Read The Fine Print

Nobody reads the terms of service. I don't. You don't. The lawyers who write them probably skim the parts they didn't write.

That worked fine for a long time, because most terms said roughly the same thing and nothing much happened to your stuff. AI changed the stakes. Your words, your files, your customer list and your website are now raw material, and the companies that hold them have started writing that into the fine print.

Three things happened in the last two weeks that are worth ten minutes of your attention. Then I'll give you the one hour audit I'd run this week if I were you.

Meta's updated commercial terms take effect October 30. According to reporting by Nieman Lab, the new language lets Meta crawl websites "associated with" business accounts on Facebook, Instagram and WhatsApp, and use what it collects to train its products. Meta's definition of products includes its AI. There's no opt out. If your business account keeps using Meta's tools after October 30, you're treated as having agreed.

Nieman Lab's angle was newsrooms, because nearly every publisher runs a Meta business account. But read it again with your own business in mind. If you've got a Facebook page, an Instagram business profile or WhatsApp Business, and a website linked to it, you're in the same boat as the newspapers.

Two caveats, to be fair. The reporting doesn't explain how Meta decides which sites count as associated with an account. Meta's side, as quoted in the coverage, is that it's just consolidating terms it already had and its crawling won't change. Media attorney Matt Topic called it a remarkable provision to bury in the terms, and said publishers should assume a court would enforce it.

I'm not your lawyer, and I'm not telling you to quit Instagram. I'm telling you to know what's on your website before October 30.

On October 12, Meta released Muse Wonder, its first frontier model, and a bigger sibling called Muse Wonder Full. The full version isn't available through Meta's developer API. You only get it inside Muse Code, Meta's coding app, on the $50 and $200 monthly plans.

Here's the catch. Muse Code subscriptions default to something Meta calls Contributor mode. In exchange for more usage, Meta can use your prompts, code, files and outputs to train future models. You can turn it off at any time, but turning it off only covers what you send from then on. Whatever went in before stays in. Meta's own terms tell you not to send confidential or personal information while Contributor mode is on.

Think about who's likely to try a new coding tool. It's your developer, your ops person, or the guy at your agency who builds your automations. They sign up, paste in a script to see what it can do, and that script has your API keys, your customer database structure and your pricing logic in it. Nobody meant to donate any of that. The default did it for them.

404 Media reported on October 15 that ChatGPT's ad system lets advertisers target people by uploading email addresses, phone numbers or device IDs, and that ads are also targeted based on what people type. The reporter, Joseph Cox, said he set it up himself in about five minutes.

Uploading a customer list for ad targeting isn't new. Meta and Google have done it for years. What's new is where the ads land: inside a conversation where people describe their problems in far more detail than they'd ever type into a search bar.

Two takeaways for a business owner. First, your competitors can upload a list too, and if they've got your customers' emails from a trade show or a shared vendor, they can follow them into ChatGPT. Second, if you ever run ChatGPT ads yourself, the customer list you upload has to be one your privacy policy actually covers. Which brings us to the audit.

All three come down to the same thing: defaults. Somebody else decided what happens to your data unless you go find a switch. Sometimes there's a switch. Sometimes, like with Meta's terms, there isn't.

Your best defense is a list of your tools and what each one is allowed to do with what you feed it. Most small businesses can't answer that today. They're not careless. AI just got into the building through a dozen side doors. A free account here, a browser extension there, a feature that switched itself on inside an app you already pay for.

That last one is real, by the way. Google's new Gmail Live, which lets you ask questions about your inbox by voice, started rolling out on October 15 and is on by default for Workspace organizations with Gemini access. It's genuinely useful. It's also one more model reading your email, and nobody asked you first.

Open a sheet. Eight columns: tool, who uses it, personal or business account, what goes into it, training setting, who owns the company now, last reviewed, and action needed. Then run four passes.

Start with the obvious ones: ChatGPT, Claude, Gemini, Copilot, Grok. Then go hunting for the hidden ones.

AI features inside tools you already pay for. Your email, your CRM, your helpdesk, your design tool, your accounting software. Most of them added AI in the last year and many switched it on by default.

Meeting notetakers. Anything that joins or records calls.

Browser extensions. Ask your team to open their extensions page and send you a screenshot. You'll find things.

The tools your contractors use on your work. Your developer, your designer, your VA. If they paste your stuff into their personal AI account, it's your stuff in their account.

Apps connected to your platforms. Go High Level now has an official Muse by Meta app in its marketplace, for example. Every connected app is another set of terms.

For each tool, note whether your people use a personal account or a business account.

