Permission used to be something an advertiser or a reader gave. In the 24 hours to Saturday morning, more of it was simply written into terms, defaults and protocols by the companies that collect it, while the people asked to give it showed signs of saying yes without meaning it.
The clearest case came from Meta. Its revised Commercial Terms, which take effect on October 30, 2026, add a clause to Section 1 that lets the company use automated software and test credentials to access, index, cache, copy and re-crawl websites linked to a business's products, and to use that content to train its own products. PPC Land reported on October 16 that Meta's new terms let it crawl business websites to train AI from Oct 30, replacing a version dated March 6, 2024. Nieman Lab reporters Andrew Deck and Hanaa' Tameez first described the change on October 15.
Acceptance is passive. Continued use of Meta's commercial products counts as agreement, and there is no partial opt-out. The terms do not mention robots.txt, and Meta-ExternalAgent, the crawler involved, is a mixed-use agent rather than one dedicated to a single purpose. Andy Stone, a Meta spokesperson, said on October 16 that the clause is narrower than critics suggest. "This update is designed to make sure we're able to pull accurate information about products for sale on third-party websites when making on-platform ad and content recommendations, not about scraping news sites," he wrote.
Luis Rijo
Jason Kint, chief executive of Digital Content Next, read the same text differently. "This reads that Meta is looking to grant itself the rights to scrape websites across the open web," he posted, in a thread that drew about 45,500 views against roughly 3,679 for Stone's reply. Matt Topic, a media and intellectual property attorney at Loevy & Loevy, offered the practical view: "It's not clear whether a court would enforce this, but publishers should assume that it would be enforceable."
The rest of the document points the same way. A new AI features section sits at Section 5, the service is supplied "AS IS", the indemnity is wider, five sets of supplemental terms hang off Section 8, and clause 9(g) lets Meta discontinue products. Liability is capped at the greater of $100 or the fees paid in the previous twelve months. US businesses go to individual arbitration; disputes outside the US can go to courts in California or Ireland. The timing places the new rights two days after October 28, when Meta switches on in-app product browsing in existing ads, a default PPC Land covered in the previous edition.
Meta's appetite for crawling is not new. Its share of AI crawling rose from 0.9% to 7.5% between July 2024 and July 2025, and its Muse agent took 33% of agentic browser traffic within nine days of launch. What is new is the contractual footing: the businesses that buy Meta ads are also the ones whose sites it may now copy.
Publishers have been trying to put a price on that copying, and one of them described its terms on the same day. Jessica Davies reported for Digiday on October 16 that Reach's chief executive is presenting its Google AI deal as a template while stepping up pressure on OpenAI over scraping. Piers North, who runs the owner of the Daily Express, Daily Star and OK! Magazine, has agreed a deal that Digiday understands runs for two years and gives Google paid, expanded rights to Reach's UK and Ireland news content for its news AI pilot and experimental AI features. The amount is undisclosed. More than 200 publications have joined the Google pilot.
"We have set out the rules of the game," North told Digiday. "We see this as the first of a number of deals that we will do." Reach is in talks with Amazon, Google, Meta and Microsoft. With OpenAI the relationship has turned adversarial: Reach has sent a cease-and-desist letter, which it calls the next stage in the legal process, and cites well over 100 million successful scrapes across its portfolio in six months, based on its access logs. On the same Friday, Adweek's TVNewser reported in its daily Ticker on NBC News' Dateline heading north of the border that CNN has joined Google's news AI pilot in a multi-year partnership that includes content rights for experimental generative AI features.
The contrast is instructive. Google is buying rights from publishers one contract at a time; Meta is writing them into the terms its advertisers accept by default; and OpenAI, in Reach's account, is taking content without either.
