WhatsApp Help Pages Found With Hidden AI Instructions About Privacy Regulators
WhatsApp has removed hidden instructions from its help center after a privacy researcher discovered that dozens of support pages contained text meant for an AI chatbot. The instructions were not visible to regular visitors but appeared inside the page code, raising new concerns about how AI support tools may influence the information users receive about privacy rights.
The discovery was made by Dan Saltman from the privacy company Redact, who reviewed and archived hundreds of pages from WhatsApp’s help center. After examining 545 linked support pages, he reportedly found 102 hidden instruction blocks spread across roughly 80 pages.
What the hidden instructions told the chatbot
Many of the hidden notes appeared to be standard chatbot guidance, likely intended to help an automated assistant answer support questions more consistently. However, some of the instructions were more sensitive.
On a support page about deleting a WhatsApp account, one hidden instruction reportedly told the chatbot not to recommend contacting any Data Protection Authority, regulator, or supervisory authority. The same instruction also said not to suggest that WhatsApp could manually delete accounts for users.
Another hidden prompt appeared to apply when users mentioned lawyers, courts, or possible legal action. It instructed the chatbot not to reference, cite, or interpret privacy and data protection laws, including regulations such as the GDPR, LGPD, and CCPA, even if a user brought them up directly.
An archived version of the account deletion page from October 9 reportedly showed the sentence in the page source exactly as described.
WhatsApp says the hidden text appeared because of a bug
WhatsApp said the instructions were intended only for its internal support chatbot and were not meant to be shown publicly in the help center’s page code.
Company spokesperson Joshua Breckman said the text appeared because of a bug that has since been fixed. He explained that the instructions were created for the chatbot, not for users directly, and said WhatsApp wants its support bots to provide help about the app rather than legal advice.
The hidden blocks were removed after the issue was reported, and by October 18 they were reportedly no longer present on the affected pages.
It is still unclear whether WhatsApp’s chatbot actually followed these instructions in real conversations. Redact did not test the chatbot’s behavior, and the review focused only on English-language help pages.
Why hidden AI prompts matter
Hidden instructions placed inside web pages have become a growing concern as more people rely on AI assistants, AI search tools, and automated browsers. These systems often read web content and may follow commands that are invisible to human readers.
In previous cases, hidden website text has been used to influence AI tools by injecting commands into pages. This technique, often called prompt injection, can cause an AI assistant to ignore user requests, change its response, or prioritize instructions embedded in a webpage.
This case is different because the hidden instructions were found on WhatsApp’s own help pages and appeared to be aimed at the company’s own support chatbot. The concern is that users asking about privacy rights, account deletion, or legal options could potentially receive incomplete answers if a bot is instructed not to mention regulators or data protection laws.
What users should know about privacy rights
If a chatbot does not answer a privacy-related question, that does not remove a user’s legal rights. Privacy laws still apply, regardless of how an automated support system responds.
For users in the European Union, Article 77 of the General Data Protection Regulation gives people the right to file a complaint with a data protection authority. This is especially relevant if someone believes their personal data has been mishandled or if they feel a company has not properly responded to a privacy request.
Users can usually contact the data protection authority in the country where they live, work, or where the alleged privacy issue occurred.
The bigger issue for AI customer support
As companies increasingly use AI chatbots for customer service, transparency is becoming more important. Users need to know when they are speaking to an automated system, what limitations that system has, and whether it is being instructed to avoid certain topics.
AI support tools can be useful for simple tasks such as account settings, app troubleshooting, and basic product guidance. But when questions involve privacy rights, legal complaints, data deletion, or regulators, users may need clear information beyond what a chatbot is willing or able to provide.
The WhatsApp case highlights a key challenge for the future of AI support: hidden instructions can shape what users are told without users ever seeing those instructions. That makes independent scrutiny, clear policies, and stronger safeguards essential as AI becomes more deeply integrated into everyday apps and online services.
