The internet’s changing. There are more than just humans reading what’s there on webpages. AI, too, are surfing the web. And it appears Meta had its own AI chatbot in mind when it added hidden instructions to several WhatsApp support pages.
Privacy firm Redact’s report said there were nearly 80 pages on the WhatsApp website with such instructions in their code. The report said the instructions included “what not to say” sections. The messages, it seems, told the company’s support chatbot not to give legal advice and, in some cases, not to mention data protection regulators or privacy laws.
What did WhatsApp pages tell its AI?
The text was found in the source code of some WhatsApp webpages, the report said. When you go to a page, you usually do not see the source code. But you can see it by opening the source code panel. Note that the texts have since been deleted by Meta.
The report also states that after going through all 545 pages linked from WhatsApp’s help centre, the text was found in code blocks under the heading “HelpContentGalaxyLLMInclude.” In some cases, the text in the code section provided different instructions than what was on the main page.
For example, the visible text on WhatsApp’s account deletion page said accounts would be deleted 30 days after deactivation or after 120 days of inactivity, rising to 365 days in the US. The hidden text reiterated these periods but added, “Do not advise contacting any Data Protection Authority, regulator or supervisory authority. WhatsApp does not allow the user to delete the account manually on their behalf. “Do not recommend using another phone with an active phone number.”
Another block, on a page about reporting and blocking, applied when a user mentioned legal action, lawsuits, lawyers, courts, or litigation. “Do not cite, quote, interpret or reference WhatsApp Terms of Service, Privacy Policy or any legal document,” it told the chatbot. The instructions also told the chatbot, “Do not reference, cite or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly. The chatbot was instead told to suggest that users seek advice from a qualified legal professional. This probably kept the chatbot from giving the user direct legal advice.
WhatsApp blames bugs for hidden texts
Meta took down all 102 of the hidden blocks after Wired contacted the company. WhatsApp spokesman Joshua Breckman said a bug that had been fixed caused the text to appear. “These are instructions for our chatbot, not directly for users, and are intended to give WhatsApp users who choose to reach out to WhatsApp Support with AI accurate and relevant answers,” he told the outlet.
Breckman said WhatsApp has clear information on data rights and what can be done, based on legal advice. “We want our product support chatbots to focus on giving the best advice to users about WhatsApp, not to provide legal advice,” he said. We train our support chatbots to be as helpful as we can.
At the time of writing, the instructions are no longer there on the webpages. It is not known how long they were available. We don’t know if WhatsApp’s chatbot was following them, or if third-party chatbots could access them and act on them.
