Let’s talk about the contract that took effect on Friday — the one you agreed to by carrying on.
Picture a hardware shop on the East Rand. Not a chain. One branch, two bakkies, a yard out back with paving stones stacked in pallets. In 2013 somebody’s cousin set up the Facebook page because that’s where the customers were. They post a special on cement every second Tuesday. They run fifty rand a day of ads in December.
That page is now a legal instrument.
On Friday, the thirtieth of October, Meta’s revised Commercial Terms and Self-Serve Ad Terms took effect. Every business account on Facebook, Instagram, WhatsApp and Messenger moved onto new terms at midnight. Nobody clicked anything. Nobody got an email with a box at the bottom. The terms themselves are explicit about that: if you do not agree to the updated terms, please stop all access or use of our products for business or commercial purposes.
That’s the whole choice. Accept, or leave the shop.
Two clauses do the damage, and they’re different kinds of damage, which is why neither one got the attention it deserved on its own.
The first is liability. There’s a new section on AI Features. It says, and I’m quoting the terms: AI features may make mistakes and may not always produce accurate, complete, or suitable results. Then it says the customer is solely responsible for and assumes any and all risks associated with such AI features and any resulting content.
Read that again, because the order matters. Meta builds the feature. Meta writes the sentence admitting the feature is unreliable. Then Meta hands the consequence to you.
And it isn’t just the features you choose. Adweek reported that the clause covers what Meta’s AI does to your ads, including features Meta switches on itself — the automated creative enhancements, the background swaps, the copy variations that appear in your account whether you went looking for them or not.
So here’s the scene I can’t get out of my head, and it’s not exotic. The AI rewrites an ad for the paving stones. It misreads the price sheet and writes R149 instead of R449. The ad runs all weekend. Four hundred people order at R149. The yard can’t fill it, the orders get cancelled, and somebody’s Saturday is gone.
Who eats that? Under the new terms, you do. Not because you were careless. Because a feature you didn’t enable, described in a document you didn’t read, produced output you didn’t approve, and the contract you agreed to by posting on Tuesday says the risk is yours.
Frank Dickson at Dickson Research put it better than I can. He said it turns accountability upside down. He’s right. This is the first time I’ve seen a vendor write the disclaimer and the transfer in the same paragraph and call it streamlining.
The second clause is quieter and, in the long run, worth more money.
The new terms authorise Meta to use web scrapers, bots, spiders, crawlers and user agents, and to create test credentials, to access, index, cache, analyse, collect, retrieve or crawl the domains, web pages or URLs associated with your products or services, and to periodically pull updates from them. And Meta may use any content from those pages to provide, develop, improve, research, train and maintain its products.
Train. That’s the word doing the work in a document that otherwise never mentions AI.
Nieman Lab had three legal experts read it. Matt Topic, a media and IP attorney, said this is a remarkable provision to bury in terms of service, because it gives Meta access to material that would likely cost many millions of dollars in a licensing market. James Grimmelmann at Cornell went further: on the broadest reading, Meta could build a comprehensive archive of everything you publish and serve it however it wants, including in competition with you.
The phrase that should make you sit up is “associated with your products or services.” Not “posted to your page.” Your website. The thing you own, that you paid a developer for, that you write yourself. It becomes reachable because a login you use for advertising points at it.
And “test credentials.” That’s new language. It wasn’t in the previous commercial terms, and it isn’t in the product catalog terms or the ad creative terms that got folded in. It means Meta reserves the right to hold a login to your site. Which is how a paywall stops being a wall.
Meta’s position, stated to both Nieman Lab and Ars Technica, is that nothing has changed. They say the crawling language was previously scattered across different documents and this consolidates it, that robots.txt still governs, and that any suggestion otherwise is false. That may well be true about their crawler. It says nothing about the liability clause, which is the one with a price attached.
Now. Same Friday.
The UK Competition and Markets Authority opened a formal investigation into whether those terms abuse a dominant position under the Competition Act 1998. Exploitative terms imposed on publishers and advertisers. Sarah Cardell, the CMA’s chief executive, said they moved quickly after hearing concerns. Meta says there are no grounds for an investigation. That will take a year or two to resolve, and by then the terms will have been in force for two Christmases.
Also same Friday, and this is the part that makes the whole thing legible: OpenAI, Google and Microsoft said they would honour a single shared line in robots.txt — a policy token called __usage_ai-training — so a publisher can opt out of AI training across every participating crawler with one directive instead of writing a rule for each company’s bot. The draft was written by Kevin Kelley at Anthropic and posted to the IETF that day. Anthropic is implementing it. OpenAI says in the coming months. Google says early 2027. Microsoft says the first of February 2027.