Consent under strain
If platforms are drafting their own permissions, the formal consent systems meant to govern data use are struggling to keep up. A group of 65 researchers, 36 of them affiliated with Google, published a report arguing exactly that. PPC Land reported on October 16 that consent can't keep up with AI agents, 65 Google-led researchers argue. The paper, titled "Open and Emergent Problems in Agentic Privacy and Security: A Contextual Angle" and led by Eugene Bagdasarian and Lillian Tsai, lists 51 open problems, eleven of them concerning identity, authorisation and accounting. It grew out of a workshop in New York in November 2025 and appeared on the Google Research blog on October 5.
The core argument is that agents act faster than people can review what they do, so prompts and static permissions produce fatigue rather than control. The report calls consent "an approach whose efficacy had already been called into question in the pre-agentic era". Its proposed alternative is a "contextual policy engine" that sits beside the planning model and turns social norms into machine-checkable policies that allow, deny, modify or escalate each action. It contains no experiments. Caitlin Fennessy, vice president and chief knowledge officer at the IAPP, summed up the reaction on LinkedIn: "Consent as the primary governing mechanism seems unworkable in an always-working agentic context."
Consumers appear to agree, at least in their behaviour. 16% grant AI data access reluctantly, 7% willingly, Usercentrics finds, PPC Land reported on October 16. The Munich consent platform's 12-page "Resigned Consent Report", based on Sapio Research fieldwork among 11,000 consumers in seven markets in March 2026 and published on September 29, defines resigned consent as granting an AI system access to data while uncomfortable doing so. Overall, resigned users outnumber the fully comfortable by about 2.3 to 1, and 58% report some discomfort.
The split varies by data and by country. For financial accounts, 6% are fully comfortable, 14% resigned and 24% would stop using the AI tool. Germany has the most resigned users at 24%, the Netherlands the highest refusal rate at 31%, and the US the fewest resigned at 10%. Age matters less than expected. "Age doesn't decide how reluctant a 'yes' is. It decides how often someone gets to yes in the first place," the report says. Its conclusion runs against the interests of most consent vendors' clients: "The goal isn't a higher yes rate. It's a more honest one." The press release puts the resigned figure at 17%, a point higher than the report itself.
The machinery of consent
The plumbing behind those yes and no answers changed in small ways too. Google AdSense removed its standalone downloadable TCF error report and moved those errors into the Policy center, PPC Land reported on October 16 in AdSense drops TCF error report as consent errors move to Policy center. The errors, which affect publishers with ad requests from the EEA, the UK and Switzerland, now sit under a "Regulatory issue" category. "These TCF errors are now surfaced in the Policy center, bucketed under the 'Regulatory issue' category," Google's help page, dated October 15, says. Sites are sorted by affected ad requests, with the share of restricted or disabled requests, CSV export and email alerts. It is unclear whether the old report's error codes, its seven-day detection window and app-level detail carry over.
New entrants keep joining the framework those errors describe. Singapore's Lacuna, a programmatic company founded in 2022, registered as a vendor in IAB Europe's Transparency and Consent Framework, PPC Land reported in Singapore's Lacuna gains TCF vendor ID 1648 for European consent signals, announced on October 16. "Programmatic growth and respect for user privacy should advance together," said Michael Wang, its chief executive. The release did not list the purposes or legal bases Lacuna claims. Registration is a minimum condition rather than a certification: IAB Europe ran 587 enforcement procedures in 2025, up from 269, and suspensions rose from 23 to 41.
Browsers are setting their own limits, regardless of what a consent string says. PPC Land reported on October 16 that Safari cuts server-set cookies to 7 days on cloaked tracking subdomains, drawing on a September 30 analysis by Mariusz Brucki, founder of Measurelake, for the Dutch server-side tagging host TAGGRS. When a tracking subdomain on the same site resolves to an unrelated network, for example one IPv4 and one IPv6 address, or two IPv4 addresses sharing fewer than 16 leading bits, Safari caps the cookie at seven days. "Safari treats it as disguised tracking and caps that cookie at seven days," Brucki wrote. The rule dates from Safari 16.4 in March 2023. Returning visitors are then counted as new. "The visitor didn't change devices or clear their cookies," he noted. TAGGRS sells the same-origin routing that avoids the cap, and the piece is candid about its limits: "It does not create more visitors or conversions."
