removed the word \"train\" from its terms and narrowed the stated use cases to \"advertising and business products,\" legal experts say the remaining language, letting Meta \"develop\" business products using content from sites \"associated with\" a business account, is still broad enough to cover scraping entire news sites and potentially feed AI training. The terms take effect October 30 with no opt-out option. Publishers weighing platform data risk follow terms-of-service changes like this one on daily.dev."}},{"@type":"Question","name":"Does Meta's terms of service say it will respect robots.txt files when scraping business-associated websites?","acceptedAnswer":{"@type":"Answer","text":"No specific language about respecting robots.txt appears in Meta's revised commercial terms, despite a company spokesperson claiming such preferences are honored. Law professor Benjamin Sobel notes robots.txt only signals a voluntary preference, not a legally enforceable right, comparing it to a sign saying \"don't look at my house\" that carries no binding force. Developers evaluating crawler compliance and site-blocking tactics track cases like this on daily.dev."}}]} ```