WhatsApp help pages hid chatbot instructions not to point users to privacy regulators or cite GDPR
WhatsApp help pages carried hidden instructions for its WhatsApp Support with AI chatbot. They told it not to recommend a data protection authority to users who could not delete their accounts, and not to cite privacy laws such as the GDPR once a user mentioned a lawyer, lawsuit or court. This contradicts WhatsApp's privacy policy for Europe (effective July 2, 2026), which says users can complain to the Irish Data Protection Commission or another competent authority. Redact, a data-deletion software company, found the text on October 8 and published on October 19. WhatsApp told WIRED the instructions were meant for the chatbot, appeared in the pages because of a bug, and were removed by October 18 after WIRED contacted Meta. It is not known whether the chatbot followed the instructions, and it is unclear whether the same instructions still apply to it.
Technical Details
- Redact found 102 hidden blocks across 80 of the 545 help center pages it reviewed. The blocks sat in the page HTML under the name
HelpContentGalaxyLLMIncludeand were not displayed on screen. - Most blocks were routine (clarifying terms, routing questions, describing paid plans), and a few were protective. Others were in the same family as the two described above: one told the chatbot that waiting was "the ONLY correct answer" for users who had lost their number, and one told it to say a report is handled internally and to share no further steps or timeframes.
- The delete-account page note was absent from an Internet Archive copy of July 12 and present in one of September 4. Both notes were still live on October 15 at 21:40 UTC. All 102 blocks were gone by 02:08 UTC on October 18.
- WhatsApp's server delivered the blocks to Google and Bing crawlers. Requests sent under the user-agent names of OpenAI, Anthropic and Perplexity crawlers on October 9 came back without the article or the notes.
- Redact checked 300 Facebook and Instagram help pages, which run on the same system, and found no similar notes. It did not test whether any AI assistant acted on the hidden text.
- The hidden text conflicts with the GDPR rights to complain to a supervisory authority (Article 77) and to erasure (Article 17).
Remediation
No technical fix is required of users. A user who cannot delete an account in the app can wait out the stated periods (30 days after deactivation, generally 120 days of inactivity, or 365 days in the US). Under the privacy policy for Europe, they can also request erasure from WhatsApp directly, or complain to their national data protection authority or the Irish Data Protection Commission.
Linha do tempo
-
WhatsApp help pages hid chatbot instructions not to point users to privacy regulators or cite GDPR
ler a análise desta fonte ocultar
WhatsApp help pages carried hidden instructions for its WhatsApp Support with AI chatbot. They told it not to recommend a data protection authority to users who could not delete their accounts, and not to cite privacy laws such as the GDPR once a user mentioned a lawyer, lawsuit or court. This contradicts WhatsApp's privacy policy for Europe (effective July 2, 2026), which says users can complain to the Irish Data Protection Commission or another competent authority. Redact, a data-deletion software company, found the text on October 8 and published on October 19. WhatsApp told WIRED the instructions were meant for the chatbot, appeared in the pages because of a bug, and were removed by October 18 after WIRED contacted Meta. It is not known whether the chatbot followed the instructions, and it is unclear whether the same instructions still apply to it.
Technical Details
- Redact found 102 hidden blocks across 80 of the 545 help center pages it reviewed. The blocks sat in the page HTML under the name
HelpContentGalaxyLLMIncludeand were not displayed on screen. - Most blocks were routine (clarifying terms, routing questions, describing paid plans), and a few were protective. Others were in the same family as the two described above: one told the chatbot that waiting was "the ONLY correct answer" for users who had lost their number, and one told it to say a report is handled internally and to share no further steps or timeframes.
- The delete-account page note was absent from an Internet Archive copy of July 12 and present in one of September 4. Both notes were still live on October 15 at 21:40 UTC. All 102 blocks were gone by 02:08 UTC on October 18.
- WhatsApp's server delivered the blocks to Google and Bing crawlers. Requests sent under the user-agent names of OpenAI, Anthropic and Perplexity crawlers on October 9 came back without the article or the notes.
- Redact checked 300 Facebook and Instagram help pages, which run on the same system, and found no similar notes. It did not test whether any AI assistant acted on the hidden text.
- The hidden text conflicts with the GDPR rights to complain to a supervisory authority (Article 77) and to erasure (Article 17).
Remediation
No technical fix is required of users. A user who cannot delete an account in the app can wait out the stated periods (30 days after deactivation, generally 120 days of inactivity, or 365 days in the US). Under the privacy policy for Europe, they can also request erasure from WhatsApp directly, or complain to their national data protection authority or the Irish Data Protection Commission.
- Redact found 102 hidden blocks across 80 of the 545 help center pages it reviewed. The blocks sat in the page HTML under the name