still have the ability to disable the crawler via robots.txt flags
Never rely on robots.txt. Configure it, but do not rely on it. A bot will do what a bot can do. Their bots are trivial to spot so close the connection, bonus if done silently closing the socket and inhibiting first RST from web daemon and second RST from the OS.
robots.txt can used as a reward mechanism. If an automated visitor that we would normally block begins by accessing robots.txt that's a good sign and we give that a plus score or whatever. If subsequent accesses from that visitor comply with robots.txt, we let them continue (perhaps with some rate checks).
Conversely, if an obviously automated visitor does not fetch robots.txt, that can be an instant ban, kind of like a reverse honey pot, if you will.
So it can have some nonzero value in the overall context; it's just silly to think of it as a blocking mechanism.
In short, robots.txt documents what access is allowed; it states the policy. Enforcing it the job of something else.
Someone you work for in this capacity shouldn't ask about robots.txt because that's the sort of detail for which they have you to deal with.
This implies the solution is every actor in the world willfully complying which doesn’t sound very realistic if you ask me.
Similar to saying world hunger would be solved in everyone who could donated $100 to those in need. Sure it may be true but foot stomping about why isn’t it organically happening is missing the point.
The problem itself does not matter. If the nature of any solution relies on willful global compliance, it’s not going to be very effective at whatever it’s trying to solve.
Every society fundamentally relies on willful compliance. Sure, you can force a few outsiders, but once a sizeable population stops being compliant, it just breaks down.
Yeah it reminds me of the typical copyright notice found in a book, even decades ago:
> All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without permission in writing from the publisher.
For AI, wasn't the book first "reproduced or transmitted" into a training system?
Returning some text files from the server fs is _wayyy_ lighter than letting the bot go through the search, middleware, and db while crawling your stuff.
I'm not convinced that it's possible to poison AI. Real data all correlates, fake data is all unique in its own way. I suspect feeding AI fake data is a waste of time.
Angel banning is better, 100% agreed on giving it false data that the scraper builders can't easily detect. Give it seemingly correct and useful but totally wrong answers
I would assume it's exactly what they described, banning something by pretending to still helpfully assist them while silently undermining them instead.
I'm a bit confused why people are freaking out about these term changes - Meta scrapes my website already on a fairly regular basis (even with robots.txt). Is the point of this change to justify more intense scraping?
You can but you'll probably want to do it with a browser extension or an undetectable webdriver.
I suggest doing it, actually. Could be a fun project. I suggest not making the script make any extra requests on your main account just in case - anything already on the page is free for scraping.
Color me shocked... one of the most profitable companies in the world, that doesn't contribute anything positive to society, is unethical. Just another day in America that ends in Y.
Blocking by UA is pointless now, meta-externalagent rotates and a chunk comes off non-Meta ASNs. We matched on ASN plus TLS JA4 and that actually stuck.
Your robots.txt "Do Not Scrape" signs become legally useless: robots.txt is just a voluntary preference, not a law. While Meta says in PR statements that it will respect robots.txt, it left that promise out of the binding legal contract. By keeping your business account active, you are signing a contract that legally authorizes Meta to ignore your site’s block-lists.
- Meta can create fake accounts to bypass registration walls: The terms explicitly authorize Meta to "create test credentials" to crawl your site. Legal experts warn this gives Meta permission to sign up as a fake user to scrape gated content behind login screens or basic paywalls that anonymous bots usually can't see.
- Your entire domain is fair game, not just links you post: Because the terms cover any domain "associated with your products or services" (or shared by regular users on Meta), Meta isn't just scraping the specific landing pages you run ads for—it has a green light to crawl your entire website from top to bottom.
- AI training is still allowed through a backdoor: Removing the word "train" is a PR smokescreen. The contract still lets Meta scrape your site to "develop, improve, and research... advertising and business products." Because "business products" isn't strictly defined—and Meta builds AI tools for businesses "developing" legally covers training AI models on your proprietary articles, data, and work.
- Third-party companies get the same access: The terms grant these scraping rights to "any entity acting on our behalf," meaning external contractors or third-party scraping vendors hired by Meta also have legal cover to harvest your site.
- It is a non-negotiable hostage situation (Zero Opt-Out): There is no toggle or form to reject this before the October 30 deadline. Your only legal way to decline is to completely delete your commercial presence across Facebook, Instagram, Threads, and WhatsApp—forcing you to choose between surrendering your content for free or losing access to your audience.
The Bottom Line: Starting October 30, their updated terms give it sweeping permission to scrape entire websites linked to any Meta Business account (Facebook, Instagram, Threads, WhatsApp). Despite a last-minute wording tweak after backlash, legal experts warn the rules still let Meta harvest publisher content to build AI tools—with zero option to opt out.
