Meta under pressure on three fronts: Muse sharing returns with new URLs, term tweaks deemed insufficient to stop AI scraping, and Rhode Island becomes the first state to sue over scam ads

Meta's concession-pushback cycle is spinning faster: barely two days after dropping the word "train" from its commercial terms and suspending Muse sharing, the company switched the feature back on this week — with a new URL mechanism; legal experts simultaneously poured cold water, saying the term changes aren't enough to stop Meta scraping news sites for AI training; and Rhode Island became the first US state to sue Meta over scam advertisements^[1][2][3].

Muse sharing returns: new URLs are easy, winning back trust isn't

Last week's incident is still fresh — research firm Claroc found Muse share links enumerable via passive DNS (shared domain plus conversation title as subdomain), exposing 6,800 private conversations, and Meta suspended the feature. This week's fix: new URLs for shared Muse "artifacts," and sharing is back on^[1]. It's a textbook rapid patch, but leaves the open question: does the new scheme eliminate the structural enumerability, or merely rename it? Until the security design is published, users should keep the default assumption that "shared may mean public" — the security community's next audit will render the verdict.

Terms wordplay: drop "train," keep scraping?

The Verge's legal read cools the concession: Meta tweaked its business terms to remove language suggesting it could freely train AI models on news sites — but experts say the changes aren't enough to add substantive limits, and the new terms could still justify training on scraped content^[2]. In other words, rhetorical retreat and behavioral boundaries are different things: absent new self-restraint on the scraping itself (see the earlier robots.txt dispute), deleting a verb is more public relations than a change in rights. For publishers and creators, the test remains plain: is my content in your training data — which takes transparent data disclosure, not contractual rhetoric.

The Rhode Island suit: scam ads become the first state-level battleground

The third blow comes from regulators. Rhode Island Attorney General Peter F. Neronha sued Meta over its handling of scam advertisements, alleging the company does not do enough to prevent fraudulent ads and has not taken stronger action because they generate revenue. Neronha's statement is unsparing: "For a company that engages so many Rhode Islanders and Americans, maintaining high standards for consumer safety should be of the utmost importance. As alleged, Meta knowingly exposed vulnerable users to fraud and scams, and made enormous profits in doing so"^[3]. It is the first state to sue on these allegations — and a state AG's "first" usually means "not the last"; alongside record CDS and the capex controversy, the legal-risk ledger gains another line.

What the three fronts share

Side by side, a pattern emerges: Meta is managing a "trust deficit" on three fronts at once — product safety, data rights and ad compliance — and on every front the pace of concession is set by external pressure (researchers, legal experts, state attorneys general) rather than internal risk control. The lesson for users and regulators is the same: constraint on platform behavior currently comes from people who discover problems, not mechanisms that prevent them. Three things to watch: an independent security audit of the new Muse URL scheme; whether the first public dispute over scraping "under the new terms" materializes; and whether other states follow Rhode Island's litigation path^[1][2][3].

Why the three fronts converged in one week

The three stories landing in the same week is no coincidence; the shared cause is Meta's heightened exposure this week. Earnings and Muse user numbers put the company on every front page, and with the spotlight came a fresh audit of every legacy liability — the sharing flaw is the product's first technical debt within six weeks of launch, the terms wording is a standing content dispute, and the scam-ads suit is structural risk in the ad business model. High exposure magnifies scrutiny, and scrutiny surfaces debt — the fate of every platform company under the lights. For investors, the week's lesson: when evaluating Meta's AI story, product data (10 million users, $200 baskets) and risk inventory (privacy engineering, content compliance, ad litigation) must sit on the same balance sheet — the former sets the valuation ceiling, the latter the floor.