Starting October 30, 2026, Meta will be allowed to crawl your business website

This is a new addition to Meta's Commercial Terms. Following pushback from press outlets, Meta removed explicit wording allowing scraped content to "train" its products, but retained the full crawling rights. The only levers store owners still control are their robots.txt file—deciding which Meta bots can enter—and how they draft their privacy policy pages.

Crawling rights are no longer tied solely to running ads

If your store runs ads, Meta already had these rights. The Self-Serve Ad Terms dated August 22, 2025, granted Meta permission to collect content on an advertiser's website when running ads, for purposes including research and model training, as Search Engine Journal noted when comparing term revisions.

The update expands this right to any store using Meta for Business—even if you just maintain a Page without spending a dime on ads.

Specifically, Meta is authorized to use automated software and generate test credentials to access, index, cache, and collect pages associated with your products or services, periodically scraping updated content. Cornell Law Professor James Grimmelmann pointed out that test credentials could allow Meta to sign up as a mock user to bypass gated registration pages.

The initial draft explicitly stated that Meta could use scraped content to train its products.

On October 17, news outlet Nieman Lab reported that Meta removed this phrasing, according to Search Engine Journal. The terms preview as of October 20 lists purposes limited to providing, developing, improving, researching, and maintaining Meta ad and business products, as well as maintaining product safety and security. Crawling rights and test credential generation remain intact.

Meta spokesperson Daniel Roberts claimed the update does not change how the company uses web crawlers. However, Matt Topic, a media and IP lawyer at Loevy & Loevy, interprets the legal language differently:

"I think the word 'develop' is broad enough to encompass 'training.'"

In short: relying solely on the terms won't tell you whether your site content is being fed into AI models. Store owners who want to know what each specific bot does will need to dive into Meta's technical documentation.

Block AI training bots, but don't block all of Meta

Meta states that businesses retain control over access via robots.txt. Meta's web crawler documentation separates its two AI-related bots by purpose:

• Meta-ExternalAgent: Scrapes data to train AI models or index content for AI products.
• Meta-WebIndexer: Powers search within Meta AI, allowing Meta to quote and link back to your pages.

This means you can block the training crawler while leaving the door open for the search crawler. Blocking any bot comes with trade-offs, and there is no clear data yet on which choice delivers a net benefit.

Additionally, two other crawlers—Meta-ExternalFetcher and FacebookExternalHit—may bypass robots.txt under certain conditions. University of Wisconsin Law Professor Benjamin Sobel also noted that robots.txt merely signals a site owner's intent, rather than acting as a legally enforceable barrier.

If you don't want your content used for AI training, Meta's designated crawler for this task is meta-externalagent. If you block the remaining bots, your store risks losing product image previews and titles when shoppers share links, or missing out on backlink citations generated by Meta AI.

Keep in mind that robots.txt has its limits. The Commercial Terms make no mention of the file, making it unclear whether blocking a bot legally overrides the broad consent you've granted. Meta told Nieman Lab that the update doesn't give the company new powers to override robots.txt settings, while Professor Sobel reminded webmasters that respecting robots.txt is entirely voluntary—site owners have no legal leverage to force bots to comply.

What should Shopify merchants do right now?

Action items before October 30:

• Audit your current file: Go to yourdomain.com/robots.txt and look for meta-externalagent. If you don't see it, your store hasn't set custom rules for this bot.
• Block the AI training bot if desired: Add the following two lines at the very bottom of your theme's robots.txt.liquid template, right after the default Liquid code. If your theme lacks this template, create a new one via "Add a new template," select robots, and follow Shopify's instructions. Shopify warns that Support won't assist with editing this file, and incorrect edits can wipe out your site traffic—so only add rules rather than replacing the whole file. Meta can take up to 24 hours to pick up the change.

User-agent: meta-externalagent
Disallow: /

• Keep high-converting bots active: Allow facebookexternalhit to run normally if you want product links to render rich preview images when shared, and keep meta-webindexer active if you want your store cited in Meta AI responses.
• Review gated and sensitive information: Wholesale price sheets or client-only portal pages shouldn't rely solely on robots.txt, nor should they sit behind basic pages that only require a simple account signup to view.

If you're an agency or freelancer building stores for clients, note that Shopify does not export robots.txt.liquid when uploading themes from the Themes dashboard. You'll need to re-apply these rules every time a client switches themes.

Meta revised its preview terms just days after announcing them, so give the final text another read before October 30. In the meantime, the best move for store owners is to control which bots get access and move sensitive data off public-facing pages.