Meta Business Accounts Now Feed Its AI Training Data, With No Opt-Out, Lawyers Warn

Meta has rewritten the terms governing its business accounts in a way that legal analysts say amounts to blanket consent for AI training, according to reporting by ZDNet. The change covers data tied to Facebook and Instagram business profiles, and unlike the consumer settings Meta introduced after earlier privacy complaints, there is no opt-out switch attached. Lawyers reviewing the language say continued use of a business account now functions as agreement to the scraping.

The practical distinction between consumer and business accounts is the crux of the complaint. Meta previously let personal users object to their public posts and photos being used for model training, and European regulators forced the company to pause those plans in 2024 while it worked through GDPR objections. Business accounts sit under separate commercial terms, which Meta argues are a contract between the company and the account holder rather than a consumer relationship. That framing is what removes the opt-out, according to the analysts quoted in the ZDNet report.

What Meta is actually collecting is broad. A business account carries page posts, ad creatives, captions, product catalogs, customer messages routed through Messenger and Instagram Direct, and the engagement metrics attached to each. For a company that has spent years building ad-ranking and recommendation systems, that material is closer to labeled training data than the raw web scrapes its rivals rely on. Meta has not published a breakdown of which of those fields feed its models.

The timing matters because Meta is pushing hard on multimodal and agentic systems, and text paired with images, product metadata and real conversational turns is exactly the mixture those models need. Rivals have run into the same wall from the other direction: OpenAI, Google and Anthropic have all faced licensing fights over scraped content, while Reddit and Stack Overflow have signed paid data deals. Meta's advantage here is that the data arrives through a contract it wrote, so no third party can renegotiate the price.

For small businesses, the risk is less about the model and more about what leaks into it. Ad copy, unpublished product names, pricing tests and customer service transcripts can all carry competitive information, and once absorbed into a trained model there is no deletion mechanism that reliably removes them. Attorneys quoted in the report suggest companies review whether their marketing material contains anything they would not want reproduced elsewhere, and some may shift sensitive correspondence off Meta's messaging tools entirely.

The open question is whether regulators treat commercial terms as valid consent. Europe's data protection authorities have already questioned whether buried contract language meets the GDPR bar, and Meta's earlier training pause showed it will yield when pushed. Watch whether any business association or national regulator challenges the clause, and whether Meta adds a business-side opt-out before that happens.

Meta did not say when the terms took effect or how many accounts they cover.