1. What Exact Things Can Meta Do?
If you have a Meta Business account, you authorize Meta (and its third-party partners) to:
a) Deploy automated bots: Use web scrapers, crawlers, spiders, and user agents on your site.
b) Bypass basic walls: Create "test credentials" to access, index, cache, analyze, and collect your content.
c) Monitor continuously: Periodically pull updates from your domains, web pages, and URLs.
2. What is the Extent of the Scraping?
- What gets scraped: Any domain, webpage, URL, or content "associated with" your business or shared by users on Meta platforms. Legal experts note this is broad enough to let Meta scrape entire websites, not just specific landing pages.
-
- Who it affects: Virtually every news organization and business that uses a Meta account to manage Facebook Pages, Instagram profiles, Threads, or WhatsApp channels.
How it expanded:
- Previously: Meta could only scrape your site if you specifically used its generative AI ad features, and only to "optimize your ads."
- Now: It applies to all business accounts by default, and scraped data can be used for all "advertising and business products" (plus platform security/integrity).
3. Why Legal Experts Say Meta's "Fix" Changes Nothing
After initial outrage, Meta revised the text on Friday to remove the word "train" and claimed it still respects robots.txt (the code websites use to block scrapers). Legal experts aren't buying it for three reasons:
- "Develop" still means "Train": Meta replaced "train" with permission to "develop, improve, research, and maintain advertising and business products." Attorneys point out that "business products" isn't strictly defined, and "developing" AI business tools naturally includes training AI models on your data.
- The robots.txt loophole: While a Meta spokesperson publicly promised to respect robots.txt flags, Meta refused to put that promise into the actual legal terms. Because robots.txt is voluntary, signing a contract that explicitly authorizes scraping legally overrides your robots.txt preferences.
- Take it or leave it: There is no opt-out. To avoid giving Meta permission to scrape their websites, businesses and news outlets would have to abandon Facebook, Instagram, Threads, and WhatsApp entirely before October 30.
still have the ability to disable the crawler via robots.txt flags
Never rely on robots.txt. Configure it, but do not rely on it. A bot will do what a bot can do. Their bots are trivial to spot so close the connection, bonus if done silently closing the socket and inhibiting first RST from web daemon and second RST from the OS.
I have been writing bots and scrapers for almost 20 years.
Not once have I had someone I work for in this capacity even ask about robots.txt
How much would I have to pay you for you to change careers permanently?
robots.txt can used as a reward mechanism. If an automated visitor that we would normally block begins by accessing robots.txt that's a good sign and we give that a plus score or whatever. If subsequent accesses from that visitor comply with robots.txt, we let them continue (perhaps with some rate checks).
Conversely, if an obviously automated visitor does not fetch robots.txt, that can be an instant ban, kind of like a reverse honey pot, if you will.
So it can have some nonzero value in the overall context; it's just silly to think of it as a blocking mechanism.
In short, robots.txt documents what access is allowed; it states the policy. Enforcing it the job of something else.
Someone you work for in this capacity shouldn't ask about robots.txt because that's the sort of detail for which they have you to deal with.
You are part of the problem, sounds like.
This implies the solution is every actor in the world willfully complying which doesn’t sound very realistic if you ask me.
Similar to saying world hunger would be solved in everyone who could donated $100 to those in need. Sure it may be true but foot stomping about why isn’t it organically happening is missing the point.
There is a clear difference between the global issue of famine and actively choosing to work for an arsehole corp.
The problem itself does not matter. If the nature of any solution relies on willful global compliance, it’s not going to be very effective at whatever it’s trying to solve.
Every society fundamentally relies on willful compliance. Sure, you can force a few outsiders, but once a sizeable population stops being compliant, it just breaks down.
Denied. One can choose not to be an active element in that problem.
So, what’s your proposed solution?
Yeah, calling this "disabling" it is inaccurate, it's just "asking nicely".
Yeah it reminds me of the typical copyright notice found in a book, even decades ago:
> All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without permission in writing from the publisher.
For AI, wasn't the book first "reproduced or transmitted" into a training system?
How would we reformulate it today?
Legal notices are designed to be as scary as possible so they usually say you can't do things that you actually can do.
See also: Nintendo
Wouldn't feeding them false data be even better?
That could consume as much, if not more, resources as returning real data
Returning some text files from the server fs is _wayyy_ lighter than letting the bot go through the search, middleware, and db while crawling your stuff.
Or just sending it a tiny zip bomb, or even just some sh*t right out of /dev/random
I'm not convinced that it's possible to poison AI. Real data all correlates, fake data is all unique in its own way. I suspect feeding AI fake data is a waste of time.
Angel banning is better, 100% agreed on giving it false data that the scraper builders can't easily detect. Give it seemingly correct and useful but totally wrong answers
Would you mind explaining what "angel banning" is? I've never heard this term before and even Google doesn't seem to know what it is.
I would assume it's exactly what they described, banning something by pretending to still helpfully assist them while silently undermining them instead.
We've already been using AI to target military strikes without human intervention.
Make of that what you will.
