# WhatsApp Hidden AI Instructions Restrict Legal and Regulatory Guidance Hidden chatbot prompts instructed AI to avoid citing privacy regulators or legal rights. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/d2fd14bd-638e-4619-ad6e-3c73d8cf4718 ## Hidden AI Prompt Discovery Data-deletion firm Redact discovered hidden instructions embedded within WhatsApp help page HTML code. These prompts specifically directed the support chatbot to avoid recommending data protection authorities to users. The instructions were active between September 4 and October 18, 2024, appearing in the source code but remaining invisible to standard website visitors. ## Restricting Legal Discourse A secondary block of hidden text instructed the AI to ignore mentions of lawyers, lawsuits, or courts. When users raised these topics, the chatbot was told to avoid citing GDPR or privacy laws. Instead, it was directed to refer users to qualified legal professionals, effectively silencing automated discussions regarding user legal rights. ## Contradicting Official Privacy Policies The hidden instructions directly conflicted with WhatsApp's own privacy policy. While the policy explicitly informs European users of their right to lodge complaints with the Irish Data Protection Commission, the chatbot prompts forbade suggesting such regulatory contact. This discrepancy creates a significant gap between stated corporate transparency and automated support system behavior. ## Scope of Hidden Blocks Redact identified 102 hidden instruction blocks across 80 different help pages. While many blocks served routine functions like clarifying terminology, others restricted user autonomy. For instance, users unable to delete accounts were told that waiting was the only correct answer, preventing the chatbot from offering alternative solutions or acknowledging specific user rights. ## Technical Implementation Details The instructions were stored under the HTML name HelpContentGalaxyLLMInclude. These blocks were served to search engine crawlers but were not visible on the rendered page. Notably, similar checks on 300 Facebook and Instagram help pages yielded no such hidden instructions, suggesting the implementation was specific to the WhatsApp support chatbot infrastructure. ## Corporate Response and Removal WhatsApp removed all 102 hidden blocks by October 18, 2024, following inquiries from media outlets. Spokesperson Joshua Breckman stated the instructions were intended to ensure accurate responses and prevent the chatbot from offering unauthorized legal advice. The company maintained that these prompts were meant for internal chatbot guidance rather than direct user interaction. ## Regulatory and Legal Implications The incident highlights tensions between AI-driven customer support and GDPR compliance. Article 77 of the GDPR guarantees the right to lodge complaints, while Article 17 covers erasure rights. By programming chatbots to bypass these topics, companies risk creating barriers that hinder users from exercising their fundamental data protection and legal rights. ## Future Security Considerations This event underscores the necessity of auditing AI agent instructions and system prompts. As AI systems increasingly handle sensitive user queries, organizations must ensure that automated guidance aligns with legal obligations. Security teams should prioritize visibility into these hidden system layers to mitigate risks associated with biased or restrictive AI behavior. ## Sources covering this story - https://thehackernews.com/2026/10/whatsapp-hid-instructions-in-help-pages.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._