AI agents have no rules, so Meta wrote its own

By Pete Pachal

Pete Pachal is a journalist and the creator of Media Copilot, a newsletter and podcast that examines how AI is changing media, journalism, and the news.

Why would anyone trust Meta? After all, this is the company that became the world's avatar for shameless and exploitative data harvesting.

The same data mastery that powers one of the most effective advertising platforms ever made also gave us Cambridge Analytica, whistleblowers like Frances Haugen and Sarah Wynn-Williams, and unflattering films like The Social Dilemma and, just this month, The Social Reckoning.

In the Axios-Harris Poll 100, Meta scored a lowly 59.6, down in the basement with ByteDance and X.

Publishers have their own reasons to be suspicious. Meta once vastly increased the reach of its properties, and even paid them for content, then abruptly took it all away when its priorities shifted. Meta has blocked news entirely in Canada since 2023, and briefly did the same in Australia in 2021.

So when Nieman Lab reported that Meta had changed its terms of service in a way that seemed to give itself permission to scrape the site of any company with a Meta Business account, nobody was inclined to give it the benefit of the doubt.

The new terms, which allow Meta to use automated tools to "access, index, cache, analyze, collect, retrieve, or crawl" websites "associated with" a business account, and to use that content to "provide, develop, improve, research, train" Meta products, could be interpreted as signing over to Meta the license to do whatever it wants with your content, including training its AI models or even offering up AI answers based on it.

Indeed, three legal experts Nieman Lab consulted warned publishers of exactly that danger.

Meta quickly backpedaled, sort of. Within a day, it removed the word train and limited scraped content to its advertising and business products.

A spokesperson insisted, "This is not about scraping news sites." That didn't calm anyone down. Legal experts said the revised language still permits mass scraping, and publisher groups on both sides of the Atlantic demanded a pause and filed complaints with regulators.

This week Meta pushed the effective date from October 30 to November 20. The U.K.'s News Media Association called the delay "a pause, not a solution."

What Meta probably wants

It's unlikely that Meta secretly changed its position on what has been, for the past three years, the single most important legal issue in how AI affects media, and then tried to bury it in a terms-of-service update.

The impetus for the change was likely more mundane: Meta says the crawling language came from folding its Ad Creative Generative AI Terms into its main commercial terms, and AI tools that build ads for a business presumably need to read that business's website. As Meta pushes further into agents like its Muse assistant, its bots will need to touch the open web more, not less.

But you don't have to be a conspiracy theorist to see how Meta stepped in it here. The change isn't irrelevant, and publishers should be concerned about how legal agreements are worded. And some of Meta's wording is hard to explain away.

The terms let Meta create "test credentials," which Cornell law professor James Grimmelmann said would let it sign up as a fake user to get past registration walls. There's no opt-out short of abandoning Meta's business tools.

And the change arrived just as Meta began charging some accounts, through its new Meta One subscription, to post links to the same content its bots could crawl for free.

And, as I said, Meta has wholly earned its reputation for not considering all the dimensions of how its actions can lead to disastrous consequences.

What Meta did here, and the media's understandable reaction, is a symptom of a deeper problem. Some will blame AI companies' thirst for data, or a Machiavellian quest to squeeze the media industry, but the real issue is a vacuum of standards and rules around what AI agents, and the crawlers that power them, can and cannot do.

Whoever holds the leverage writes the law

You can see this same issue in another freakout from the past week: an Axios report that banks were seeing a growing number of "unauthorized" AI agents accessing customer accounts.

While that sounds scary out of context, what it mostly represents is individuals using AI services to access their accounts and take actions on their behalf, not some kind of mass hacking event. Still, there are real concerns around agents the bank didn't sanction accessing customer accounts, not the least of which is liability when something (inevitably) goes wrong.

That's why JPMorgan Chase CEO Jamie Dimon told analysts earlier this month that letting in outside agents is "just too risky for clients and for JPMorgan," and the bank now blocks them from logging in. Schwab is doing the same while steering clients to its own AI assistant (a move that also happens to protect its lucrative cash business), and Citi doesn't allow third-party agents to log in either.

One of the agents getting locked out, incidentally, is Meta's own Muse.

In both cases, the platform saw either an opportunity or a gap with respect to AI usage, and as the party with leverage, it decided the rules. Which is exactly what happens when there are no rules - the person with the biggest gun gets to make them. When it comes to AI, and especially agents, we're all living in Tombstone.

We saw the same dynamic in last year's dustup between Perplexity and Cloudflare. To recap, Cloudflare accused Perplexity of using stealth crawlers to get around sites' bot-blocking preferences, and Perplexity insisted its agents were legitimate proxies for actual users, entitled to the same access.

Regardless of who you think is right, it's clear Perplexity had leverage when it was them versus individual sites. But when Cloudflare got involved, the equation changed. As the gatekeeper for a huge share of the web, Cloudflare delisted Perplexity as a verified bot and gave every customer a way to block its stealth crawlers.

Perplexity has since deputized itself in another matter, blocking ads that Time served to AI agents as "deceptive" without saying how it defines the term.

Who gets to be sheriff?

Certainly, the system would benefit from common rules and standards, and - to stretch the Wild West analogy - we're beginning to see the townspeople band together.

Collective organizations like SPUR (the Standards for Publisher Usage Rights coalition), now more than 80 publishers strong, are looking to establish standards for how publisher content is tracked and valued when AI systems use it.

And lawmakers are moving, too:

• The bipartisan Stealth Bot Prohibition Act in Congress would require crawlers to identify themselves and their purpose.
• And several states, including New York, have already passed their own versions, so any site that crawlers scrape - not just publishers - will have a better idea of what to do with them.

What this means for Meta and anyone else attempting to use their leverage to set the rules: You overreach at your peril. While legal departments will always default to grabbing the widest possible set of rights, that will arouse suspicion and mistrust in a world with no rules to govern those rights, and it's why it's not enough for a Meta spokesperson to simply say publishers can still block its crawler with robots.txt.

Putting those words in the actual terms of service, as WAN-IFRA, the global publishers' association, has demanded, would make clear to everyone what rules you think you're playing under.

The fact that those rules are up to Meta at all is the real vacuum. Right now, whoever holds the leverage decides what an agent can do with what it collects: Meta through its terms, JPMorgan through its login page, Perplexity through its index. A three-week delay doesn't change that.

Until someone builds a framework everyone has to follow, you can't blame publishers for circling the wagons whenever someone pins on a badge and declares themselves the new sheriff in town.