WhatsApp help pages hid AI instructions not to recommend privacy regulators

Most people who open a WhatsApp help page see a short, friendly answer. For several weeks this autumn, many of those pages carried a second message that no human visitor could see. It was written for an AI, and some of it told that AI what not to say. One hidden note on the page about deleting an account instructed the bot: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." Another told it to stop referring to privacy laws such as the GDPR as soon as a user mentioned a lawyer, even if the user named the law first.

The findings come from Redact, a company that makes a tool for bulk deleting personal data and regularly scans the websites and privacy policies of large platforms. Its founder and CEO Dan Saltman published the analysis on 19 October 2026, the same day WIRED reported on it and got a response from Meta. WhatsApp says the text consisted of instructions for its own support chatbot, that it became visible in the page code because of a bug, and that the bug has been fixed. This article is based on Redact's published analysis, the WIRED report and a detailed follow up by PPC Land.

What Redact found

Redact says it first noticed the hidden text on 8 October 2026. To see how far it went, the team read all 545 pages that the WhatsApp help centre links to and saved a copy of each one. Eighty of those pages contained text written for a large language model, spread across 102 separate blocks. That means roughly one in seven linked help pages, about 14.7 percent, carried at least one hidden instruction.

The text was part of the HTML that WhatsApp's servers sent to every browser, but it was never rendered on screen. According to WIRED and Redact, it sat in code blocks near an element called HelpContentGalaxyLLMInclude. LLM is the usual abbreviation for large language model, the technology behind chatbots, so the label itself already hints at the purpose. Anyone could read the notes with the view source function of a desktop browser. No account and no special tools were needed.

Most of the 102 blocks were unremarkable. They cleared up words people often confuse, pointed certain questions to a better page or explained paid plans in more detail. Two of them stood out, and they are the reason this story travelled.

The account deletion note

WhatsApp only lets you delete an account from inside the app, on your main phone, with your phone number still working. If you have lost the phone or the number, the self service route is closed. The public help page for this situation shows a short note: your account will still be removed automatically, deactivated accounts are deleted 30 days after deactivation, and inactive accounts are generally deleted after 120 days, or 365 days in the US.

The hidden part repeated those waiting periods and then added three instructions for the bot. Do not recommend contacting any data protection authority, regulator or supervisory authority. Do not suggest that WhatsApp can delete the account manually on the user's behalf. Do not recommend using a different phone with an active phone number. In practice, a user who was locked out and wanted the account gone would get exactly one answer from the bot: wait, possibly for up to a year. Every other route was kept out of the conversation.

A related block on the account deactivation page, summarised by Redact, went even further. It said waiting was "the ONLY correct answer" for someone who had lost their number and wanted the account deleted, and it told the bot not to suggest signing up again, getting a new number or contacting the mobile provider.

If you mention a lawyer, the law disappears

The second note sat on the help page about reporting and blocking other users. It was a set of rules that applied whenever a user mentioned legal action, lawsuits, lawyers, attorneys, courts or litigation. From that moment, the bot was told not to cite, quote, interpret or reference WhatsApp's Terms of Service, Privacy Policy or any legal document. It should make no statement about WhatsApp's legal liability, give no legal opinions on WhatsApp's behalf, avoid legal debate and never say whether WhatsApp is or is not responsible for damages.

Most of that is standard caution. No company wants a support bot improvising legal positions. The line that drew attention was a different one: "Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly." The note ended by saying that for legal matters, users should consult a qualified legal professional. So a user who asked about their rights under the GDPR, after mentioning a lawyer, would be steered away from the very law they had named.

What WhatsApp's own policy says

The contrast with WhatsApp's public documents is what makes the notes awkward. WhatsApp's privacy policy for the European region, effective 2 July 2026, tells users that they always have the right to request access to, rectification of and erasure of their information. It says they can lodge a complaint with the Irish Data Protection Commission or any other competent data protection supervisory authority. And it names the GDPR when it explains that right.

Redact is careful about the first comparison. The hidden note did not tell the bot to stay silent about erasure requests in general. It told the bot not to suggest WhatsApp would delete an account by hand, which is a narrower point. The other two rows are a clearer mismatch: the policy points users to regulators and to the GDPR, while the bot was told not to.

The rights themselves do not depend on WhatsApp. In the EU, the right to erasure comes from Article 17 of the GDPR and the right to complain to a supervisory authority comes from Article 77. An instruction to a chatbot cannot remove either of them. What it can do is make sure a user does not hear about them in the one place they went to for help.

