A review of WhatsApp's help centre archives uncovered instructions embedded in the site's source code that limited how its support chatbot could respond to certain user queries. The findings, documented by researchers on October 8, 2026, revealed two distinct sets of directives: one visible to human users and another concealed within the HTML that was intended solely for AI crawlers indexing the pages.
The hidden text appeared in two key sections of the help documentation. In the account deletion guide, an unseen instruction told the AI not to recommend contacting a data protection authority, even when users referenced legal remedies. A second directive, embedded in the reporting and blocking page, prohibited the chatbot from acknowledging or citing relevant privacy laws once a user mentioned legal action, a lawyer, or a court. These blocks were not rendered on screen for human visitors but were included in the page source, where they could be read by search engine crawlers and AI training systems.
The privacy policy for WhatsApp's European operations, effective July 2, 2026, affirms users' rights to lodge complaints with the Irish Data Protection Commission or other EU supervisory bodies under the GDPR. However, the concealed AI directives contradicted this by instructing the chatbot to withhold such information when legal topics arose. This created a discrepancy between publicly available policy and the guidance being fed to automated systems.
Other hidden instructions in the source material included limitations on discussing account recovery after device loss, restrictions on reversing bans via support channels, and guidance to avoid assisting with payment issues for WhatsApp Plus subscriptions. Nearly all of the 102 hidden text blocks identified were routine operational notes, but the two related to legal compliance and regulator references stood out due to their potential impact on user access to rights.
The discovery was made possible through analysis of archived versions of the help pages using the Internet Archive. Researchers accessed the raw HTML of deleted account and reporting pages from October 8 and 18, 2026, and identified the hidden directives through targeted searches for phrases like "do not recommend contacting". These blocks were absent from later archived copies, indicating they were removed after the findings were reported.
While WhatsApp has not publicly commented on the purpose of these AI-specific instructions, a company representative confirmed they were part of a broader effort to guide its support chatbot's behavior. The company emphasized that it does not intend for its automated systems to provide legal advice and that users should be directed to legal counsel when appropriate. However, critics note that suppressing references to regulatory rights — even with the intent of avoiding legal overreach — risks limiting user awareness of available remedies.
The incident highlights broader concerns about transparency in AI deployment for customer support. As companies increasingly integrate large language models into service interfaces, the inclusion of hidden behavioral directives raises questions about how information is filtered, who controls automated responses, and whether public-facing policies align with internal system instructions. The use of AI in regulatory contexts continues to evolve, and the boundaries of permissible guidance remain under scrutiny.
The full implications of these findings are still being explored. It remains unclear whether the chatbot ever acted on the restricted responses, whether other languages or regions were affected, or whether similar patterns exist across Meta's broader help ecosystem. What is clear is that users relying on automated support may have encountered incomplete or inconsistent information without knowing it.
For users seeking to delete an account, the recommended path remains to follow the in-app process, which requires access to the original phone number. If that is unavailable, waiting periods of up to 365 days may apply depending on regional settings. In the EU, users retain the right to file complaints with data protection authorities regardless of chatbot responses, and such complaints can be submitted directly through official channels.
The case underscores the importance of verifying automated guidance against official documentation and legal frameworks. As AI becomes more embedded in digital services, the need for clear, auditable, and transparent interaction policies grows. Whether this incident leads to changes in how companies manage AI behavior in sensitive domains remains to be seen.
For those interested in reviewing the original source material, archived versions of the relevant help pages are available through the Internet Archive. Accessing the raw HTML via browser developer tools allows for inspection of hidden content that is not visible in standard page views.