WhatsApp help pages hid orders telling an AI not to recommend going to regulators
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
Redact found 102 hidden blocks on 80 WhatsApp help pages that only an AI was meant to read. Two of them told it not to point anyone to a regulator and not to bring up the GDPR when lawyers or lawsuits came up. WhatsApp blames a bug involving its support chatbot's instructions, and by October 18 none were left.
Until mid-October, WhatsApp's help pages carried orders for an AI that no user could see. Redact, a privacy firm, made them public on Monday, October 19, after spotting them on October 8.
To gauge how far they went, Redact went through the 545 pages linked from WhatsApp's help centre and counted 102 blocks of hidden text across 80 of them: the server sent them along with each page, but they never appeared on screen. Most were harmless, but two stood out. On the account deletion page, one order read: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." On the reporting and blocking page, if the user brought up lawyers or lawsuits, the AI was not to cite data protection or privacy laws such as the GDPR, even when the user had named them.
Redact says none of this was in line with the documents WhatsApp has to publish: its privacy policy for Europe reminds users they can file a complaint with a data protection authority. WhatsApp told WIRED, as reported by Redact, that the text was meant for its support chatbot and had appeared on the pages because of a bug, which has since been fixed. Spokesperson Joshua Breckman said the company wants those assistants to give advice about WhatsApp rather than legal advice, as he told WIRED and as reported by Infobae.
The orders were still there on October 15, and by October 18 they had disappeared from all 80 pages, although copies in the Internet Archive still hold them. Those copies show that the note on the account deletion page was absent on July 12 and present on September 4. Redact also checked 300 help pages from Facebook and Instagram, which run on the same system, and found no similar notes. It is not known whether WhatsApp's chatbot ever followed the orders.
Why it matters · analysis and opinion
This finding puts the spotlight on a layer that is almost never seen: the instructions a company gives its customer service assistant. Here they did not tell the bot to lie, but they did leave out complaint routes that the company itself acknowledges in writing, and that turns a technical setting into a matter of trust. For people who use these assistants, the lesson is simple: what a support chatbot says is no substitute for the privacy policy or for the information from each country's data protection authority. Companies that deploy one need to review those instructions as carefully as a legal text, because they can end up in plain sight and because they limit what customers get to know about their rights.
Source: Redact · Written with the help of AI: how we make the news
