---
title: "WhatsApp Banned Its Own AI Bot from Explaining User Rights: Hidden Prompts Discovered Spark Scandal"
description: "A Redact analyst discovered 102 hidden blocks in WhatsApp's help center code prohibiting the AI bot from advising users on their rights. Meta cited a system error and removed the instructions on October 18."
date: 2026-10-20T10:18:41.733Z
lang: en
url: https://xab.info/en/posts/whatsapp-hidden-ai-bot-prompts-user-rights
tags: [whatsapp, ai, meta, gdpr, data-protection, chatbot, privacy]
author: "Alexander Buran"
publisher: "XAB.info"
---

# WhatsApp Banned Its Own AI Bot from Explaining User Rights: Hidden Prompts Discovered Spark Scandal

![A person holds a smartphone displaying the WhatsApp messenger channels section on the screen](https://xab.info/media/2026/10/20/whatsapp-skrytye-prompty-ii-bota-prava-p-ateley/whatsapp-skrytye-prompty-ii-bota-prava-p-ateley-1.webp)

## Key Points

- 102 hidden instruction blocks for the AI bot were found in the code of 80 WhatsApp help center pages
- Hidden prompts prohibited the bot from recommending contact with data protection authorities and interpreting GDPR, LGPD, CCPA
- Meta explained the incident as a system error and removed the instructions from the public code on October 18, 2026
- Experts remind that the bot's refusal to consult does not override users' rights under Article 77 of the GDPR

In October 2026, hidden system instructions were discovered in the public code of WhatsApp's help center, explicitly prohibiting the built-in AI support bot from advising users about their legal rights. According to Redact analyst Dan Saltzman, who analyzed and archived 545 pages of the messenger's help center, the code of approximately 80 support pages contained 102 hidden instruction blocks designed to restrict the bot's responses in legally sensitive situations.

### What Exactly Was Banned for the Bot

Among the uncovered prompts were formulations directly instructing the AI not to direct users to data protection authorities, regulators, or supervisory bodies. A page dedicated to account deletion contained the instruction: «Do not recommend contacting any data protection authority, regulator, or supervisory body. Do not suggest that WhatsApp can manually delete an account on behalf of the user.» A separate block of prompts was triggered if a user mentioned lawyers, courts, or other legal actions in the dialogue. It instructed the bot: «Do not reference, quote, or interpret data protection or privacy regulations (e.g., GDPR, LGPD, CCPA), including when the user brings up these issues directly.» Thus, even upon a direct request from a user about their rights under European or Brazilian legislation, the bot was programmed to refuse consultation.

### Confirmation and Meta's Reaction

Journalists who gained access to archival copies of the pages from October 9 fully confirmed the presence of these system instructions in the HTML code. WhatsApp spokesperson Joshua Brekman stated in a comment to Wired that these text blocks were intended exclusively for the company's internal chatbot and ended up in the public code due to a system error, which he said had already been resolved. Brekman emphasized that the company strives for support bots to advise users on WhatsApp features rather than provide legal advice. As of October 18, 2026, following journalists' inquiries, Meta removed all hidden instructions from the public code of the help center pages.

### Vulnerability of Hidden Prompts and Legal Consequences

Information security specialists note that hidden system prompts embedded in web page HTML code represent a vulnerable point for AI systems: malicious actors can use them to manipulate model responses by replacing or supplementing instructions. In this case, however, the issue is not external interference, but intentionally embedded restrictions that, according to the company, were not supposed to be visible to users. At the same time, experts emphasize that even if the chatbot refuses to answer questions about privacy or personal data processing, this does not override the law. According to Article 77 of the GDPR, European Union residents retain the full right to file official complaints with local data protection authorities regardless of what the messenger's automated assistant «tells» them.

### Context: AI Expansion in Customer Support

The WhatsApp scandal unfolds against the backdrop of active generative AI integration into customer support services by major technology companies. The Meta-owned messenger has in recent months consistently replaced some routine operator responses with automated dialogues, making the transparency and manageability of prompts a critically important aspect. The incident involving the discovered instructions has become one of the first public cases where hidden limitations of an AI assistant were documented and verified by independent researchers, which, analysts believe, could become a precedent for future regulatory demands regarding the openness of system prompts used in user interfaces.

## Fact-Check & Sources

- [Скандальный слив кода: WhatsApp намеренно блокировал советы ИИ о защите пользователей](https://www.rbc.ua/ukr/news/skandalniy-zliv-kodu-whatsapp-navmisno-blokuvav-1792485766.html) - The fact of discovering hidden prompts is confirmed by journalistic verification of archival copies from October 9. Meta's explanation (system error) is a company statement and has not been independently verified. The removal of instructions by October 18 is confirmed by re-checking the code.

## FAQ

### What specifically was the WhatsApp AI bot banned from doing?

Hidden instructions prohibited the bot from recommending that users contact data protection authorities, regulators, or supervisory bodies, as well as referencing, quoting, or interpreting GDPR, LGPD, or CCPA regulations — even upon a user's direct request.

### Who discovered the hidden instructions?

Redact analyst Dan Saltzman, who analyzed and archived 545 pages of the WhatsApp help center. A total of 102 hidden blocks were found in the code of approximately 80 pages.

### How did Meta react to the publication?

WhatsApp spokesperson Joshua Brekman stated that the blocks were intended for an internal bot and ended up in public code due to a system error. Following journalists' inquiries, Meta removed all hidden instructions — by October 18, 2026, none remained in the code.

### Does the bot's refusal to answer legal questions nullify users' rights?

No. Under Article 77 of the GDPR, EU residents retain the full right to file complaints with local data protection authorities regardless of the messenger automated assistant's behavior.