Rules for gatekeepers
Regulation moved in Luxembourg. Advocate General Andrea Biondi advised the Court of Justice of the European Union to dismiss the parts of ByteDance's appeal he examined against TikTok's designation as a gatekeeper under the Digital Markets Act, PPC Land reported in TikTok gatekeeper appeal should be dismissed, EU court adviser says. The opinion in Case C-627/24 P was delivered on October 15, 2026, after a hearing on May 12, and is the first DMA case to reach the higher court. Biondi set the bar a company must clear to rebut the gatekeeper presumption: "the standard of proof required by Article 3(5) amounts to a high degree of plausibility." Merely casting doubt is not enough. He rejected ByteDance's arguments on its ecosystem, multi-homing by users, its young audience and business dependency. The opinion is not binding, no judgment date has been set, and the outcome bears on pending Meta and Apple cases.
Agents at the controls
The agents the researchers worry about are already doing more. PPC Land reported on October 16 that ChatGPT gains control of Chrome tabs to fill forms and send messages. OpenAI announced on October 15 that its Chrome extension can read open tabs in Chat mode and, in Work mode, operate them: sending messages, filling in forms, downloading files and grouping tabs. "We're bringing the power of computer use to anyone who uses Chrome," the company posted, in an announcement that drew 1.2 million views. The move follows the closure of OpenAI's own Atlas browser on July 9, 2026, less than nine months after its launch. OpenAI has not said which plans get tab control, what confirmation prompts apply, how long data is retained or which countries are covered. Chrome carries about two-thirds of global web traffic, and ChatGPT's own advertising business passed a $1 billion annualised run rate in late August.
Shopping agents need merchants to cooperate, and the evidence on that was thin. Brandon Lazovic, an SEO data engineer, examined how Google's new shopping product talks to retailers, and PPC Land reported on October 16 that Google's Universal Cart calls retailers once and only at transfer. Saved items sit on Google's side, and the retailer receives a single cart request when the shopper moves to its site. Google's Cart API reference says the system "does not fire multiple API calls as items are added." That keeps the merchant blind until the end. "Neither report counts a product saved to the cart," Lazovic wrote of Merchant Center's reporting, which starts at "Clicks to Buy". Of eight merchants named at launch, only Steve Madden and Fenty Beauty, both Shopify stores, returned a Universal Commerce Protocol profile; six returned 404 errors. Lazovic labels the test unverified. "Absence from a launch post does not prove a feature is missing," he cautioned.
Netomi wants AI inside the website rather than beside it. Mark Stenberg reported for Adweek on October 16 that the Katzenberg-backed Netomi is expanding its leadership as it bets on AI-tailored websites. Justin Wexler, a longtime general partner at Jeffrey Katzenberg's venture firm WNDR who has spent five years on Netomi's board, becomes president, and Ryan Boughan, former president and chief operating officer of the CMO network PTTOW!, joins as senior vice president of growth. The company, led by founder Puneet Mehta, "tries to move AI out of the chat window in the corner of a website".
Measurement companies are making the same bet. Alyssa Boyle reported for AdExchanger on Friday that VideoAmp bets on AI to connect ad planning and measurement. The company, re-certified last month by the JIC alongside Comscore and iSpot, cut about 20% of its staff over the summer and plans to link planning to AI agents that can shift spend mid-flight, for example to grow unique reach. "We wouldn't be prudent if we didn't take advantage of the promise of AI, which is to make workflows more efficient," said Andrea Zapata, senior vice president of agency partnerships. Chief product officer Josh Hudgins stressed that this depends on clean rooms, ACR data and publisher log-level integrations that can take years to build. "Ultimately, what we're all trying to get is outcomes," Zapata said.
