Meta Revokes Scraping Clause, Limiting Data Access to Ads Only, Shielding News Sites

Meta has updated its terms of service to remove language that suggested the company could scrape websites associated with business accounts. According to The Verge, the social media giant clarified that the previous provision applied strictly to ads and business products, not general website content.

Root cause

The original terms of service included wording that security experts interpreted as granting Meta permission to scrape external websites. This language linked the scraping right to business accounts, creating ambiguity about the scope of data collection. The Verge reports that experts believed this clause allowed the scraping of news sites to train artificial intelligence models. Meta has now removed this specific language to eliminate that interpretation.

Attack path

There is no technical attack path involved in this change. The issue was contractual and legal, relating to the permissions granted by users through the terms of service agreement. The "attack" was a potential overreach in data collection rights, where the broad wording could be used to justify scraping web content beyond the intended advertising scope. This was a policy adjustment, not a software vulnerability or exploit.

Affected versions

This change affects the current terms of service for Meta business accounts. There are no specific software versions, CVE IDs, or patch levels associated with this update. The modification applies to the legal framework governing how business accounts are managed and what data Meta can access. All existing business accounts are subject to the revised terms moving forward.

Mitigation

• Review the updated terms of service for any changes to data usage rights.
• Audit which websites are linked to your Meta business account.
• Ensure that data sharing permissions align with your compliance requirements.
• Monitor for further updates to Meta's data collection policies.

Why it matters

Teams usually review terms of service to understand data rights and liabilities. This change clarifies the boundary between advertising data and general web content. It highlights the importance of precise language in legal agreements, especially regarding AI training data. Organizations should check whether their current data sharing practices rely on broad interpretations. Clear terms reduce legal risk and ensure compliance with data protection standards.

What to do and how to stay safe: Meta

• Check your business account settings to see which websites are linked.
• Review the updated terms of service to understand new data usage limits.
• Consult legal counsel if your business relies on broad data scraping rights.
• Monitor Meta's announcements for further policy changes regarding AI training.

Step-by-step guide: Stop Sensitive Data Leaks in AI Chatbots: Priority Controls

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What did Meta remove from its terms of service?

Meta removed language that suggested it could scrape websites associated with business accounts.

Why did Meta make this change?

Meta clarified that the language applied only to ads and business products, not general scraping.

Did experts believe the old terms allowed AI training?

Yes, experts said the language allowed scraping news sites to train its AI.