WhatsApp Removed Hidden AI Instructions That Discouraged Regulator Referrals and Privacy Law References

WhatsApp removed hidden chatbot guidance from about 80 help and FAQ pages after an investigation found instructions discouraging references to privacy regulators and laws including Europe’s GDPR. The text was embedded in page code rather than displayed to visitors, and some blocks carried headings such as “WHAT NOT TO SAY.”

The guidance included an instruction not to recommend contacting a data protection authority to users who could not delete their accounts. Another told the chatbot not to cite privacy laws after a user mentioned a lawyer, according to the investigation described by Hacker News AI and Redact. Meta said a bug exposed the instructions and that the issue was fixed.

Redact found the text on October 8 while examining WhatsApp’s help centre, then reviewed all 545 pages linked from the site. The review identified roughly 100 hidden instruction blocks, with later accounts putting the total at 102 across 80 pages. The figures describe blocks of machine-readable guidance, not 102 separate chatbot policies.

The hidden text was intended for an AI system supporting WhatsApp’s help content. It was not visibly rendered on the pages, and Redact did not establish whether a chatbot actually followed every instruction. That distinction matters because the discovery demonstrates exposure of the guidance, while its operational effect remains a separate question.

Meta attributed the exposure to a software bug and removed the text after the issue was raised. Several accounts describe the instructions as internal controls for a support chatbot rather than public policy language. The company’s response addressed the accidental visibility of the instructions, while the controversy centers on what those instructions told the system to omit.

WhatsApp’s own European privacy policy gives users information about contacting a data protection regulator and identifies the legal framework behind that right. The hidden guidance therefore created a conflict between the information presented in the policy and the response boundaries set for an AI support channel. Chatai and Mindgrow described the material as removed after Meta was contacted, while Wired AI framed the incident as an accidental disclosure on dozens of public pages.

A chatbot that withholds regulator information can affect how users understand their options when ordinary support fails. The issue is especially sensitive for account access, deletion requests and privacy complaints, where users may need an independent authority rather than another company support exchange.

The discovered guidance did not erase rights described in WhatsApp’s privacy policy, but it shaped which rights a user might hear about during a support interaction. Ppc reported that the instructions covered both regulators and privacy laws such as the GDPR, while Hacker News AI also identified the CCPA in its account. The practical concern is informational: users often treat support answers as the company’s clearest explanation of what they can do next.

The incident shows how a public webpage can serve two audiences at once: people reading visible content and AI systems processing hidden page text. Instructions written for machine consumption can influence answers without being apparent to the person seeking help, creating a governance gap between published policy and automated support behavior.

That gap creates concrete review obligations for companies deploying support bots. Teams need to compare chatbot rules with privacy policies, test answers involving regulators and legal rights, and inspect what public pages expose to crawlers and models. Pulse.adyog emphasized those checks, while Explainx described the text as AI-only blocks and Wired AI highlighted restrictions on legal advice.

The immediate response is complete at the page level: Meta said it removed the exposed instructions and fixed the bug. The unresolved questions concern duration, deployment and oversight, including how long the guidance was present, whether a production chatbot used it, and whether users received answers that omitted regulator options.

The episode also gives regulators and privacy teams a specific test for AI support systems. They can examine whether automated answers accurately reflect published rights, preserve referrals to independent authorities and disclose when a system is restricted from discussing legal topics. For users, the practical lesson is to consult the relevant privacy policy or regulator when a support bot provides an answer that conflicts with those documents.