If you run a business account on Facebook, Instagram or WhatsApp, the rules change on 30 October. Meta's updated Commercial Terms take effect that day, and inside them sits a clause most owners will never read: keeping the account counts as consent for Meta to crawl the website linked to it and use what it finds to build its products. Legal experts quoted in TechRound's report read that as covering AI training. In plain terms, from 30 October, Meta scraping your website for AI training is the default that comes with staying.
There is nothing to click first and no switch to turn off while you keep trading on the platforms. The consent is the usage.
What the new terms actually say
From 30 October, Meta may use automated crawlers on sites "associated with" a business account, then use the content to provide, develop, improve, research, train and maintain its products, as TechRound explains. Experts read that list as covering AI training, though the clause never names a model. Meta's own position is different: it says the update consolidates existing permissions, does not change how it crawls publishers, and that content owners can still manage access through robots.txt.
The mechanics of consent matter most for a small business. A standard opt-in asks before it uses your content, and an opt-out lets you say no and carry on. Meta chose neither. Staying active after that date is the yes, and the same reporting says businesses that object are told to stop all access or use of Meta's products for commercial purposes. If orders arrive through Instagram and enquiries come through WhatsApp, you cannot follow that instruction without cutting off a channel customers actually use.
There is also no UK carve-out. Within the EU, rights holders can reserve content from text and data mining with machine-readable signals and AI providers must respect those reservations. What nobody has tested is how such a reservation mixes with a contract accepted simply by staying active. Until a court looks at it, the terms will mean what the parties each decide they mean, which is not a footing you can build a policy on.
What "associated with" could sweep up
The clause leaves "associated with" undefined. Read broadly, the net takes in a company's main domain, product inventory, sales landing pages, ad links and the pages behind them. Read narrowly, it covers product descriptions, catalogues and basic metadata. The legal experts quoted in the report call the breadth uncertain, and their inability to pin it down tells you something about the drafting.
For independent businesses, that broad reading covers the pages you worked on: marketing copy, blog posts, documentation, pricing pages, product specifications, images, FAQs and support content.
Two honest counters belong next to that. The same report is clear that no published evidence shows Meta has started systematically scraping domains like these, or that every byte would become training fuel. And a site that works mainly as a brochure has little at stake. If what makes you worth hiring is original research, templates, paid content or documentation nobody else has, the broad reading becomes a proper commercial problem, because it hands over rights to exactly the material that sets you apart.
A second decision most owners never made
Separately from the training question, AI tools already read small business websites in a different way. Perplexity's Comet browser and the browser built into the ChatGPT desktop app open pages on a customer's behalf, so the page they can read is the page they can act on.
Whito's AI Browser Readiness study knocked on 606 working UK trade and dental homepages on 8 October and found that 69 of them, about one in nine, turned the automated reader away while loading normally for a person in a browser. Sixty of the 69 answered with 403 Forbidden, and in most cases the block came from firewall or bot protection a host or security service had switched on by default, not from anything the owner chose. The study is free to read, with the full dataset published.
Put those two stories side by side and the shape repeats. In Meta's terms, consent arrives by default. On your own site, a security default decides the door. Only the second is yours to change this week. Allowing verified AI readers in means your services, prices and opening hours can be read and quoted when an assistant answers a customer's question for them, and positioning a site for that is its own subject. Blocking everyone keeps the content to yourself and out of those answers. Some sites should block, particularly where original or paid content is the product. The point is to make the choice yourself, knowing the trade runs both ways.
What to do before 30 October
Four things, and none of them needs a lawyer.
-
See the site as a machine sees it. Run the Miaigi free assessment, an instant, automated 60-second audit of one page (ten checks), on the page a customer reaches first.
-
Decide the door on purpose. Check your robots.txt and ask whoever manages your hosting or security tooling what their bot protection actually allows, and whether verified AI crawlers get through. robots.txt remains the lever content owners keep, which Meta itself confirmed, so set it consciously rather than leaving it to your supplier's settings.
-
Tidy what a reader will find. The study's fix list is short and worth copying: phone number as text with a tappable link, town and postcode written out in plain text, and no unnamed buttons, because a screen reader or an agent needs a name to say what a button does. Beyond that, prices that are current, FAQs that answer real questions and service pages in plain English. Schema markup helps here as well, because it tells machines exactly what you do.
-
Keep the substance on ground you own. Instagram, WhatsApp and the Facebook business tools are distribution and worth keeping for most trades. Your website is the asset whose terms you set and that carries over if any platform changes its mind. That separation is what we mean by digital architecture, and it is what keeps the customer relationship yours rather than the platform's.
The bottom line
You cannot use Meta's business tools and refuse this clause at the same time. What sits within reach is the ground on your side of the fence: what your site says, who may read it, and whether it answers well when a customer or a machine arrives. Settle those before 30 October and this change costs you only what you decided to give. Leave them unsettled and the defaults decide again.