Google is speeding up the pipes for such systems. Search Engine Roundtable's Barry Schwartz reported on October 16 that the Google Ads API will move to two releases a month starting with version 26, up from the monthly cadence announced last year. Google framed it in agentic terms: "As we enter a new agentic era where speed and agility are paramount". Fewer releases are planned around January, and some may be skipped over the holidays.
Signals, recovered and counted
Measurement shifted inside Google's own stack. In Floodlight gains Google signed-in data to recover unattributed conversions, PPC Land reported on October 16 that Google's Display & Video 360 roadmap for the fourth quarter, updated that day, lists three changes dated November 2026. Floodlight will use Google signed-in data to recover previously unattributed cross-device and cross-environment web conversions in DV360, Search Ads 360 and Campaign Manager 360 reporting, with no action required. The advertiser-level Brand Control Center will be retired, and the audience provider Amerilink will be renamed Open Audiences in Data Onboarder reporting. Google gave no volume estimate and no detail on how recovered conversions will be labelled.
DV360 also tightened what YouTube ads must carry. PPC Land reported that Google's DV360 now requires a business name and logo on YouTube ads, under a release note dated October 12. The assets used to be taken from the YouTube channel hosting the ad. Names are limited to 25 characters and logos must be square and at least 128 by 128 pixels, and a rejected name or logo disapproves the whole ad. The release note says the rule covers "all YouTube line items", while the help page excludes ad sequences, audio ads and Masthead.
Attribution in Google Ads gained a new view for upper-funnel campaigns. PPC News Feed reported on October 16 that Demand Gen gets Campaign Type Attribution in beta, which gives Demand Gen full credit in the conversion path rather than sharing it with Search and Performance Max, making comparisons with Meta and TikTok easier. It requires data-driven attribution on all conversion actions, and standard GA4 imports are not supported.
Retailers want a stricter measure of what ads achieve, and advertisers are hesitant. Mitchell Parton reported for Adweek on October 16 that Target is pitching an ad metric to drive sales, but most brands aren't fully on board. Shawn McGahee, senior director of performance and insights at Roundel, Target's retail media network, told an advertiser event in New York that only 8% of Roundel's advertisers use incrementality as their primary performance metric, even after years of encouragement.
How Google's machines behave
Google spent part of the day explaining its automation. PPC Land reported on October 16 that a Google Ads PM says target or budget changes cause no learning period. In an Ads Decoded episode published on October 15, Tal Akabas told host Ginny Marvin that Smart Bidding keeps the data it already has when a steady-state campaign's target or budget changes, so "nothing's going to reset in the back end and throw everything off." He also gave rollout dates: promotion mode leaving beta on Search and Performance Max, re-engagement-only mode arriving in Performance Max with Search and Shopping to follow before the holidays, and a new budget planning tool. His timings did not always match Google's written material. Channel controls arrive "over the coming weeks" in the episode and "over the next months" in Google's October 14 blog post.
Organic search was less settled. Schwartz reported on October 16 that Google Search ranking volatility and chatter spiked over the previous 24 hours, little more than a week after the September 2026 spam update finished on October 8. One WebmasterWorld poster wrote: "Something changed during/after the spam update." Another added: "Sigh, was hoping that the end of the update would stabilize things, but it's just made them worse."
Google also rewrote its Indexing API documentation without much explanation. Schwartz reported that Google updated its Indexing API quota information, removing the stated default quota of 200, the request-form language and a Quickstart passage recommending the API over sitemaps for short-lived pages. Google announced only the quota page change. Alexander Chukovski replied: "This change makes zero sense. A new service account still gets a default quota of 200."
