With Halloween approaching, Meta's lawyers are opting to trick rather than treat.
The tech behemoth is changing its liability terms for the output of its generative AI tools. The updated "Commercial Terms" govern who is legally and financially liable when Meta's generative AI tools make mistakes.
The changes were scheduled to take effect on Friday, October 30; however, due to widespread backlash, the date has been pushed back. Now scheduled for November 20, these new Commercial Terms state that Meta's business customers are “solely responsible for and assume any and all risks associated with such AI features and any resulting content.” Yikes.
Meta's proposed changes have garnered pushback from politicians on both sides of the aisle
Besides shifting AI output risk to its customers, Meta's new terms also involve new web-crawling permissions. According to the terms, Meta can use crawlers and bots to access and collect data from domains and URLs “associated with” a business’s products or services. Thus, Meta will now have contractual permission to pull data from enterprises' websites, although surely they were doing this before (at least on publicly-facing sites).
Meta has verbally said that they will adhere to robots.txt protocols—the signals that companies put up when requesting that their pages are not to be crawled; however, compliance with robots.txt is voluntary and companies' requests to not crawl aren't necessarily legally binding.
After the recent backlash, Meta removed the word "train" from its terms, suggesting that crawled content would not be used to "train" the company's AI tools; however, media and IP attorney Matt Topic believes Meta's replacement word, "develop," is broad enough to include training.
Senator Marsha Blackburn (R-TN) has described Meta's proposed changes as "attempting to exploit American creators and businesses by granting itself sweeping authority to scrape content from any website associated with Facebook and Instagram business accounts."
Likewise, Senator Adam Schiff (D-CA) has been appalled, calling for Meta to make changes to its proposed terms. Specifically, he'd like Meta to “provide explicit guarantees that external technical boundaries like paywalls and robots.txt protocols will be fully respected.”
Enterprises will certainly face new risks
Any enterprise using Meta Business Agent (Meta's customer-facing AI assistant tool on WhatsApp, Instagram, and Facebook Messenger) will face new risks, as will organizations using Llama or Muse.
Meta's Commercial Terms govern any use of Meta's products for business or commercial purposes. This includes running ads, managing Facebook pages, and operating WhatsApp business accounts.
According to Meta's updated Commercial Terms, any business that does not agree with the terms, "may stop all access or use of our products for business or commercial purposes." Very well. But unless enterprises opt to leave Meta's ecosystem altogether, there will be a need to manage the new risks.
Liabilities from AI tools' mistakes will shift to enterprises
To quote Meta's new terms directly, "You acknowledge and agree that AI features may make mistakes and may not always produce accurate, complete, or suitable results. You are solely responsible for and assume any and all risks associated with such AI features and any resulting Content, including evaluating the suitability of any Content for business or commercial purposes."
So if, while working on behalf of your business, Meta's Business Agent were to mishandle a customer complaint, botch a refund, or make unsupported advertising claims, your business would likely be on the hook for any financial and legal liabilities incurred. Given that Meta builds and controls the underlying AI models, this new accountability seems backwards.
Domain crawling
I won't cite the entire legal statement, but it begins with "You authorize us (or any entity acting on our behalf) to use automated software (such as web scrapers, bots, robots, spiders, crawlers, and user agents) and create test credentials to access, index, cache, analyze, collect, retrieve, or crawl the domains, web pages, or URLs (and any content available through them) that are associated with your products or services..."
This sounds to me like Meta intends to scrape the entirety of their customers' websites without much concern for copyright violation. Meta was likely already doing this for publicly-facing pages, but now they seem to be legally covering themselves to dig deeper. This would be my best guess.
Shadow AI and potential data exposure
As we know, when employees use unsanctioned, shadow AI tools for work activity, sensitive corporate data can be made public through data leaks.
With Meta's new legal terms placing AI risk firmly on its business customers, Meta's customers can now be on the hook for not only data exposure, but also any corresponding legal or financial liabilities as well. As an example, perhaps Meta scrapes sensitive business information and then Meta Business Agent is trained on that information. What could go wrong? This seems like a legal minefield.
These changes to its Commercial Terms come while Meta is embroiled in several other lawsuits
Meta was recently fined $25 billion by a New Mexico judge, who ruled that Facebook routinely lied about how it handles user data. In a scathing ruling, district court Judge Francis Mathew said, "The lies extend beyond Facebook's data practices as well. [They speak to] the heart of Facebook's core business practices."
An important AI copyright infringement case, Kadrey v. Meta, is ongoing as well. According to Maxwell Pritt, a partner at Boies Schiller Flexner LLP, Meta CEO Mark Zuckerberg was warned about the illegality of pirating works, but he gave his employees the go-ahead nonetheless. In Pritt's 2025 Senate testimony, he says Meta employees allegedly tried to hide the company’s behavior by moving a torrenting operation (via Library Genesis) from Facebook servers and onto AWS servers. A discovery order in this case took place on October 19, 2026.
Advice for enterprises that use Meta AI tools
If your organization uses Meta Business Agent, Llama, Muse, Facebook, Instagram, WhatsApp, or Messenger, there are some clear steps to take.
Firstly, assess what relevant tools, if any, your organization is using. Your IT department should ban shadow AI, especially the personal use of Muse on work devices.
IT can also prohibit employees from sharing public links of business content on Meta-owned properties. And it's worth considering blocking muse.ai and metaaiusercontent.com via DNS filters.
Secondly, be sure to do an audit of the content that currently exists on public pages (and in any shared links). Gate or remove any content you don't want crawled and used to train Meta's AI tools. Of course, sensitive corporate data should never exist on any Meta platforms.
Lastly, if you want to continue using Business Agent, or any other Meta AI tool, ensure that the AI deployments are adequately tested before they go live. Be sure to continuously check to ensure they are behaving as intended, and keep a human in the loop to review for accurate refunds, pricing, consumer messaging, and proper log keeping.
Continue to keep an eye on Meta's proposed changes to its Commercial Terms. Given the recent pushback, I wouldn't be surprised if they change the terms or delay the start date yet again.
