WhatsApp's help pages contained hidden text telling its AI support chatbot not to send users to privacy regulators and, on at least one page, not to cite the GDPR. Meta's messaging service removed the text on 18 October 2026, a day before the researchers who found it published their findings.
No authority has said the instructions broke the law, and many questions are still open. But the episode touches the part of the GDPR that makes people's rights usable in practice, and any company with a support bot can learn from it. This article is for general information only and is not legal advice.
What was hidden
The instructions sat in the HTML of WhatsApp's help pages and were never shown on screen. Redact, a data-deletion software company, found them while reviewing 545 help pages. It counted 102 hidden blocks spread across 80 of those pages.
The wording depended on the page:
- On the account-deletion page, the text told the chatbot not to recommend contacting a data protection authority or regulator. It also told the bot not to suggest that WhatsApp could delete accounts manually, and not to recommend using a different phone.
- On the page about reporting and blocking contacts, the text told the bot not to cite data protection laws such as the GDPR, even when users raised them themselves.
Timeline
According to the coverage we reviewed, the note was added to the pages between 12 July and 4 September 2026 (archived copies of the deletion page differ on those dates), and it stayed live for ten days after Redact found it.
- 12 July: an archived copy of the deletion page does not include the note.
- 4 September: an archived copy includes it.
- 8 October: Redact first finds the notes.
- 15 October: the notes are still on the live pages.
- 18 October: all hidden blocks are removed from the live pages (02:08 UTC).
- 19 October: Redact publishes its findings.
- 20 October: The Hacker News reports the story.
WhatsApp's response
WhatsApp said the instructions were meant for its chatbot, not directly for users, and blamed a bug, now fixed, for exposing them. It added that it wants the chatbot to avoid giving legal advice. Reporters had contacted Meta before publication, and WhatsApp removed the text before either WIRED or Redact published.
Several questions remain open. It is not known whether the chatbot actually followed the hidden instructions. WhatsApp calls the text a bug but, in the coverage reviewed, has not said how it reached 80 pages or who wrote it. The coverage reports no regulatory action or statement so far.
Why it matters under the GDPR
This section is our analysis, not a regulatory finding.
Article 12(2) requires controllers to facilitate the exercise of data subject rights, including erasure. A deletion page whose chatbot is told not to mention manual deletion or regulators sits uneasily with that duty. Article 13(2)(d) requires controllers to tell people they can lodge a complaint with a supervisory authority. The hidden text pushed the support bot away from exactly that information.
The contradiction is visible in WhatsApp's own documents: its European privacy policy tells users they can complain to the Irish Data Protection Commission or another supervisory authority. Users who asked the chatbot may not have heard the same thing.
The case also shows a new kind of risk. The problem was not what the model said, but what a hidden prompt told it not to say. A company can be fully transparent in its legal text and still steer users away from their rights in its support tools.
What companies using AI support bots should do
Any business that puts a chatbot in front of customers can make the same mistake without bad intent. A few checks would catch it:
- Audit what the bot reads. Review the system prompts, hidden page text and knowledge-base notes, not only what customers see.
- Keep rights answers available. The bot should always be able to explain how to exercise access, erasure and objection rights, and how to complain to a supervisory authority.
- Separate legal advice from facts. Do not let legal-advice guardrails block factual rights information. Pointing to a regulator is information, not legal advice.
- Test with rights questions. Ask “how do I delete my data?” and “which authority can I complain to?” before every release.
- Version the content. Keep history for everything the bot ingests, so you can show when a change was made and by whom.
If your bot processes personal data, a DPIA is the natural place to record these checks. See our guide to DPIAs for AI chatbots.
The bottom line
Whether or not the chatbot followed its hidden instructions, the lesson stands: transparency has to hold in every channel where people ask questions, including the AI ones. Book a free consultation with GDPRGard → and we will help you check what your support bot is allowed to say.
Sources
- eSecurity Planet: WhatsApp's hidden AI instructions told chatbot not to mention privacy complaints
- PPC Land: WhatsApp help pages hid 102 AI orders, one barring regulator referrals
- GDPR Article 12 (gdpr-info.eu)
- GDPR Article 13 (gdpr-info.eu)
The GDPR analysis, including Articles 12(2) and 13(2)(d), is our reading of the regulation, not a quote from the sources.
Also read:
- Your AI chatbot isn't anonymising anything
- AI Act Article 50: What the Final Guidelines Mean for Your Chatbot and AI Content
- Uber's €825M Fine: When “The Algorithm Decided” Becomes a Liability