Policy by the line item
Gambling advertisers got a quicker route to approval. PPC Land reported on October 16 that Google lets gambling advertisers apply for certification inside Google Ads, under Admin, then Policy, then Account, in a rollout that started this month and will reach all advertisers over time. Schwartz covered the same Google Ads online gambling certification notice. "Existing certifications that an advertiser holds and pending applications will not be affected by this incremental launch," Google said. It is the latest step in a year of tighter gambling rules: on October 21, certified gambling advertisers become eligible for the YouTube Masthead and Colombia opens to online lottery ads.
Microsoft tightened age rules. PPC News Feed reported on October 16 that Microsoft requires 18-plus targeting in restricted categories including beauty, food, healthcare and pharmaceuticals, religious content, psychics, people finder sites and government services. Marijuana stocks and ETFs are now disallowed financial products, the drugs policy covers drug-themed merchandise, and US spray paint ads must target adults. No effective date was given.
Verification is getting stricter in places. PPC News Feed reported that proof of address may now be required in Google Ads as a second document in advertiser verification, such as a utility bill or bank statement from the last 60 days, uploaded through the Ads interface. It applies only in South Sudan for now. Product data expanded as well: Merchant Center adds a warranty attribute for all products, PPC News Feed reported on October 16, previously limited to vehicle ads in Japan and needed under rules such as Quebec's Bill 29. Schwartz added a detail to a lead management story the previous edition carried: Google Ads lead form scoring allows up to 12 answers per question to be marked as qualifying.
Bing's experiments
Microsoft tested new labels in its results. Schwartz reported on October 16 that Bing is testing Popular Links on snippets, spotted by Khushal Bherwani, and PPC News Feed reported early on October 17 that Bing tests Popular Links in sponsored ads, possibly a new display name for sitelinks. The two accounts differ on whether the label appears on organic sitelinks or ads; Bherwani's own post describes sponsored ads. Schwartz also reported that Bing is testing Read More links at the end of organic snippets, pointing to the same page as the title, about a year after Google introduced a similar link.
Money, courts and creators
The Character.ai bankruptcy returned with new dates. PPC Land reported on October 16 that Character.ai faces creditors under oath on November 19, a day before bids. The official notice of the Chapter 11 case, filed on October 15 in Delaware, sets the creditors' meeting by Zoom for 1:00 p.m. Eastern on November 19. "The debtor's representative must attend the meeting to be questioned under oath," it says. Bids are due on November 20, with an auction on November 23 and a sale hearing on November 24. Google LLC is the largest listed unsecured creditor at $4,148,944, and no deadline for claims has been set.
A creator dispute reached federal court. PPC Land reported that an engineer sues Cassie Millz over gym clip in 3.3M-view transition reel. Shahin Khazey, a Southern California engineer, filed a 25-page complaint on October 15 in the Central District of California alleging that Dylan Granger, posting as Cassie Millz, reposted his April 2026 gym video as footage of Granger before a gender transition and used the reach to send viewers to a paid OnlyFans account. The Instagram Reel reached 3.3 million views. The eight causes of action include copyright infringement, false association under the Lanham Act and publicity rights; all facts are allegations, and Granger had not responded.
Adobe revised its holiday forecast without changing a number. PPC Land reported on October 16 that Adobe's $275.1bn holiday forecast gets a correction, not new numbers. The reissued Business Wire release changes only one phrase, now saying Amazon's October Prime event became an annual tradition in 2022. The forecast still puts US online holiday spending at $275.1 billion, up 6.7%, with Cyber Monday at $15.1 billion. Errors Adobe left in place include a 2024 season total that differs from its earlier reports.
Short-form drama is becoming a brand format with unsettled economics. Alyssa Mercante reported for Digiday on October 16 that the brand playbook for microseries is still taking shape, with brands choosing between costly partnerships with existing series and cheaper productions they own. Adam Wescott of Home Game Studios put the average season at about $200,000, with episode counts falling from 70 to 90 one-minute episodes to between 40 and 50. "We're delivering them the media value for every dollar that they spend," said Ian Schafer of Ensemble. Dayna Carney, whose client Nuuly backed a dating series, described the appeal plainly: "There is no call to action."