I'm a bit confused why people are freaking out about these term changes - Meta scrapes my website already on a fairly regular basis (even with robots.txt). Is the point of this change to justify more intense scraping?
I'm with you. I don't quite grasp the magnitude of response.
And they spend huge resource so that we can't scrap Facebook - our own feed.
> so that we can't scrap Facebook
Whilst I assume you meant to say “scrape”, I can’t help but appreciate the poetry of that typo.
You can but you'll probably want to do it with a browser extension or an undetectable webdriver.
I suggest doing it, actually. Could be a fun project. I suggest not making the script make any extra requests on your main account just in case - anything already on the page is free for scraping.
just rename the company to Meta Law or Zuckerberg & Associates already
Meta law actually sounds pretty good to me.
The valuable data to scrape is in the IDE of the expert and that expert getting challenges.
Does it really matter what they have "permission" for when they'll do it anyway?
Color me shocked... one of the most profitable companies in the world, that doesn't contribute anything positive to society, is unethical. Just another day in America that ends in Y.
Humanity experts warn oligarchs, "not good"
News at never.
Blocking by UA is pointless now, meta-externalagent rotates and a chunk comes off non-Meta ASNs. We matched on ASN plus TLS JA4 and that actually stuck.
TLDR;
The Danger List
Your robots.txt "Do Not Scrape" signs become legally useless: robots.txt is just a voluntary preference, not a law. While Meta says in PR statements that it will respect robots.txt, it left that promise out of the binding legal contract. By keeping your business account active, you are signing a contract that legally authorizes Meta to ignore your site’s block-lists.
- Meta can create fake accounts to bypass registration walls: The terms explicitly authorize Meta to "create test credentials" to crawl your site. Legal experts warn this gives Meta permission to sign up as a fake user to scrape gated content behind login screens or basic paywalls that anonymous bots usually can't see.
- Your entire domain is fair game, not just links you post: Because the terms cover any domain "associated with your products or services" (or shared by regular users on Meta), Meta isn't just scraping the specific landing pages you run ads for—it has a green light to crawl your entire website from top to bottom.
- AI training is still allowed through a backdoor: Removing the word "train" is a PR smokescreen. The contract still lets Meta scrape your site to "develop, improve, and research... advertising and business products." Because "business products" isn't strictly defined—and Meta builds AI tools for businesses "developing" legally covers training AI models on your proprietary articles, data, and work.
- Third-party companies get the same access: The terms grant these scraping rights to "any entity acting on our behalf," meaning external contractors or third-party scraping vendors hired by Meta also have legal cover to harvest your site.
- It is a non-negotiable hostage situation (Zero Opt-Out): There is no toggle or form to reject this before the October 30 deadline. Your only legal way to decline is to completely delete your commercial presence across Facebook, Instagram, Threads, and WhatsApp—forcing you to choose between surrendering your content for free or losing access to your audience.
The Bottom Line: Starting October 30, their updated terms give it sweeping permission to scrape entire websites linked to any Meta Business account (Facebook, Instagram, Threads, WhatsApp). Despite a last-minute wording tweak after backlash, legal experts warn the rules still let Meta harvest publisher content to build AI tools—with zero option to opt out.
1. What Exact Things Can Meta Do?
If you have a Meta Business account, you authorize Meta (and its third-party partners) to:
a) Deploy automated bots: Use web scrapers, crawlers, spiders, and user agents on your site. b) Bypass basic walls: Create "test credentials" to access, index, cache, analyze, and collect your content. c) Monitor continuously: Periodically pull updates from your domains, web pages, and URLs.
2. What is the Extent of the Scraping? - What gets scraped: Any domain, webpage, URL, or content "associated with" your business or shared by users on Meta platforms. Legal experts note this is broad enough to let Meta scrape entire websites, not just specific landing pages. - - Who it affects: Virtually every news organization and business that uses a Meta account to manage Facebook Pages, Instagram profiles, Threads, or WhatsApp channels.
How it expanded:
3. Why Legal Experts Say Meta's "Fix" Changes Nothing After initial outrage, Meta revised the text on Friday to remove the word "train" and claimed it still respects robots.txt (the code websites use to block scrapers). Legal experts aren't buying it for three reasons:- "Develop" still means "Train": Meta replaced "train" with permission to "develop, improve, research, and maintain advertising and business products." Attorneys point out that "business products" isn't strictly defined, and "developing" AI business tools naturally includes training AI models on your data.
- The robots.txt loophole: While a Meta spokesperson publicly promised to respect robots.txt flags, Meta refused to put that promise into the actual legal terms. Because robots.txt is voluntary, signing a contract that explicitly authorizes scraping legally overrides your robots.txt preferences.
- Take it or leave it: There is no opt-out. To avoid giving Meta permission to scrape their websites, businesses and news outlets would have to abandon Facebook, Instagram, Threads, and WhatsApp entirely before October 30.
Zuckerberg is an absolute sociopath, a cancer on the internet, he should've been shut down years ago