Hidden AI prompts on WhatsApp: a GDPR lesson for SMEs
In brief
According to Silicon.fr, a company analyzed 545 WhatsApp help pages in early October 2026 and found 80 with CSS-hidden text instructions in the source code. WhatsApp says they should not have been there and were meant for its support chatbot, in part to stop it giving legal advice. The instructions were still present on 9 October and gone by 18 October.
Source : Silicon.fr - « WhatsApp a-t-il laissé traîner des instructions LLM « anti-RGPD » ? »
What it changes for an SME
If you run a chatbot for customers or staff, the instructions you give it on GDPR carry the same weight as your privacy policy. According to Silicon.fr, some prompts told the bot not to point people to a data protection authority and not to mention the regulation, which can sit in tension with the right to complain and the duty to help users exercise their rights. Text hidden with CSS can still be read by models, including third-party bots. For an SME of 10 to 250 people, this is mainly a legal and reputational risk, not an immediate extra cost.
What you can do
- Review the instructions of your support assistants and check they do not forbid mentioning a DPA or the right to erasure.
- Ask whoever maintains your website to look for CSS-hidden text aimed at language models on help pages.
- Make sure AI answers stay consistent with your privacy policy.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.