WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws

Investigators discovered hidden instructions embedded in WhatsApp's public help pages that directed the company's AI chatbot to avoid recommending users contact data protection authorities. The instructions also prohibited the AI from citing privacy regulations such as GDPR, LGPD, or CCPA, even when users raised these topics themselves. The directives appeared on pages about account deletion and complaints, remaining invisible to human visitors but delivered to crawlers and the AI model. WhatsApp later confirmed the text was intended for its internal support chatbot and attributed the exposure to an error that has since been corrected. The findings highlight a gap between the company's publicly stated privacy policy and the operational guidance given to its AI systems.

HabrOctober 20, 2026Translated from Russian

Read at source

Researchers examining WhatsApp help documentation uncovered hidden instructions that instructed the company's AI support chatbot to withhold information about user rights under privacy law. The instructions remained invisible to ordinary visitors but were embedded in the page source delivered to crawlers and the language model.

The first set of directives appeared on the account-deletion help page. Visible text explained that deactivated accounts are removed after 30 days and inactive accounts after 120 days (365 days in the United States). The hidden block that followed told the AI: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." It also forbade suggesting that WhatsApp could manually delete accounts or that users should try another phone with an active number.

A second hidden block on the complaints and blocking page activated whenever a user mentioned lawsuits, lawyers, courts, or legal action. The AI was ordered not to quote, summarize, or interpret WhatsApp's Terms of Service, Privacy Policy, or any legal documents. It was further instructed never to reference data-protection laws including GDPR, LGPD, or CCPA, even if the user raised them first.

These instructions contradicted WhatsApp's publicly available European privacy policy, which explicitly informs users of their right to lodge complaints with the Irish Data Protection Commission or any competent supervisory authority. The policy also states that users always retain the right to request access, rectification, and erasure of their data.

WhatsApp told WIRED that the notes were meant exclusively for its own AI support chatbot and were published by mistake. The company stated it does not want its bots to provide legal advice. All 102 hidden blocks were removed from the live site between 15 and 18 October 2026, although copies remain available in the Internet Archive.

WhatsApp CCPA Internet Archive GDPR Wired LGPD

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Privacy & Surveillance

Privacy & Surveillance

Maximizing iPhone Privacy: Essential Settings to Enable, Disable, and Verify Immediately

The article provides a detailed guide on strengthening iPhone privacy by limiting unauthorized access to messages, location data, photos, and cloud backups. It explains how to set a strong alphanumeric passcode, enable Stolen Device Protection, and restrict lock screen notifications and widgets. Users are advised to review Apple ID security, enable Advanced Data Protection for iCloud, and minimize app permissions for location, contacts, and camera. Additional steps include turning off cross-app tracking, using private Wi-Fi addresses, and activating Lockdown Mode for high-risk scenarios. The guide emphasizes regular updates, encrypted local backups, and periodic audits of shared access and active sessions to maintain long-term protection.

SecuritylabOct 28, 2026Translated from Russian

Privacy & Surveillance

Top 10 Secure DNS Servers for Privacy, Threat Blocking and Ad Filtering in 2026

Public DNS resolvers differ significantly in their ability to block malicious domains, filter advertising and tracking, respect user privacy, and support modern encryption protocols. The guide evaluates ten services including Quad9, Cloudflare, AdGuard DNS, NextDNS, Control D, CleanBrowsing, Mullvad DNS, DNS4EU, Google Public DNS and DNS.SB, providing IPv4 addresses, DoH and DoT endpoints, and recommended use cases. Key distinctions include Quad9’s focus on phishing and malware blocking without logging, Mullvad’s strict no-logs policy requiring encrypted protocols only, and DNS4EU’s EU-based infrastructure with mandatory court-ordered blocks. The article explains why DNSSEC and encryption alone are insufficient and outlines four practical selection criteria: threat filtering quality, data-handling practices, encryption support, and network stability. Detailed configuration instructions cover Windows 11, Android, iOS, and home routers, along with verification methods and warnings against mixing providers with conflicting policies.

SecuritylabOct 28, 2026Translated from Russian

Privacy & Surveillance

WebRTC IP Leaks Explained: Why Disabling the Protocol Harms Anonymity in Anti-Detect Browsers

The article from Aurorium details how WebRTC technology can leak real IP addresses even when users route traffic through proxies. It explains the peer-to-peer mechanics of WebRTC, the role of STUN servers in generating ICE candidates, and why standard TCP proxies fail to handle UDP traffic. Disabling WebRTC via flags or JavaScript extensions creates detectable anomalies that anti-fraud systems flag as non-standard environments. The recommended approach involves native emulation inside the browser kernel so that STUN requests return proxy IPs while preserving full API integrity across workers. Additional leaks through local network addresses, mDNS candidates, and IPv6 are also covered with practical verification methods using tools like BrowserLeaks and CreepJS.

HabrOct 26, 2026Translated from Russian