WhatsApp's help pages hid LLM instructions: dont recommend a regulator

WhatsApp's privacy policy for Europe informs users they can complain to a data protection regulator, citing the right under the applicable law. Until mid-October 2026, WhatsApp's help pages included instructions for an AI not to recommend the regulator, nor to cite that law once legal action or a lawyer had been mentioned. These instructions were hidden from users' view, only accessible to the AI.

The hidden instructions were discovered on October 8, 2026, and were examined across WhatsApp's help center, consisting of 545 pages.

Out of those 102 blocks, most were harmless, but two stood out. The first applied to account deletion, specifying waiting periods for account removal based on account deactivation or inactivity. The second was found on the page about reporting and blocking, which came into effect when discussing legal action, lawsuits, lawyers, or courts.

This instruction told the AI to avoid any legal discussion, including privacy laws that protect users. The hidden instructions contradicted WhatsApp's published privacy policy for the European region, which was more open and allowed users to request account deletion at any time.

WhatsApp's help pages, built on the same system, were also checked for other hidden instructions. Nearly all of them were housekeeping, clearing up word confusion, directing users to relevant pages, or describing paid plans. However, twenty of these hidden instructions were similar to the two prominent ones, protecting users from certain situations.

The hidden instructions have been removed from WhatsApp's live pages, and users can access them through the Internet Archive's copies of the pages. However, the instructions reveal WhatsApp's caution in handling users' requests for account deletion, legal inquiries, and other sensitive topics.