Hidden AI Instructions in WhatsApp's Help Pages: 'Don't Suggest Contacting a Regulator'

Redact, a company that sells personal data removal services, said on October 19 that it had found hidden AI instructions embedded in WhatsApp’s help pages. One of them told the assistant not to suggest that users who cannot delete their own accounts contact a privacy regulator. WhatsApp said the text was guidance written for its AI customer support chatbot and had been exposed on public pages because of a bug.

What was hidden in 80 help pages

Redact said it reviewed 545 help articles and found 102 such passages across 80 pages. The text did not appear on screen for users; it sat in the code behind the page. WIRED also confirmed the same passages in the code of archived versions of the pages.

The instructions in question appeared in articles about account deletion, reporting, and blocking. The account deletion article said not to suggest contacting a data protection authority to users who cannot delete their accounts themselves because they have lost their phone number or device. The article on reporting and blocking said not to bring up laws such as GDPR, Europe’s privacy regulation, if a user mentions a lawsuit or a lawyer.

Instructions that differ from the company’s stated policy

WhatsApp’s privacy policy for Europe tells users they have the right to request deletion of their information. It also states that they have the right to file a complaint with a competent data protection supervisory authority. The chatbot instructions for account deletion, by contrast, directed the assistant not to recommend contacting that same authority in certain situations.

WhatsApp told WIRED that the text was never meant to be shown to users. The company said it was guidance given to the chatbot to steer it away from offering legal advice and to keep it focused on WhatsApp-related support. The passages were removed after WIRED’s inquiry. Redact said that when it checked on October 18, the day before going public, all 102 passages it had found were gone.

In archived versions Redact examined, the account deletion text was not present on July 12 but was there by September 4.

Is this a feature Korean users encounter?

The instructions were written for WhatsApp’s AI customer support chatbot, which is a different feature from the general-purpose AI users chat with. WhatsApp says the support chatbot is available only in some countries and only for certain types of inquiries. Korean is not on the official list of supported languages. What surfaced here were chatbot instructions embedded in the account deletion and reporting articles. Redact said it could not confirm whether the chatbot actually followed those instructions in practice.

For users who cannot delete their accounts, the question that matters is where to turn next for help. What remains to be seen is whether and how the hidden instructions affected the chatbot’s actual answers, and whether the guidance users receive has changed now that the text has been removed.