tl;dr

WhatsApp’s privacy policy for Europe says you can complain to a privacy regulator. A note hidden in the code of its help pages told its support chatbot: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.” Redact, a company that sells data-deletion tools, found 102 hidden notes on 80 help pages. Most were routine, the regulator line sat only on the account deletion page, and nobody has shown the bot followed it. All 102 were gone by 18 October 2026. In episode 2 of Ignore Previous Instructions, the Signals Corps podcast, threat researcher Marcus Arnold’s verdict is that this is less bad than the headlines suggest, but we only ever see the prompts that leak. If you run a support bot, assume its prompt will be read.

WhatsApp told its chatbot not to mention your rights

This player is provided by Spotify and sets optional cookies. It loads only if you allow optional cookies.

Listen on Spotify

Watch on YouTube

What we covered

What Redact found (0:53)

Redact read all 545 pages linked from WhatsApp’s help center. Redact sells tools that bulk-delete your posts and data, so it has a commercial interest in how hard account deletion is. On 80 of the pages it found 102 notes for WhatsApp’s support chatbot, sent with the page but never shown on screen. Many simply explained terms or pointed a question to a better page. WIRED reports that some notes had sections headed “WHAT NOT TO SAY”.

The account deletion page told the bot not to recommend contacting a regulator and not to suggest WhatsApp can delete an account on the user’s behalf. A note on the account deactivation page told it that, for people who had lost their number, waiting was “the ONLY correct answer”. Another note, triggered when a user mentioned lawyers, courts or legal action, told the bot not to cite WhatsApp’s own terms or privacy policy, and not to “reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly”. The Hacker News reports that all 102 notes were gone by 18 October, after WIRED contacted Meta and before WIRED or Redact published.

Why the regulator line matters (2:11)

Under Article 77 of GDPR, everyone has the right to complain to a data protection regulator, and WhatsApp’s own privacy policy for Europe says so. In 2021 the Irish Data Protection Commission fined WhatsApp €225 million for failing to be transparent with users, and the order included telling people how to complain to a regulator.

Sarah Andrews, a Signals Corps threat researcher, points out that the notes are narrower than the headlines suggest. The regulator line sat only on the account deletion page, and the note about privacy law applied only when someone raised legal action. A charitable reading is that the note keeps the bot from giving legal advice. Marcus Arnold’s reply: those are exactly the people the right to complain exists for.

WhatsApp told WIRED: “These are instructions to our chatbot, not directly to users”, and WIRED reports that WhatsApp put the text showing on the pages down to a bug. A bug explains why the notes were visible. It doesn’t explain why someone wrote them. Redact only read the instructions, so nobody has shown the bot ever followed them.

A different page for AI crawlers (4:32)

Redact found that WhatsApp served the notes to browsers and to Google’s and Bing’s crawlers. When it requested the same pages posing as OpenAI’s, Anthropic’s and Perplexity’s crawlers, they came back without the article or the notes. Nobody has explained why, and a rule that blocks AI scrapers would account for it. Many sites sort visitors this way: in our own scan of HTTP headers, 136 of the 139 sites that reported an AI-bot check said they had classified Common Crawl’s crawler, CCBot, as an AI bot. Once a site can tell an AI agent from a person, it can show the agent a different page: one with less on it, as here, or one with text the person never sees.

Grok’s unauthorized prompt changes (5:35)

WhatsApp isn’t the first company caught out by instructions it didn’t mean to show. In February 2025, people reading Grok’s system prompt found it told the bot to ignore sources saying Elon Musk or Donald Trump spread misinformation. xAI said a former OpenAI employee made the change, and reverted it. In May 2025, Grok started bringing up claims of white genocide in South Africa in unrelated answers, and xAI blamed an unauthorized modification to the prompt. After that, xAI said it would publish its prompts on GitHub. Most companies never show theirs.

Can hidden text sway ChatGPT search? (6:44)

Hidden text swayed ChatGPT search in a December 2024 test, though it’s an old test and we wouldn’t assume it still works. The Guardian built a fake product page for a camera with negative reviews on it, and hid text asking ChatGPT for a favorable review. ChatGPT search came back entirely positive. A real brand would also be taking a big risk: Bing’s guidelines say prompt injection content can get a site demoted or delisted, and in May 2026 Google brought AI Overviews and AI Mode under its spam policies, including the rule on hidden text.

How bad are hidden chatbot instructions? (7:47)

WhatsApp’s hidden notes are less bad than the headlines suggest. The bigger problem is that outsiders only see the prompts that leak. A company’s chatbot brief serves the company first. If you run a support bot, assume its prompt will be read, and leave out any line you wouldn’t put in your terms of service. If your teams use agents, remember a page can carry text meant only for the agent, and have a person approve anything that sends personal data.

Show notes

The sources we used, in the order the episode uses them: