A reported change to WhatsApp help pages has drawn attention to how AI-powered support systems can be influenced by hidden instructions that users never see. According to The Hacker News, WhatsApp had code embedded in help pages that told its support chatbot not to recommend a data protection authority or regulator to users who were unable to delete their accounts, despite WhatsApp's European privacy policy stating that users can lodge a complaint with a supervisory authority.

The reported text was not visible on the page itself and was said to have been removed by 18 October. Based on the source provided, it is not clear why the instruction was added, how broadly it affected responses, or whether it changed the chatbot's behaviour in every case.

What happened

The report describes hidden instructions placed in WhatsApp help page code, apparently aimed at influencing the platform's support chatbot. The instruction reportedly told the chatbot not to suggest contacting a privacy regulator or data protection authority in a specific support scenario involving account deletion problems.

This matters because AI support tools increasingly rely on website content, structured help materials and embedded prompts to generate answers. If hidden text is used to shape responses, companies may affect what users are told about their rights, escalation options or complaint routes without making that guidance explicit in the visible support content.

Why it matters for European businesses

For European companies, the issue goes beyond WhatsApp. Many businesses are deploying AI chatbots across customer service, employee support and website help centres. These systems are often connected to knowledge bases, help articles and internal guidance that can include instructions for tone, escalation, compliance and risk control.

The practical concern is that an AI assistant may reflect hidden or poorly governed instructions that conflict with published privacy notices, complaint procedures or legal information. In a European context, that can create risk in areas such as:

• Privacy transparency: if public-facing privacy notices say one thing while a chatbot is guided to say another, businesses may create inconsistency in user communications.
• Complaint handling: support bots may become gatekeepers that discourage escalation, even where users should be informed of formal complaint channels.
• Governance and auditability: hidden prompts in code or content management systems may be difficult for legal, compliance or customer service teams to review.
• Trust and brand risk: if users discover that AI support was steered by unseen instructions, confidence in the company can fall quickly.

For SMEs, this is especially relevant because AI support deployments are often implemented quickly through third-party tools, plugins or knowledge-base integrations. That can make it easy for undocumented instructions, prompt rules or optimisation shortcuts to enter production without cross-functional review.

Who may be affected

• SMEs using AI chatbots on websites, help centres or customer portals.
• Marketing and digital teams managing website content that feeds AI assistants or on-site search experiences.
• IT and product teams integrating support automation into CMS, CRM or customer service platforms.
• Regulated or privacy-sensitive businesses that must provide clear information about complaints, data rights and support escalation.
• Agencies and technology partners building AI-enabled support journeys for clients.

What companies should consider

European businesses using AI for customer support should treat this case as a governance reminder rather than a platform-specific anomaly.

• Review AI support inputs: check whether hidden text, metadata, system prompts or knowledge-base instructions are shaping chatbot answers in ways that are not obvious to compliance or legal teams.
• Test rights-related scenarios: run structured tests for topics such as account deletion, data access, consent withdrawal, complaints and escalation to verify that AI responses match published policies.
• Align chatbot guidance with public documentation: privacy notices, terms, support articles and AI response rules should not contradict each other.
• Create approval workflows: changes to help-centre content that may influence automated responses should be reviewed by the appropriate business, legal or privacy stakeholders.
• Maintain audit trails: document who changed prompt instructions, content sources or support logic, and when those changes went live.
• Plan human escalation: for sensitive privacy or account issues, users should have a clear route to human support where appropriate.

The source does not establish whether any regulator has taken action or whether WhatsApp has publicly explained the reported instruction. Even so, the case illustrates a broader issue for businesses adopting AI: unseen prompt design can have visible compliance and trust consequences.