Creator marketing is drifting away from follower counts, and agencies are reorganising around that. Stenberg reported for Adweek that Parade founder Cami Tellez has hired a UTA executive to scale her post-follower agency. Ed Victori, previously vice president of strategy and business operations at United Talent Agency, becomes the first chief operating officer of Devotion, which Tellez launched this year. "Social media has moved past the follower count, but influencer marketing has not," Adweek wrote.
Meta added data to the reserved ad windows it began selling earlier in the week. PPC Land reported on October 16 that Meta sells brands 3 to 24 hour ad windows that shut out category rivals, and the new detail is in the test results: a median of 34 million people reached per Ads Super Burst flight, a median ad recall lift of 2.9 points and an intent lift of 0.6 points, without published baselines. Reels Trending Ads expands to 15 always-on topics, and Meta now says five seconds of attention spread across a week drove 32% more offline sales than one continuous view, up from the 21% it cited earlier. Kendra Barnett's Adweek column, A Meta-Morphosis: Frontier Foray and TikTok Block, published on October 16, described a company "pouring hundreds of billions of dollars into AI investments" as platform tensions rise.
Brands leaned on famous faces in the week's creative. Matt Barker's Ads of the Week roundup of 13 campaigns, from Chipotle onwards, published on October 16, includes Bill Murray in Rivian's Ghostbusters-themed Halloween Mode, Kim Kardashian for DoorDash, Kim Cattrall for Meltwater, Nikola Jokic for Sprite, a Kathryn Bigelow-directed midterm push for Polymarket, Megan Thee Stallion as Gymshark's first celebrity ambassador, an Oura city tour, Chipotle's oversized group-dining bag and Aura's pitch as a family social network.
Television news crossed borders. The same TVNewser Ticker reported that Dateline Canada debuts on November 26 on Citytv, the franchise's first international expansion, hosted by Diana Swain. CNN All Access expands to Canada and the UK on October 20, BBC News is now on YouTube in the US, and MS NOW apologised on air for a false report that FBI Director Kash Patel had travelled to Russia. "We regret this error, and we are transparent about when we make errors," said correspondent Ken Dilanian.
Google's search team is also heading south. PPC Land reported that Google sets October 19 deadline for first Cape Town Search Central Live, a free, application-only event at The Old Biscuit Mill on November 11 with John Mueller and Martin Splitt, and confirmations due by October 26.
The common thread
Taken together, the window's news describes permission being redistributed. Meta wrote crawl and training rights into terms its advertisers accept by continuing to buy ads. Google bought equivalent rights from Reach and CNN by contract, and OpenAI faces a legal threat for taking them without either. Researchers inside Google argued that consent prompts cannot govern agents, while Usercentrics found that a large share of the consent already given is reluctant. Safari decided for itself how long a cookie lives, and Universal Cart decided how little a retailer learns before a sale. The people and businesses asked to say yes are being asked less often, and believed less when they do.
By the numbers
16%
Consumers who grant AI tools data access while uncomfortable, against 7% fully comfortable, across seven markets.
16% grant AI data access reluctantly, 7% willingly, Usercentrics finds
51
Open problems in agentic privacy and security listed by 65 researchers, 36 of them affiliated with Google.
Consent can't keep up with AI agents, 65 Google-led researchers argue
2 of 8
Named Universal Cart merchants that returned a Universal Commerce Protocol profile in an unverified test.
Google's Universal Cart calls retailers once and only at transfer
$4,148,944
Google's listed unsecured claim, the largest among Character.ai's creditors ahead of the November 19 meeting.
Character.ai faces creditors under oath on November 19, a day before bids
3.3 million
Views on the Instagram Reel at the centre of a federal copyright and publicity lawsuit.
Engineer sues Cassie Millz over gym clip in 3.3M-view transition reel
Discussion