WhatsApp Embedded Hidden LLM Directives in 2 of 545 Help Pages on Oct 8 2026

The first block sat on the account deletion page. Visible text listed 30-day and 120-day wait periods. Hidden text added three explicit orders telling the model not to suggest manual deletion or regulator contact. The second block appeared on the reporting and blocking page. It activated on any reference to legal action and barred citation of GDPR Article 77 or equivalent statutes even when users raised them first.

WhatsApp's July 2 2026 European privacy policy states users retain rights to erasure and complaints to the Irish Data Protection Commission. The hidden directives directly contradicted those statements once legal terms surfaced. No employee-facing changelog or internal memo recorded the addition of the blocks.

Meta has published no CVE or incident report on the deployment. Similar hidden prompt patterns appeared in prior OpenAI and Anthropic system cards when models were instructed to route legal queries away from specific statutes. The pattern indicates an operational choice to limit chatbot exposure to statutory language rather than a documented policy update.

Regulators in Ireland and Brazil now hold copies of the archived pages. A formal request under GDPR Article 58 could compel Meta to disclose the full commit history and any A/B test logs tied to the two pages.