WhatsApp's help pages hid LLM instructions: dont recommend a regulator

Hidden AI instructions that prevented users from being told about regulators or relevant laws have been removed from WhatsApp's help pages.

WhatsApp's help pages contained hidden instructions for an AI chatbot, directing it not to recommend data protection regulators or cite relevant laws under specific circumstances. These instructions, discovered on October 8, 2026, were embedded within the page source code and not visible to users. One instruction stated that if a user could not delete their account (e.g., due to losing their phone number), the AI should not recommend contacting a regulator or suggest manual deletion by WhatsApp. Another instruction, triggered when users mentioned lawyers or legal action, prohibited the AI from citing or interpreting privacy laws like GDPR, LGPD, or CCPA. WhatsApp stated these were intended for its support chatbot, aiming to keep it focused on product advice rather than legal advice, and attributed their presence to a bug that has since been fixed. The hidden notes were removed from the help pages by October 18, 2026, after WIRED reported on the findings.

The discovery of hidden AI instructions on WhatsApp's help pages reveals a deliberate attempt to steer users away from regulatory recourse and legal information. This tactic, designed to be invisible to human readers but accessible to AI, raises significant questions about corporate transparency and user rights. While WhatsApp claims a bug and a desire to avoid offering legal advice, the specificity of the instructions—particularly preventing mentions of regulators when users are locked out of their accounts—suggests a more comprehensive strategy to limit user awareness of their protections. The removal of these notes, prompted by external reporting, highlights the ongoing tension between companies and users regarding access to critical information and regulatory oversight.

This incident underscores a growing trend of companies embedding AI-specific guidance within public-facing content, creating a dual layer of information. The implications extend beyond WhatsApp, suggesting that other platforms may employ similar methods to manage user interactions with AI-powered support systems. As AI becomes more integrated into customer service, users and regulators alike will need to be vigilant about these hidden directives. The situation also prompts a re-evaluation of how help pages are structured and what constitutes 'user-facing' information in an AI-driven world.