This matters more than anything else on the sheet. The big AI companies generally treat their business and enterprise plans differently from consumer plans when it comes to training. Business plans usually don't train on your data by default. Consumer plans usually have a setting, and the default isn't always the one you'd pick.

Don't take my word for any specific vendor. Policies change, and they've changed a lot this year. Open each vendor's help center and search the word "train." The answer for your plan is usually in the first two results.

The most common finding in this pass: someone on your team is using a free personal account for work because the company account felt like a hassle to set up. That's your leak, and the fix is making the company account easy to get.

For every tool that has a training or data sharing setting, find it and decide.

Look in settings for words like data controls, privacy, improve the model, model training or contributor. Note what it was set to and what you changed it to. If a tool has no setting and no business plan, write that down too. That's a tool to replace or restrict.

While you're in there, check retention. How long does the tool keep your conversations or files? Some let you set it. Shorter is almost always better for business data you don't need to keep.

Then check ownership. Has the company been bought recently? Fathom, which I've recommended here before and still use, was acquired by Superhuman in September. Superhuman says it plans to bring Fathom's meeting notes into its email, docs and agents. That could be great. It's also exactly the moment to reread the settings, because acquisitions are when terms get rewritten. Same rule for any tool: new owner, new review.

Some terms don't come with a switch. Meta's October 30 change is the obvious one this month. For those, your only lever is what you leave within reach.

Go through your website with one question: is there anything here I'd be upset to see inside an AI model?

For most businesses, the answer for most pages is no. Your homepage, your services, your about page. You want those read, summarized and recommended. That's marketing.

But some businesses publish things that are actually the product. Detailed pricing calculators. Course content. Member resources. Long playbooks that took years to figure out. Original research. If that's on a public page linked to your Meta business profile, decide now whether it should move behind a login.

If content is your business, as in you're a publisher, an educator or a membership site, this is worth a real conversation with an attorney before the 30th. The rest of us can make a sensible judgment call.

The audit finds the leaks you've got, and a simple rule stops most of the next ones. Here's the one page AI use rule I'd hand every employee and contractor this week. Keep it short enough that people actually read it.

Use the company account for company work. Never a personal AI account. If you don't have a company account for a tool you need, ask and we'll get you one.

Never paste these into any AI tool: passwords, API keys, card or bank numbers, social security numbers, customer health or financial details, or anything a client told us in confidence.

Ask before connecting. Don't connect a new AI tool to company email, files, the CRM or the calendar without checking first.

New tool? Tell us. Trying something new is fine. Tell us what it is so it goes on the list.

When in doubt, strip it. Replace names, numbers and company details with placeholders before you paste.

That's it. Five lines. Put it in your onboarding doc and your contractor agreements.

The audit's only useful if it stays current, and nobody remembers to redo a spreadsheet. Two small automations keep it alive.

Catch the terms emails. Every vendor sends an email titled something like "updates to our terms." Most of us archive it unread. Set up a scenario in Make.com that watches your inbox for messages with words like terms, privacy policy or data processing in the subject, then adds a row to your audit sheet with the sender, the date and a link to the email. Now every terms change lands in front of you instead of in the trash.

Summarize the change. Add one more step that sends the email text to a model with this prompt:

Don't skip that last line. A model will happily summarize a document it never read, and sound sure about it.

Put the review on the calendar. Fifteen minutes, first Monday of every quarter. Open the sheet, scan the new rows, check one tool you haven't looked at in a while.

A business that's handled this has a few simple things in place. A single list of every AI tool, with who uses it and what goes in. Company accounts for company work. Training switched off wherever it can be, and a short list of tools where it can't, with a decision written next to each one. A five line rule that every employee and contractor has seen. And a quarterly fifteen minutes that keeps it current.

You can do all of it in an afternoon. It's just the kind of thing nobody does until the day a customer asks, "Wait, where did you put my information?" You want an answer ready that doesn't start with "Well..."

The AI companies are going to keep changing their terms. Some changes will be fine, some won't, and you won't catch most of them by reading the news. The audit flags the changes that matter, so you can skip reading the rest.

Make the audit sheet with the eight columns above.

Ask your team and contractors for a screenshot of their browser extensions and a list of every AI tool they've used for work this month.

Search each vendor's help center for the word "train" and set every switch you can find.

Walk your website with one question: would I be upset to see this inside a model? Move anything that's actually the product behind a login before October 30.

Send the five line AI use rule to everyone who touches your business.

Then build the terms email scenario so next quarter's audit starts itself.

Jordan

The AI Newsroom | Practical AI for people with a business to run.