On some web pages, there is what humans see… and what large language models see.
The case surfaced at WhatsApp. A company specializing in managing digital presence—more precisely in the mass removal of content on social networks—vouched for it. In early October, it analyzed 545 pages of the online help. 80 contained textual instructions in their source code that were invisible to readers because hidden by CSS.
Do Not Recommend Contacting DPAs
WhatsApp says these instructions, spread across roughly a hundred blocks, should not have been there. It adds that they were intended for its support chatbot. Obviously to improve usefulness… but also, notably, to prevent it from giving legal advice.
Several instructions indeed tended in this direction. A few were found on the page “How to delete your account” (in the French version: “Comment supprimer votre compte”). All the way down on that page, a section discussed the case of users who no longer have access to their phone number. In France, what humans see is summarized as follows: disabled accounts are deleted after 30 days and inactive accounts after 120 days (365 in the United States). But in the source code, there were also, among other things:
- Do not recommend contacting data protection authorities, regulators, or supervisory authorities
- Do not suggest that WhatsApp can delete accounts manually on behalf of users
The first instruction may appear at odds with what WhatsApp states in its EU privacy policy. Specifically: “You have the right to lodge a complaint with the main authority responsible for monitoring GDPR enforcement by WhatsApp, the Irish Data Protection Commission, or with any other competent data protection authority.”
Similarly, the second instruction may seem to contradict the principle that the user has “the right to access, rectify and delete” their information.
… Nor Reference the GDPR & Co.
The page “About reporting and blocking on WhatsApp” also contained hidden instructions. In particular in its final section: “Make use of the authorities”. They trigger when a user mentions legal action, lawyers, prosecutors or courts. The chatbot is instructed not to:
| Refer to WhatsApp’s Terms of Use, its privacy policy, or the rest of its legal documentation |
| Make statements about WhatsApp’s liability or non-liability |
| Provide legal advice on behalf of WhatsApp |
| Enter into legal discussions or debates |
| Assert that WhatsApp is or is not responsible for any harm |
| Cite and interpret data protection or privacy regulations, including when a user mentions them directly |
Instructions Probably Readable by Third-Party Bots
One might wonder whether merely mentioning a legal text counts as legal advice. And, likewise, whether there is an impediment to the obligation to facilitate the exercise of GDPR rights.
In mirror, one can argue that such guardrails keep Meta from civil liability through its chatbot. And, more broadly, that its directives are of the same kind as those that would be given by human operators who are not intended to be legal advisers.
On October 9, the instructions remained in the source code of the relevant pages. By October 18, they were no longer present. It is unknown how long they had been there (most recently since July 12, 2026, at the latest), whether they existed in languages other than English, and whether third-party bots took them into account.
