Meta put a price on not being trained on.

Meta's Model API has a pricing page, and on it Muse Spark appears twice.

The first listing is $1.25/M input and $4.25/M out. Beside it, Meta's own words:your prompts and completions are not used to train Meta models. The second listing is the same model at $0.10 and $0.20, and the words change topermission to use your prompts and completions to train future Meta models.

12.5x cheaper on the way in. 21x cheaper on the way out.

I have read a lot of pricing pages this year and this is the first one that made me stop. Not because the discount is large, though it is. Because every other lab sells the same two things welded together and never tells you what the weld costs. Meta unbundled it and printed both halves.

What the promise actually costs

Agentic systems run heavy on input. Context, retrieved documents, tool output, the whole conversation replayed on every turn. A ratio around thirty tokens in for every one out is ordinary, and at that ratio the standard tier blends to about $1.347/M while the contributor tier blends to $0.103/M.

The gap is $1.244/M. Call it a 92% discount, or call it the price of a sentence in a terms page.

Run 1B tokens/day, which is a real number for a mid-sized shop with agents in production, and the sentence costs about $454K/yr.

That figure is worth sitting with, because until last week nobody had one. Confidentiality was in the price of every frontier model, unlabelled, the way a hotel folds the towels into the room rate. The nearest thing we had was the open-weights argument that downloading a model buys you an exit rather than savings, and that at least put a name on what you were paying for. This puts a number on it. You could not shop for it, decline it, or put it in a budget line. Now you can, and it turns out to be roughly a senior engineer.

So you write the router

This is the part where anyone who runs inference for a living does the same mental arithmetic, so let me just do it out loud.

If confidentiality has a price, it becomes a routing decision, and the key is not difficulty. It is provenance of the input. Anything carrying a customer's material goes to the tier with the promise. Anything built on public data goes to the cheap one. You are not choosing a model, you are choosing which lane a request belongs in, and the model on both ends is identical.

For a lot of companies that split is lopsided in a useful direction. If you are building on public filings, public documentation, public code, published prices, then "non-confidential" is very nearly everything you do. The router is twenty lines and it moves most of your bill.

I built the sketch of it. Then I read the rest of the page.

Underneath the prices, two numbers disagree

Underneath the prices, Meta publishes limits per tier, and the two numbers do not move together.

Requests fall from 3,000 to 100/min. That is 30x tighter.

Tokens fall from 4M to 3M/min. That is 1.33x tighter.

A cheap tier that is simply throttled would cut both by roughly the same amount. This one does not. Divide the throughput by the request cap and you get an average of 30K tokens/request, which is not a chat message. It is a long agentic call with a large context attached, or a document going through a pipeline, or a coding agent holding a repository in its head.

Which is the opposite of the pressure per-token billing usually applies. When Anthropic moved enterprise customers onto per-token pricing I argued it was a product-architecture verdict rather than a billing change, because paying by the token rewards whoever gets the outcome in fewer of them. Meta's cheap tier inverts that. Here the rate card pays you to send more context, not less, and it does that because context is the product it is buying.

So the discount is not shaped to move inference in general. It is shaped to admit one kind of workload and turn away another. High-frequency small calls, the consumer chat shape, cannot fit through 100 req/min at any price. Context-heavy reasoning fits through almost unimpeded.

And context-heavy reasoning traces are precisely the data that is hard to buy. You can pay a labelling shop for annotations. You cannot pay them for a real engineer's real repository being reasoned over by a real agent at 2am against a deadline. That is not annotation, it is behaviour, and it only exists where the work is actually happening.

Read the two tiers together and the offer becomes legible. Meta is not running a loss leader to win API share. It is buying a specific shape of data, and it wrote the acquisition criteria into the rate limits where anyone can check them.

Which means the router needs a second key. Provenance decides which lane ispermitted. Request shape decides which lane is available. Those are different questions, and 1B tokens/day spread evenly is about 694K tokens/min, comfortably inside the cheap tier's throughput. It is the request count that bites, not the volume.

The intermediary this invites

Here is what I think happens next, and it is not Meta's move.

If confidentiality has a published price and a published spread, that spread is a business. An intermediary that strips provenance before the request leaves the building can buy at the contributor price and sell the promise, and the difference stops being a surcharge the buyer eats and becomes margin somebody earns.

The shape already exists. Venice.aisells privacy as tiers rather than a slogan: zero retention on self-hosted open models, metadata stripped before anything reaches a third-party model, and at the top end prompts encrypted on your device so only a hardware enclave can read them. It raised $65M this year at a $1B valuation, passed 3M users, and turned profitable in Q1. Erik Voorhees and Jesse Proudman built it on the argument that privacy should be structural rather than promised, which is a philosophical position right up until somebody publishes a number that makes it an arbitrage.

Nothing about that is guaranteed to happen. But a 92% spread sitting in public, on a document with a URL, tends not to sit there long.

The buyers who cannot take the deal

There is a quieter reading of the same two lines, and it is the one that will matter to more people than the router will.

The contributor tier sorts the market by who is legally able to sell their traces. A startup on public data can take the discount without a conversation. A health system cannot. Neither can a claims processor, an underwriter, or anyone holding material under a duty they did not write themselves. For them the cheap tier is not a worse deal. It does not exist.

So their $454K is not a privacy premium. It is the price of being regulated, and Meta has now expressed it per token, which is a more honest accounting than the industry has ever offered them. The regulated buyer was always paying it. They just never had the invoice.

I keep coming back to that, because I have sat in the meetings where a hospital's AI budget gets defended line by line, and "we pay 12 times more because we are not allowed to sell what our patients say" is a sentence that changes how the conversation goes. It is not a complaint. It is a number, and numbers survive contact with a finance committee in a way that principles do not.

What Meta actually did

Tomasz Tunguz read the same page and called it the ads model arriving for prompts: subsidised access in exchange for data, the barter that built consumer internet, now applied to inference. He is right about the mechanism and I think one level short on the intent.

The ads model wants volume. It wants everybody, all the time, at the lowest possible cost per impression. This rate card does not want volume. It caps requests at 100 a minute while leaving throughput almost untouched, which is a filter, not a funnel. Meta is not buying attention here. It is buying a particular kind of reasoning, from the particular people who do it at scale, and it is willing to hand back 92% of the price to get it.

That is a more interesting move than a discount, and it is genuinely novel. Every lab holds the same two products. Meta is the first to admit they were ever separate, put a number on each, and then quietly specify which customers it actually wants in the cheap lane.

The pricing page says all of it. Most people will only read the first column.

—TJ