Meta website crawling terms from Oct 30: what brands should do
Meta's business terms take effect Oct 30 and let its bots crawl your website. Here are five steps for Vietnamese brands, from robots.txt to login pages.
In early October 2026, Meta notified business users of new commercial terms that take effect on Oct 30 (PPC Land). Have you read them? Under this version, Meta may use bots to access websites linked to your business account. The open question is Meta website crawling: is it for training AI, or only for pulling product information so ads can be more accurate? As of Oct 20, the answer depends on whom you ask and which version of the terms you are reading.
Our view at 126Insights: whatever Meta plans to do with its bots, a brand's website is now a data asset, and how far AI may read it is being decided in a contract. For brands that sell through Facebook and Instagram, quitting Meta for business is too expensive. What you can do is decide, deliberately and before Oct 30, which parts of your site bots may read and which they may not.
What do Meta's website crawling terms allow?
The commercial terms currently in force took effect on Mar 6, 2024 and contain no clause permitting crawling (automated collection of web pages), according to PPC Land. The new version, per an excerpt from the revised text quoted by Engadget on Oct 20, lets Meta “use automated software (such as web scrapers, bots, robots, spiders, crawlers, and user agents) and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl” the domains tied to a business's products and services, and return periodically for updates. The stated purpose is “to provide, develop, improve, research, and maintain advertising and business products”. The wording of the version that takes effect on Oct 30 may still differ from this excerpt.
In short: Meta may use automated software to enter, store and analyze your website, including by creating test credentials (dummy accounts for logging in).
Who is bound? According to Nieman Lab, business accounts that manage Pages and Groups, run ads, send marketing messages or use the business account dashboard. PPC Land adds posting products, creating or using product catalogues, and using Ads Manager and Meta Business Suite. PPC Land also points out that under Section 7, simply continuing to use Meta products for business counts as agreement. To decline, you must “stop all access or use of our Products for business or commercial purposes”, as NetInfluencer reported, citing Nieman Lab. Before Oct 30, there is no way to opt out and keep using the products.
If you read this story on Genk, a Vietnamese tech site, note that its article is based on a report by The Register from Oct 16, which covered the version before Meta changed the wording.
Two readings of the same text
The first version said the collected content would be used to “train” Meta products, including “AI at Meta”, per Nieman Lab. The legal experts Nieman Lab consulted said this wording would allow scraping even newsroom websites. James Grimmelmann of Cornell Law School said the terms could be used to “develop a comprehensive archive of all content that Meta would then serve as it wanted to directly or through AI”.
Meta rejected that reading. According to FourWeekMBA, Andy Stone, Meta's vice president of communications, wrote on X on Oct 16: “This is false. There's no change to how Meta uses web crawlers.” He said the purpose is to get accurate information about products sold on third-party websites so Meta can suggest ads and content, “not about scraping news sites”.
On the afternoon of Oct 16 (US time), Meta revised the wording: it dropped the word “train” and limited the purpose to “advertising and business products” (Nieman Lab, Quartz). According to MediaNama and Quartz, on Oct 17 spokesperson Daniel Roberts told The Verge that the crawling applies only to advertising and business products, that site owners can still use robots.txt, and that the update does “don't give us new rights that supersede those preferences”.
Grimmelmann was not reassured by the revision. He said it “doesn't address my concerns”, because the phrase “develop… advertising and business products” is still “broad enough to drive a truck through” (Nieman Lab, MediaNama). According to MediaNama, he also argued that the right to create test credentials could let Meta register as a user and get past sign-up walls. The text contains no commitment to respect robots.txt; PPC Land describes it as “silent” on the point, and Quartz also notes that Meta did not put such a commitment in the terms.
The detail that matters most for readers in Vietnam: per FourWeekMBA and ContentGrip, on Oct 19 the US English version dropped the word “train” while the UK English version kept it. Versions differ by country, so the safest approach is to open the version that applies to your own account (step 1 below).
Your website is now a data asset
Suppose a cosmetics shop has 500 self-written product pages, a few dozen skincare guides and a wholesale price list. That is months of work by copywriters, a photographer and an owner who compared ingredients one by one. Any content team that has built a blog post that keeps pulling traffic for years knows what that body of content is worth.
If “develop… advertising and business products” is read as broadly as Grimmelmann fears, the shop owner cannot know which Meta products that content will end up in. If Meta uses it exactly as Andy Stone describes, the product pages are read only so Meta has more accurate information when suggesting ads and content. Both readings sit inside one paragraph of text.
It is like handing a spare key to a delivery man you know. He may only come in to drop off a parcel, but the key is already in his hand, and the paper you both signed decides which rooms he may open.
Blocking AI bots with robots.txt: a sign, not a lock
Robots.txt is a text file at the root of a website that declares which bots may enter which areas. According to Meta's official documentation, the Meta-ExternalAgent bot can be blocked with robots.txt, and you can block by directory, for example Disallow: /private/, instead of blocking the whole site.
The same documentation states two things few people notice. Meta-ExternalFetcher, the bot that fetches links at a user's request, including for agent-style AI, “may bypass robots.txt”. FacebookExternalHit may ignore robots.txt when running security or integrity checks. Also, changes to robots.txt can take up to 24 hours to take effect.
So robots.txt works like a “No entry” sign hung at the gate. Polite visitors read it and stop, but the sign cannot lock the door. It is still worth using, because it is the clearest way for a brand to state its wishes in writing.
Don't block every bot by reflex. Meta itself separates its bots by purpose, and other AI companies name their bots separately too. Suppose a customer asks an AI assistant “which sunscreen suits oily skin”: a website closed to all bots will struggle to appear in the answer. Check each company's official documentation before writing a blocking rule.
What should Vietnamese brands do before Oct 30?
Matt Topic, an intellectual property lawyer at Loevy & Loevy and one of the experts Nieman Lab consulted, said it is unclear whether a court would enforce these terms, but advised treating them as enforceable (per the Northeast Times, Oct 16). Before Oct 30, these are the things worth reviewing:
- Open the preview of the commercial terms inside your own business account, read the version that applies to you, and screenshot it with the date. Don't rely on summaries, including this one.
- List the domains linked to your Meta business account: the main website, campaign landing pages, pages used for catalogues.
- Review robots.txt directory by directory. For the hypothetical cosmetics shop above, you might leave product pages open so dynamic ads can pull information, and consider blocking Meta-ExternalAgent on
/blog/and/huong-dan/(the guides section). Allow 24 hours for changes to take effect. - Put paid or exclusive content behind a login. Suppose an English-language center has PDF coursebooks: they belong in the students' area. The test credentials right means a login may not be fully airtight either; for sensitive content, ask a lawyer.
- Assign one person to track the terms of the platforms you use, such as Meta, TikTok, Shopee (a leading Vietnamese e-commerce marketplace) and Google: log them once a quarter, and review immediately when an update notice arrives.
Step five sounds the least technical and is the most worthwhile. Meta's notice reached business users in early October, but the story drew attention only on Oct 15, when Andrew Deck and Hanaa' Tameez of Nieman Lab took the terms to legal experts.
Do you want to choose, or let the platform choose for you?
In our piece on Meta blocking ads that lead to TikTok, the issue was a sales channel. This time it is content: the pages you wrote, photographed and priced yourself. Meta has already changed the wording once, a day after Nieman Lab's first article, versions differ by country, and the final text may still change.
Vietnamese has a saying: “only after losing the buffalo do you think of building the pen”, a warning against acting too late. Nobody knows for sure whether the buffalo will be led away, but the pen can be built today. Tonight, open your website's robots.txt file and read it. If you don't know what it says, that is your answer to who is deciding for you.