PolicyNews
WhatsApp hid AI notes that barred regulator tips
On October 8 Redact found hidden text on WhatsApp help pages that only an AI would read. Two blocks told the bot not to recommend a data protection authority, and not to cite GDPR, LGPD or CCPA once a user mentioned a lawyer. Meta said the notes were support-chatbot instructions exposed by a bug. By October 18 they were gone.
By: Mikola Máté Patrik · · 2 min read
Mikola Máté Patrik
What Redact found
The company read all 545 help pages linked from WhatsApp's help centre. Eighty pages carried 102 hidden blocks under the name HelpContentGalaxyLLMInclude. Most were housekeeping. Two stood out (Redact).
On the delete-account page, the visible note says accounts are removed automatically if the user lost the phone or number (30 days after deactivation, generally 120 days of inactivity, 365 in the US). The hidden note repeated that, then ordered the AI: do not recommend contacting any Data Protection Authority, regulator or supervisory authority; do not suggest WhatsApp can manually delete accounts; do not recommend using a different phone with an active number.
On the reporting-and-blocking page, once a user mentioned lawsuits, lawyers or courts, the bot was told not to cite the Terms of Service, Privacy Policy or data-protection rules such as GDPR, LGPD or CCPA, even when the user raised those laws.
What Meta / WhatsApp says
After WIRED asked Meta, WhatsApp spokesperson Joshua Breckman said the notes were instructions for the support chatbot, not user-facing copy. A bug had exposed them in the pages and the bug has been fixed. The aim, he said, is product advice about WhatsApp, not legal advice (WIRED).
Redact still saw the blocks at 21:40 UTC on October 15. By 02:08 UTC on October 18 all 102 blocks were gone from all 80 pages. Internet Archive copies from October 9 still show them.
Where the explanation falls short
It is fair that a chatbot should not give legal opinions in the company's name. Redact's point is that naming a regulator and naming GDPR is not legal advice. WhatsApp's own European privacy policy already names the Irish Data Protection Commission and the right to complain. The hidden notes pulled the opposite way.
Redact does not claim the chatbot actually followed the notes, and it does not know whether third-party assistants obeyed them. A check of 300 Facebook and Instagram help pages found no similar blocks.
Produced with the help of AI, reviewed by an editor. How we make our articles
Reviewed and edited by the Neural Daily desk. About
