WhatsApp Hides Instructions for AI in Its Help Center
WhatsApp hides instructions for AI in its Help Center, telling it not to recommend data protection authorities or cite GDPR after users mention lawyers or lawsuits—even though Europe’s privacy policy clearly specifies rights under Article 17 and Article 77.
Another page instructs the AI to tell users who can no longer access their phone number or original device to wait for automatic account deletion, without recommending that they contact a regulator or ask WhatsApp to delete the account. These instructions are not displayed on screen and were discovered on October 8, 2026.
When You Want to Delete Your Account but the Only Answer Is to Wait
If a phone is lost or the original number is no longer usable, users cannot delete their WhatsApp account through the app or primary device. The AI’s answer is therefore limited to waiting for the system to delete it automatically: 30 days after deactivation, or 120 days if there is no activity (365 days in the United States).
The problem is that the AI does not recommend contacting a regulator, does not mention that WhatsApp may be able to help delete the account, and does not suggest using another phone with an active number. Users who want to manage their account immediately are therefore left with only one answer: “wait.”
WhatsApp Uses Its Help Center as Both a Guide and a Data Source for AI
WhatsApp’s Help Center is not intended only for people to read; it is also a data source used by AI to answer questions, with a total of 545 linked pages.
On October 8, 2026, we found text that users cannot see but the AI can read. These messages were inserted beneath the normal content and specify what the AI should or should not recommend in certain situations. The investigation involved reading all 545 pages and saving a copy of each one.
What People See Versus What the AI Receives
The account deletion page tells users that deactivated accounts will be deleted after 30 days, while inactive accounts will be deleted after 120 days, or 365 days in the United States. But the hidden instructions add prohibitions concerning other options.
| Factor | What People See | What the AI Receives |
|---|---|---|
| Automatic deletion | 30 days after deactivation; 120 days when inactive (365 days in the United States) | Provides the same timeframes |
| Contacting a regulator | Not mentioned | Must not recommend |
| Having WhatsApp delete the account | Not mentioned | Must not recommend |
| Using another phone | Not mentioned | Must not recommend |
The difference is therefore not in the automatic deletion timeline, but in the fact that the AI is instructed to close off options for people who cannot access the original app or phone number.
From Warnings About Legal Advice to Blocking Information About Rights
The hidden instructions on reporting and blocking pages become active when users mention a case, lawyer, court, or lawsuit. The AI is then instructed not to provide legal opinions, cite WhatsApp’s Terms of Service, Privacy Policy, or legal documents, or mention the company’s liability or damages.
More importantly, the instructions also prohibit citing data protection laws and privacy regulations such as the GDPR, LGPD, and CCPA, even when users mention the laws first. Telling users to consult a lawyer is allowed, but removing information about regulators and legal rights from the answer blocks information users should know.
How the Answers Change in Real-World Situations
If users do not have their original phone number or device, the answer they receive may be limited to waiting for the system to delete the account automatically, without recommending that they use another phone, contact a regulator, or ask WhatsApp to delete it. This is despite the policy stating that such a request can be submitted.
If users ask whether a regulator can help, the system is instructed not to recommend that authority. When they mention a lawyer, lawsuit, or court, it avoids all legal documents, even if they bring up the GDPR or data protection rights themselves. The result is an answer that still sounds polite but removes important information that could help users decide what to do next.
Rights in the Privacy Policy Versus What the Chatbot Refuses to Say
WhatsApp’s privacy policy for Europe took effect on July 2, 2026, and allows users to exercise their rights under the GDPR. But the hidden instructions limit what the chatbot will tell them.
| Factor | Privacy Policy | Hidden Instructions |
|---|---|---|
| Right to delete data/account | Can ask WhatsApp to delete it under Article 17 | Does not recommend that WhatsApp delete it itself |
| Regulators | Specifies the right to lodge a complaint under Article 77 | Must not recommend a regulator or supervisory authority |
| When mentioning a lawyer or case | Can still cite rights and legal documents | Must not cite the GDPR, policies, or legal documents |
The key distinction is that “requesting deletion” is a user right, while “WhatsApp will delete it itself” is a separate matter that the chatbot is instructed not to suggest.
Where WhatsApp Has a Point—and Where the Instructions Go Too Far
WhatsApp has a reasonable basis for preventing the chatbot from giving legal opinions on behalf of the company and for recommending that users consult a professional. In addition, not having a phone number does create genuine risks when deleting an account upon request.
But this rationale should not extend to prohibiting discussion of regulators or data protection laws, because this is public information that helps users understand their options. Hiding complaint channels therefore goes beyond preventing legal advice.
Pros
- +Reduces the risk of the chatbot giving legal opinions on behalf of the company
- +Encourages users to consult a professional
Cons
- −Prohibits telling users how to file complaints with regulators
- −Hides useful information about data protection laws
The Important Question Is Not Simply Whether the AI Gives the Wrong Answer
These hidden instructions do not eliminate users’ legal rights. In the European Union, those rights come from Articles 17 and 77 of the GDPR, and instructions given to a chatbot cannot take them away.
But the instructions can prevent users from knowing what rights they have because the chatbot does not tell them that regulators or data protection laws exist. This is where the line lies: prohibiting a chatbot from giving legal opinions is one thing, but keeping accurate and useful information out of its answers is something else entirely.
When the Same Help Page Speaks Differently to Different Groups
The problem is not merely incomplete information. It is that the same Help Center sends different messages to two groups. Users see the normal guidance, while the AI receives instructions that remove certain options from its answers, such as recommending a regulator or another way to delete an account.
A transparent support system must therefore disclose both the text people can read and the instructions used to guide the AI, because hidden instructions affect what users actually receive, even when the content on the website appears correct. It is reasonable to say that AI should not provide legal opinions, but that should not be used as a reason to hide accurate information users ought to know.
What Should Be Checked Next
All help pages linked by WhatsApp should be examined by comparing the text users see with the instructions sent to the AI, especially the pages covering account deletion, reporting, and blocking. Small differences can change the answers users receive about their rights.
Another point is to determine whether the AI still removes information about Data Protection Authorities, the Privacy Policy, or the GDPR from conversations when users mention a lawyer or legal action. Reviewing the service policies should therefore not stop at the visible text on the website; it should also consider what instructions the AI receives and whether those instructions are removing important information from the conversation.