WhatsApp has removed hidden instructions embedded in its help centre pages that directed its AI-powered support chatbot not to recommend contacting data protection regulators in certain situations, according to findings published by data-deletion software company Redact.
The instructions, which were not visible to users browsing the help pages, were discovered in the website's underlying code. They concerned responses to account deletion requests, legal disputes and questions involving privacy regulations.
Redact identified the instructions on October 8 and published its findings on October 19. The company examined 545 pages linked through WhatsApp's help centre and found 102 hidden instruction blocks across 80 pages.
According to the findings, one set of instructions appeared on a page explaining how users could delete their WhatsApp accounts. It directed the support chatbot not to suggest contacting data protection authorities, regulators or supervisory bodies.
The same instructions also discouraged suggesting that WhatsApp could manually delete accounts on behalf of users or that they could use another phone with an active number.
Another instruction block, located on a page covering reporting and blocking, addressed situations in which users mentioned lawyers, lawsuits or legal proceedings.
It directed the chatbot to avoid referring to privacy legislation, including the European Union's General Data Protection Regulation (GDPR), even when users raised those regulations themselves.
The findings highlighted a difference between the hidden chatbot guidance and WhatsApp's published privacy policy for European users.
WhatsApp's European privacy policy states that individuals have the right to submit complaints to the Irish Data Protection Commission or another competent supervisory authority.
The hidden instructions were reportedly stored within HTML elements labelled HelpContentGalaxyLLMInclude, making them accessible through the page source rather than the visible website interface.
Redact also examined 300 Facebook and Instagram help pages but did not identify comparable instruction blocks.
The company found that most of the hidden instructions were routine guidance intended to clarify support responses, direct users towards relevant information or explain product features.
WhatsApp told WIRED that the instructions were intended for its AI support chatbot and had appeared within publicly accessible help pages because of a technical bug.
The company said the issue had been fixed and maintained that the chatbot guidance was intended to provide relevant support information rather than legal advice.
Archived records indicated that the instructions were present on the website in September and remained accessible until October 15. By October 18, the identified blocks had been removed.
However, Redact did not test whether the chatbot followed the instructions when responding to users. There is therefore no confirmed evidence that users received responses discouraging them from contacting privacy regulators.
The findings raise questions about how organisations manage instructions supplied to AI-powered customer support systems, particularly when those systems address account access, data protection and regulatory matters.
Disclaimer: This article may include information derived from interviews, press releases, public statements, research, company communications and other publicly available or third-party sources. Such material may be summarised, paraphrased or contextualised for journalistic and editorial purposes. All rights in third-party content remain with their respective owners.