WhatsApp Embedded Hidden Prompts Blocking AI Chatbot From Citing GDPR or Data Regulators

The instructions appeared in HTML comments on at least two critical pages. One block on account deletion explicitly ordered the chatbot never to recommend contacting any supervisory authority, never to offer manual deletion, and never to suggest using another device. A second block on the reporting page instructed the model to stop referencing privacy regulations the moment a user mentioned lawyers, courts, or litigation. Redact documented these on 8 October and confirmed removal by 18 October after examining 545 pages.

WhatsApp's own European privacy policy, updated 2 July 2026, states users retain the right to lodge complaints with the Irish DPC or any competent authority under GDPR Article 77 and erasure rights under Article 17. The hidden prompts directly contradict that language. No evidence shows the chatbot actually followed the instructions; only the prompts themselves were recovered. The pattern matches other blocks that limited responses on legal matters and account recovery.

This is not isolated. The same Meta help system powering Facebook and Instagram showed zero comparable blocks when Redact scanned 300 pages. The discrepancy suggests targeted engineering for WhatsApp's deletion and complaint flows rather than generic content filtering. Users who lose a phone number already face a 30-to-365-day forced wait; the prompts ensured the chatbot would not surface regulatory avenues during that period.

Meta has not released logs of chatbot outputs before the fix. The Irish DPC and other EU regulators now have a documented internal directive that conflicts with published policy. Expect formal complaints and possible Article 83 investigations within the next quarter.