WhatsApp's support chatbot was told not to point you to privacy regulators

About 80 of WhatsApp's help and FAQ pages carried text that visitors never saw: instructions written for a chatbot, one of Meta's own, tucked into the pages' code. A privacy company called Redact found them, and WIRED reviewed the hidden text.

Redact's researchers spotted the text on October 8, saved copies of all 545 pages linked from WhatsApp's help center, and counted 102 blocks of instructions across 80 of them, Malwarebytes reports. The text was sent along with each page but never shown on screen.

The instructions sat in blocks of code under the heading HelpContentGalaxyLLMInclude, and WIRED says they can still be seen in the code of archived copies of the help pages, though they are no longer in the live ones (WIRED). Redact founder Dan Saltman told WIRED the standout issue is the gap between what people are told and what the chatbot is told.

Most of it was routine support guidance, like asking a clarifying question or sending people to the right help page, according to Malwarebytes. One line on the account-deletion page stood out. It told the chatbot: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." (WIRED)

Another block, on the page about reporting and blocking, covered what to do when someone mentions lawyers or lawsuits. It told the chatbot not to cite WhatsApp's terms or privacy policy, and not to bring up privacy laws such as GDPR or CCPA, even when the user raises them, WIRED reports.

After WIRED contacted Meta, the text was removed from all of the pages. WhatsApp spokesperson Joshua Breckman told WIRED that it had been showing because of a bug that is now fixed, and that these were instructions for the company's support chatbot, not for users.

Breckman also said WhatsApp wants its support bots to stick to product help rather than legal advice, and that the company already gives people information about their data rights and how to act on them (WIRED).

Some things are still unknown. It isn't clear how long the text was visible, or whether other companies' chatbots could read it (WIRED). Redact also didn't test whether WhatsApp's chatbot actually followed these instructions, and taking the text off public pages doesn't show whether WhatsApp changed them or still uses them internally (Malwarebytes).

How much should this worry you? For most people, not much on its own. If you can still open WhatsApp on your main phone, you can delete your account yourself in a few steps, which are below (Malwarebytes). The people who lose out are the ones who get stuck and ask the bot for help.

A support bot doesn't have to be your lawyer, and it's reasonable for a company to stop its bot from giving legal opinions. But as Malwarebytes points out, declining to give legal advice is not the same as declining to tell you where else you can get help.

The deletion instruction matters most for one group: people who can't delete their account because they lost the phone or number it's tied to. WhatsApp's deletion page doesn't offer them a manual way to do it. It only describes automatic removal once an account has been inactive for 120 days, or 365 days for US users (Malwarebytes).

Meanwhile, WhatsApp's own information-rights page says people can contact the company about their data-protection rights and, depending on where they live, their local data protection authority, per Malwarebytes. That's the same option the chatbot was told not to recommend.

The bigger lesson goes past WhatsApp. When an AI helper sits between you and a company, it works from rules you usually can't see, and those rules can include what not to tell you. This leak is a rare look at what such rules contain, as WIRED notes. If a support bot gives you a dead end on something to do with your data, the company's privacy or data-rights page is worth checking for yourself.

• Capcom says attackers got into CAPCOM ID, its shared account system, and exposed more than 11.7 million customer email addresses along with details like the last login time and IP address; it says other passwords and credit card details weren't affected (BleepingComputer).
• Six states passed laws this year limiting how police use automated license plate readers, and the EFF published a plan for state lawmakers that starts with banning police plate-reader networks outright.

If you're done with an app, uninstalling it doesn't delete your account. For WhatsApp, Malwarebytes lays out the steps, done on your main phone:

1. Export any chats you want to keep first, because deletion can't be undone.
2. Open Settings (on Android, tap the three-dot menu first), then Account, then Delete my account.
3. Enter your phone number in full international format, with the country code, and confirm.

Expect it to take a while: WhatsApp says deleting your information can take up to 90 days, people you messaged keep their copies, and some data can stay in backups (Malwarebytes). If your phone was lost, ask your carrier for a replacement SIM with the same number, register WhatsApp again, then delete the account (Malwarebytes).