That is genuinely good news, and I want to be fair about it. One line, one purpose, machine-readable, no lawyers. Ten years of this industry’s scraped-everything habit and the best answer anyone could produce was a shared way to say please don’t.
Which is the whole problem.
Look at what got agreed on Friday and look at what didn’t. Four of the largest AI companies on earth agreed that a site owner should be able to state a preference in a text file, and that they would respect it — eventually, on a schedule that runs to 2027. In the same twenty-four hours, the largest social platform took a preference you never stated, turned it into a licence, attached it to a login, and made it binding.
A preference asks. A contract binds. That’s the asymmetry nobody is naming, and it’s not a technology problem. It’s a legal form problem. robots.txt has always been a request. Terms of service have always been an obligation. We spent a decade treating them as roughly the same thing because the crawlers mostly behaved, and Friday was the day the difference got priced.
Here’s what I think people are actually missing, and it’s not that Meta is uniquely evil. It’s that this is what a consent regime looks like when it’s built by the party that benefits from the answer.
Think about how consent is supposed to work. Somebody asks. You understand what you’re agreeing to. You can say no without losing your house. You can change your mind later. Those are four separate tests, and this fails all four. Nobody asked. The document is forty pages and the clause is three levels down. Saying no means closing the shop. And there’s no revocation — you can’t un-agree next year while keeping the customers you built on that page.
That’s not consent. That’s a toll booth with a signature line painted on the road.
And the thing that makes it durable is that it’s cheap to comply with and expensive to refuse. That’s the design. Not malice — incentive. A company with three billion users can name any term it likes, because the cost of the term is spread across millions of small businesses who each lose a little, and the cost of refusing is concentrated on the one business that would have to rebuild its entire customer acquisition from zero.
So what do you actually do about it? Five things, and none of them require a lawyer on retainer.
One. Save the version of the terms you’re bound by, with a date. Right now, today, download the PDF and put it in a folder with Friday’s date on it. When a dispute arrives in eighteen months and the live document has been rewritten twice, that archived copy is the only thing that proves what you agreed to. This is basic and almost nobody does it.
Two. Write the robots.txt token this weekend. Google won’t honour it until 2027 and Microsoft until February, but the cost is four lines in a text file and the value is that you have stated your position in writing, on a date, in a form the draft recognises. When the enforcement argument eventually happens, “we said no in October 2026” is a different sentence from “we assumed it was fine.”
Three. Find out who in your business owns the AI switch inside your ad account. Advantage+ creative, automated enhancements, background generation, text variations. If the answer is “it’s on by default and nobody’s looked,” then you are running the liability clause without a supervisor. Name a person. Give them a rule: AI creative runs only with a human read of the price, the claim and the fine print. That’s not bureaucracy, that’s the only control you have left.
Four. Put a line in your own contracts. If you buy marketing, design, copy or code from a supplier who uses AI, your agreement should say the supplier carries the risk of the tool’s output, or that they warrant a human reviewed it before delivery. You are about to be on the receiving end of this same clause from everyone you buy from. Pass it down or absorb it.
Five. And this is the strategic one. Stop letting your only storefront be an asset you don’t own. If every customer relationship you have lives behind a login somebody else controls, then every negotiation you ever have with that platform is a negotiation with your own hostage. Email list. Phone numbers. A site you own. Walk-in trade. Boring, unsexy, and the reason a two-person business survives a terms update that a marketing agency does not.
Now the deeper thing, because this episode isn’t really about Meta.
We are walking into an economy where machines read, write, decide and act on our behalf, and the only mechanism we currently have for governing that is a contract that one side writes and the other side accepts by continuing to exist. Every serious question about AI and human agency — who owns your likeness, who is liable when an agent acts, whether your data trains the next model, whether a machine may speak as you — will land in exactly this place. A document. A default. A checkbox that was already ticked when you arrived.
And the answer isn’t better terms. It’s portable ones. Consent that’s readable without a lawyer. Permission that’s scoped to a purpose and expires. A record of what the machine actually did, that you can hold in your hand. Proof that doesn’t require you to hand over your whole business to get it.
The industry proved on Friday that it can build that when it wants to. One token, one line, four companies. They built the “no” and then scheduled it for 2027.
What they haven’t built is the part where the answer is binding.
So here’s the principle, and I’ll keep it short because it deserves to be remembered rather than admired.
A no that costs you your livelihood is not a choice. It’s a formality.
Consent that you can only refuse by disappearing isn’t consent — it’s the paperwork of capture. And any system that calls that agreement needs to be told, plainly and in writing, that a human being is not a checkbox on somebody else’s form.
Read the terms. Archive them. Say no in the file where you’re allowed to say no, and say it early. Then build the parts of your business that don’t need anyone’s permission to keep.
You’ve got this.