I mean, this is fine. The “content” most businesses publish where meta can see it is all sanitized advertising nonsense anyway. This will create for meta the least useful ad generator; assuming that such a thing could actually be useful.
Very tempting to take a list of IP address ranges such as https://networksdb.io/ip-addresses-of/meta-platforms-inc and add them to our WAF blocklist, since I assume they won’t be honest about their user agent string when scraping.
I mean, this is fine. The “content” most businesses publish where meta can see it is all sanitized advertising nonsense anyway. This will create for meta the least useful ad generator; assuming that such a thing could actually be useful.
To be clear, this is not restricted to content posted on Facebook. It’s any content posted on any website owned by the customer.
And specifically gives Meta the right to create “test credentials” on sites and scrape resultant deep content such as product docs that are only available with an account. This is far more invasive and concerning than traditional site scraping and indexing.(refs: https://www.theregister.com/ai-and-ml/2026/10/16/meta-grants-itself-right-to-scrape-content-from-business-customers-for-model-training/5303658 , https://m.facebook.com/legal/commercial_terms_preview )
“test credentials” just reads to me as them giving themselves permission to straight up pen test every business with a social media account.
Very tempting to take a list of IP address ranges such as https://networksdb.io/ip-addresses-of/meta-platforms-inc and add them to our WAF blocklist, since I assume they won’t be honest about their user agent string when scraping.
Except there’s no guarantee they’ll be coming from one of their own IP addresses. There’s nothing to stop them from using a residential botnet.
All too true, unfortunately. No honor among thieves!