Dan Saltman’s investigation for Redact found hidden instructions for WhatsApp’s support chatbot inside its public help pages. Some told the bot to withhold options that the company’s privacy policy openly describes. An answer can mislead through what it leaves out, even when its remaining facts are accurate.

  • Redact inspected 545 linked help pages and found 102 hidden blocks on 80 pages. Most were ordinary support guidance; some protected users.
  • One block told the bot to avoid recommending a data-protection regulator when someone could no longer delete an account themselves.
  • Another barred references to privacy laws, even when the user raised them, after any mention of lawyers or legal action.

The article accepts the case for keeping a company chatbot from giving legal opinions. It challenges the broader suppression of factual information about rights and escalation. WhatsApp said the notes were for its own support bot; Redact reports they also reached Google and Bing crawlers.

Caveat: Redact inspected instructions, not chatbot answers. It did not test whether WhatsApp’s bot or outside assistants obeyed them.

The 159-comment thread on Hacker News adds a proposed documentation design, a practitioner’s experience and a clear disagreement about escalation.

What the thread adds

  • eknkc proposes explicitly trusting marked instruction blocks from the company’s support site: “It’s also more transparent than a hidden API, yet it somehow gets more criticism.” That is their design suggestion, not evidence of WhatsApp’s implementation.
  • yoaviram, who says they run YourDigitalRights.org, describes recurring deletion difficulties and argues for exceptional escalation: “In some exceptional cases, going to a lawyer is a viable course of action, especially when any kind of harm is involved.”
  • stefangordon disagrees about the ordinary case: “The best advice for the vast majority of users who can no longer easily prove an account belongs to them is to let it expire in a few months automatically.”

Handles are pseudonymous; HN publishes no per-comment scores. Ordering follows HN’s ranking, so this is a slice of the thread, not a consensus.