In short
- Privacy company Redact found 102 hidden AI instructions across 80 pages of WhatsApp’s help center.
- One told AI not to suggest contacting data protection regulators when someone couldn’t delete their account.
- WhatsApp says they were instructions for its support chatbot that went public because of a bug. They were gone by October 18.
WhatsApp’s help pages had text that no human could see, but AI could. Privacy company Redact published its findings on October 19, the same day WIRED reported on it.
What exactly did they find?
Redact went through all 545 pages in WhatsApp’s help center. 80 of them contained hidden text written for AI to read, with 102 blocks of instructions in total. None of it showed up on screen, but it was there in the page code.
Most of it was harmless: clarifying terms, pointing to other pages, explaining paid plans. Some of it even protected users, like telling AI never to suggest lying about your age or switching off two-step verification. But two stood out.
What did the most controversial instructions say?
- On the account deletion page: if someone had lost their phone or number and couldn’t delete their account, the AI was told not to recommend contacting a data protection regulator. It also wasn’t supposed to suggest WhatsApp could delete the account manually.
- On the reporting and blocking page: if a user mentioned lawyers, lawsuits or courts, the AI was told not to cite WhatsApp’s terms and not to interpret privacy laws like Europe’s GDPR, Brazil’s LGPD or California’s CCPA, even if the user brought them up first.
Other notes told the AI to say reports are “handled internally” without more detail, and to reassure people that personal chats aren’t used for ads.
What did WhatsApp say?
That these were instructions for its support chatbot that showed up on public pages because of a bug, now fixed. The company says it wants its chatbot focused on advice about WhatsApp and “not to offer legal advice.”
Redact first spotted the notes on October 8, and by October 18 they were gone. Internet Archive copies show the regulator note wasn’t there in July and appeared sometime before September 4. Facebook and Instagram’s help centers had nothing similar.
Is this basically a hidden prompt?
Pretty much. It’s text tucked into a web page that gives orders to whatever AI reads it. The worrying part is that more and more people ask a chatbot instead of reading the help page. If the AI has been told to keep quiet about certain options, you’d never know they existed. To be fair, Redact says it couldn’t confirm whether any chatbot actually followed the notes.
Why it matters
Your rights over your data don’t depend on what a chatbot tells you. If an app won’t let you delete your account or your data, you can complain to your regulator: the ICO in the UK, the OAIC in Australia, or your state attorney general in the US, where states like California have their own privacy laws. And next time you ask a company’s support bot something, remember it answers for the company, not for you.
Quick answers
Was WhatsApp reading my chats?
No. This has nothing to do with your messages. It was hidden text on the help pages.
Are the hidden instructions still there?
No. According to Redact, they were removed from all 80 pages by October 18.
What can I do if I can’t delete my WhatsApp account?
Contact WhatsApp support first. If that goes nowhere, you can complain to the data protection authority where you live.
Sources: Redact
The biggest tech news, in 5 minutes.
