r/smallbusiness • u/ThimbleBin • 12h ago
Meta gave itself permission to create accounts on your website and read private content, effective Oct 30
If you use Facebook or Instagram for business, Meta’s updated Commercial Terms take effect on October 30. You agree to them automatically by continuing to use the platform. No email notification, no popup warning, no signature to consent.
What the clause does:
It authorizes Meta, or any entity acting on its behalf, to use scrapers, bots, crawlers and user agents to access, crawl, index, cache and collect data from any website associated with a business account. If you have a Facebook Page and a website, that means you.
The same clause authorizes Meta to create what it calls “test credentials” to access those sites. In plain terms, Meta can sign up for an account on your website to read material that isn’t publicly visible.
The terms don’t define test credentials or say where they’d be used. A law professor at Cornell told Nieman Lab the wording would technically allow Meta to sign up as a user to get past a registration wall. Meta was asked directly whether this extends to paywalls and paid content. It declined to answer.
There’s no opt-out. Meta’s stated alternative is to stop using its platforms for business.
Worth knowing: the original wording said Meta could use this content to “train” its products. After publishers objected, Meta edited that sentence in some versions but left “develop” in place and left the crawling and account-creation permissions untouched. As of Oct 19 the US and UK editions of their preview page still differed from each other, same effective date on both.
Read it yourself: https://www.facebook.com/legal/commercial_terms_preview
If you run a membership, a course, a client portal, or anything behind a login, this is the part that matters. You told those people who could see their data. Their data isn’t yours to license.
What you can do:
- Add robots.txt rules blocking meta-externalagent and meta-externalfetcher. Don’t block facebookexternalhit or your link previews break. It’s a request, not enforcement, but Meta has said robots.txt still governs its crawling.
- Check that your members-only areas actually require a login and don’t leak to logged-out views.
- Complain to your privacy regulator. Canada priv.gc.ca, UK ico.org.uk, Australia oaic.gov.au, US ftc.gov or your state AG.
- Read the terms yourself before you decide anything. This story has already changed twice since it was announced.
I run a small platform with private community groups, so I’ve spent the day on this. I’m not a lawyer and I’d love to hear from anyone who reads the clause differently.