WhatsApp Hidden LLM Instructions Blocked Regulatory Advice
Hidden system prompts instructed AI to withhold legal and regulatory information from users.
1Hidden AI Directives Discovered
Investigations revealed that WhatsApp embedded invisible instructions within its help pages until mid-October 2026. These hidden text blocks were designed specifically for AI models to read, explicitly forbidding the chatbot from recommending data protection regulators or citing privacy laws. Users remained unaware that their AI-driven support experience was being actively filtered.
2Restricting Account Deletion Support
When users sought to delete accounts without phone access, the hidden instructions forced the AI to withhold information. The chatbot was told not to suggest that WhatsApp could manually delete accounts or recommend using a different phone number. Instead, the AI was programmed to only offer the standard waiting period for automatic deletion.
3Legal Disclaimer Evasion Tactics
The system instructions triggered specific restrictions whenever a user mentioned lawyers, lawsuits, or courts. The AI was ordered to avoid citing the company's own Privacy Policy or Terms of Service. Furthermore, it was prohibited from referencing data protection regulations like GDPR, LGPD, or CCPA, even if the user raised these legal frameworks directly.
4Contradiction of Public Policies
These hidden directives directly contradicted WhatsApp's public-facing privacy policy effective July 2, 2026. While the official policy acknowledges user rights to contact regulators under GDPR, the AI instructions actively suppressed this information. This created a discrepancy between the company's stated legal commitments and the guidance provided by its automated support system.
5The Rationale Behind Restrictions
WhatsApp argued that preventing the chatbot from providing legal opinions is a standard safety measure. While avoiding unauthorized legal advice is sensible, the instructions went further by suppressing public information about regulatory bodies. The company also cited security risks in manually deleting accounts without verifying ownership via an active phone number.
6Technical Implementation and Scope
The hidden notes were sent to search engine crawlers, including those from Google and Bing, alongside standard page content. Researchers analyzed 545 help pages to identify these blocks. While Facebook and Instagram help centers use the same infrastructure, similar restrictive notes were not found on 300 pages checked across those other platforms.
7Inconsistent Deletion Timeframes
The investigation highlighted confusion regarding account deletion timelines. WhatsApp's help pages provide conflicting figures, citing 120 days for general deletion but 365 days for US users. Some pages omit the US exception entirely. These inconsistencies complicate the user experience for those attempting to manage their data privacy through official support channels.
8Implications for AI Transparency
The removal of these notes from live pages marks a shift in how companies manage AI-assisted support. By embedding instructions that contradict public policy, the system limited user access to legal rights. Moving forward, users should rely on official privacy documents rather than chatbot responses when navigating complex legal or regulatory concerns.