October 2026 brought five news items that affect a small business owner, even if a contractor runs the advertising. Two are about Meta, two about Google, and one about scammers hunting for access to ad accounts. For each we give the date of the event, what you can check yourself, and where the sources disagree.
We checked all facts against primary sources and trade press reports on 7 October 2026. Where there is no official confirmation, we say so. We give Google Ads menu names as in Google’s English help.
1. Facebook: links in posts are becoming a paid feature
What happened. Since 16 December 2025, Meta has been testing a limit: some Pages and professional-mode profiles without a paid subscription can publish links to outside websites in only two organic posts per calendar month (TechCrunch, 17 December 2025). In September 2026, with the launch of the Meta One for Business subscription, the limit was reportedly extended to more Pages (Social Media Today). News publishers’ Pages are excluded from the test.
Where the sources disagree. Our short social media post says “in 2 posts or comments”. To be more precise: in the December description of the test, links in comments, affiliate links and links to Instagram or WhatsApp were not counted against the limit. A September 2026 review, however, says Meta has not clarified whether the limit applies to comments and other formats. Practitioners advise putting the link in the first comment; others reply that Meta is already checking that workaround too. We did not find a Meta help page with this number: everything known comes from press reports.
What to do yourself.
- Try publishing a post with a link on your Page. If the limit already applies, Facebook will show a warning.
- Plan two “link posts” a month for what matters most: a promotion, booking for a service, a new product.
- If you need traffic to your website: the test was about organic posts, and Meta has not spoken separately about paid ads. You can run ads with a link as before, but check this in your own account.
2. Free Gemini: from 9 October only the simplest model
What happened. Gemini is Google’s AI chat assistant. It has three models. According to Google’s help, Flash-Lite is designed for speed and suits everyday tasks such as summaries and brainstorming, Flash balances speed and reasoning, and Pro is meant for the hardest tasks, such as complex maths and coding. According to press reports citing an updated Google help page (9to5Google described it first), from 9 October 2026 only Flash-Lite remains available without a paid Google AI plan. A Google AI Plus subscription costs $4.99 a month in the US and keeps Flash but removes Pro (Google emails each subscriber their date). Check the price for your country directly in the app.
Where the sources disagree. The Google help page about Gemini models, which we opened on 7 October, still says all three models are available without a plan and does not mention 9 October. So we did not see confirmation from Google itself on that page: there are only press reports. Check your own app after 9 October.
What to do yourself.
- Open Gemini and see which model is selected.
- Take three or four of your usual tasks, for example a reply to a customer or a product description, and run them on the simple model. If the result is good enough, you do not need to pay.
- Whatever contains prices, figures and terms, reread by hand regardless of the plan.
- Do not mix things up: this is about the Gemini app. The programmatic access (API) and Gemini in Google Workspace are separate products and are not mentioned in the reports about the change.
3. Google teaches businesses to work with AI, for free
What happened. Google Ukraine, with the support of Ukraine’s Ministry of Economy and the edtech company EdEra, is launching “AI for Business 2.0”. According to the Ministry’s announcement of 22 September 2026, it starts on 12 October and runs for five weeks. Each Monday brings three to five short videos per module (up to 15 minutes), each Thursday a live session with answers to questions, and all recordings stay available. The course is free and ends with a certificate.
Who it is for. Owners, managers and executives without a technical background. Register on the programme page.
What to do yourself. Before the start, pick one task that eats the most time in your business: answering the same customer questions, quotes, call summaries.
4. A fake job offer steals access to your advertising
What happened. On 28 September 2026 a trade Telegram channel for advertisers described a scheme: an owner or marketer gets a message about a job, is shown a polished “careers page”, and at the interview scheduling step is asked to “sign in with Google”. According to that post, behind the sign-in hides a request for access to your ad account.
Where the sources disagree. The mechanism is described differently. That post talks about a permission request (so-called OAuth: a window where Google asks whether to give third-party apps access to your account). Malwarebytes researchers described a similar story on 3 April 2026 with a different mechanism: the interview booking page shows a fake Google sign-in window that only imitates a browser window and captures the password together with two-step verification codes. And the FBI, in early September 2026, separately warned about “OAuth consent phishing” in general: scammers obtain permission to access an account and bypass the password, and changing the password does not cancel that permission. What all three have in common: the target is your Google account, and through it your advertising.
What to do yourself.
- Never type your password in a window that appeared on a scheduling or booking page. A real sign-in window can be dragged outside the page; a fake one, being an image, will stay stuck.
- If instead of signing in the window asks for access to data, read the list of permissions. If you do not understand why a recruiter needs your ad account, close it.
- See what already has access to your account: myaccount.google.com/linkedapps. Under “Access to your Google Account” you can open an app, view its details and select “Remove access”; you can do this at any time.
- See who has access to your advertising. In Google Ads, open the Admin menu and choose “Access and security”. It lists users, and the “Actions” column has “Remove access”. The “Admin” level can grant access to others, so keep admins to a minimum and make sure you recognise all of them.
- Confirm invitations to your account from inside Google Ads, not through a link in an email: this is advice from trade media (including Search Engine Land) after a wave of fake invitations.
5. Lead forms on Facebook and Instagram: what really changed
What happened. For lead forms (Meta calls them “instant forms”: a person leaves contact details without leaving Facebook or Instagram) there are two news items. The first is confirmed: in late June 2026 Meta added appointment booking right after the form is submitted. The calendar pulls the name, email and phone from the form. It works with Calendly and HighLevel, and HubSpot was added in early August. According to a Social Media Today review of 24 June, for now this is Facebook only, and full global availability is expected in October.
The second item: Meta supposedly checks the email in a submission itself and fixes obvious address errors such as “gmial.com” instead of “gmail.com”. One agency channel wrote about it on 1 October 2026; we did not find an announcement from Meta itself, so do not count on it until you see it in your own account.
What to do yourself. If you run ads with a lead form, open the last five submissions and check the email and phone. Do they look real? And did you call back on time?
From our practice: the typical lead form trap
A form inside Facebook works quickly, and there are usually more submissions than from a website. Practitioners conclude that the form gives volume while the website gives quality, because in a form people forget they left their contact details. The form also autofills the phone and email from the profile, and that number is often invalid. There is a setting that requires confirming the number with an SMS code: it filters out fake submissions, but some practitioners warn that the extra step reduces the number of submissions, especially in Ukraine. Who is right depends on the niche; Meta gives no official figure here.
A different dispute: how fast to call back. Practitioners give different answers, from 3–10 minutes to half an hour, and some say “within an hour, after that the response drops sharply”. We did not find a single figure in Meta’s help. From our practice: the faster the better.
And most importantly: the cost per submission in Ads Manager says nothing about how many of them reached a sale. That has to be counted separately, in your own spreadsheet or CRM.
We ask clients for access by an email invitation, not a login and password; more in the checklist “What Should Be Connected to Your Website”.
Summary: what to do this week
- Facebook: check whether the link limit applies to your Page and spread two links across the month.
- Gemini: after 9 October test your tasks on the simple model.
- Course: register before 12 October.
- Access: open “Access and security” in Google Ads and myaccount.google.com/linkedapps and remove anything unfamiliar.
- Lead forms: review the latest submissions and response speed.
You can read how we run campaigns in the search advertising and Performance Max sections.
Want a free audit of your Google Ads account? Send us a request: we will look at your account, including who has access to it, and tell you what is worth changing.