WhatsApp help pages hid chatbot orders not to cite regulators
Original title: WhatsApp's help pages hid LLM instructions: dont recommend a regulator
Hidden notes told WhatsApp’s support bot not to name data-protection authorities or GDPR after a lawyer was mentioned.
Researchers say that until mid-October 2026, WhatsApp help pages contained text invisible to readers but sent to an AI. On the account-deletion page, hidden orders told the bot not to recommend a data-protection regulator. On the reporting-and-blocking page, once a user mentioned a lawyer, lawsuit or court, the bot was told not to cite or interpret GDPR, LGPD or CCPA. WhatsApp later told WIRED the notes were instructions for its own support chatbot. The European privacy policy, effective July 2, 2026, states rights to erasure and to complain to the Irish Data Protection Commission or another authority.
Unconfirmed: The researchers have not tested whether any AI assistant followed the hidden instructions.
- The notes were found on October 8, 2026, across help pages linked from the centre.
- Of 545 pages saved, 80 had hidden AI text and 102 hidden blocks.
- Most blocks were housekeeping; two conflicted with published privacy-policy rights.
- Crawls posing as OpenAI, Anthropic and Perplexity on October 9 did not receive the notes.
- Checks of 300 Facebook and Instagram help pages found no similar notes.
- Products
- Organizations
- Irish Data Protection Commission
- Countries
- Ireland
From the original article
8 min read at redact.dev
WhatsApp's privacy policy for Europe tells you that you can complain to a data protection regulator, and it names the law that gives you that right. Until mid-October 2026, WhatsApp's help pages told an AI not to recommend the regulator, and not to cite that law once you'd mentioned a lawyer. You couldn't see the second part.
By ds · redact.dev
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.