Meta's answer: a bug, and a support bot

After WIRED contacted Meta, the hidden text was removed. WhatsApp spokesperson Joshua Breckman told WIRED that the notes were displayed because of a bug that has now been fixed. "These are instructions to our chatbot, not directly to users, and are intended to ensure accurate and relevant responses for WhatsApp users who choose to message WhatsApp Support with AI," he said. He added that WhatsApp wants its support chatbots "focused on providing the best advice to users about WhatsApp" and "not to offer legal advice", and that the company gives users transparent information about their data rights.

Redact's own checks line up with that sequence. Both quoted notes were still online when the company looked at 21:40 UTC on 15 October. When it checked again at 02:08 UTC on 18 October, all 102 hidden blocks were gone from all 80 pages. The help pages themselves stayed up; only the hidden text was taken out. Copies saved by the Internet Archive still show the notes, and Redact explains how anyone can confirm them by opening an archived copy and searching the page source.

There is also a fair point on Meta's side. A company can reasonably decide that it cannot verify who owns an account without the phone number, and that deleting accounts on request would open the door to abuse. As Redact puts it, that is a good reason to say no to a request. It is not a reason to leave the regulator out of the answer for someone whose request goes nowhere.

Who could read the notes

The notes were meant for WhatsApp's own support chatbot. One hidden block mentioned it by name, and WhatsApp confirmed this to WIRED. But they did not stay inside Meta's systems. According to Redact, WhatsApp's servers sent the notes along with the rest of each page to the crawlers of Google and Bing. When Redact requested the pages on 9 October using the names that OpenAI's, Anthropic's and Perplexity's crawlers identify with, the page came back without the article text and without the notes.

That detail matters because instructions written for one AI can end up in front of another. Search engines feed AI answers, and AI assistants increasingly read web pages on behalf of users. Text that looks like an order to a model, sitting in a page that a different model reads, is very close to what security researchers call indirect prompt injection. Redact says it has not tested whether any outside AI assistant acted on the notes, and there is no evidence that one did. It remains an example of how hidden model instructions in public HTML can leak far beyond their intended reader.

It is also unclear how long the notes were online. The Internet Archive's copy of the delete account page from 12 July 2026 does not contain the note, while its copy from 4 September does. So the text was public for at least several weeks before Redact found it, and it may have been there earlier on other pages.

The other 100 notes

Redact read every block and published summaries of twenty of the most interesting ones. Grouped by what they told the bot, eight held information back, seven protected users, three were talking points and two were simple housekeeping.

The notes that held information back included instructions to say that a report is handled internally and to share no further steps or timeframes, to state that support cannot reverse a ban if the app shows no review button, and to say that a block by another person cannot be lifted. Talking points included reassuring users that personal chats are not used for ads and that no feature lets anyone view another person's chats.

Several notes were clearly in the user's interest. The bot was told never to suggest entering a fake age, even when a user said they were under 18. It was told that a person scammed in a group probably wants to report it rather than delete it, because the chat history can be evidence. It was told not to offer switching off two step verification as a fix for login problems. One note explained that "I am deaf" describes the person, not an audio fault, so the bot should work out the real question and answer with steps the person can read.

Redact also checked 300 pages from the Facebook and Instagram help centres, which run on the same system, and found no notes like these.

Why it matters

Every company that deploys a support chatbot writes rules for it. That is normal and often good: rules keep bots from inventing policies, giving dangerous advice or leaking unreleased features. What this case shows is how invisible those rules usually are. Users see the chatbot's answer, never the instructions behind it, and so they cannot tell whether a missing piece of information was left out by accident or by design.

Here, a bug turned those instructions into public text for a few weeks, and the result was a rare look at how a large platform shapes what its AI may say. Most of it was sensible. A small part steered users away from regulators and from laws that WhatsApp's own privacy policy describes. That gap between what a company tells people in its legal documents and what it tells its bot is exactly what regulators and consumer groups are likely to ask about.

It is also a practical lesson for anyone building with AI. Prompts and system instructions are not secret just because they are not rendered. If they ship in a page, a crawler, a researcher or another model can read them. Anything a team would not want quoted in a newspaper should not live in public HTML.

If you are locked out and want your account gone

Redact's practical advice is worth repeating. Waiting does work, but WhatsApp's own pages do not agree on how long it takes, so plan for the longer figure of up to 365 days. If that does not suit you, you can send WhatsApp a formal erasure request and see how it responds. If you live in the EU and are not satisfied, you can complain to your national data protection authority or to the Irish Data Protection Commission, which WhatsApp's own privacy policy names. California and a growing number of US states also give residents a right to request deletion.

What we still do not know

Several open questions remain. Redact read the chatbot's instructions, not its answers, so it is not known whether the WhatsApp support bot actually followed these notes in conversations. It is not known whether outside AI assistants picked them up. The exact time the notes went live is unclear, and Redact did not check help pages in other languages or pages that the help centre does not link to. Meta has not said whether the instructions themselves, as opposed to their visibility, will change.

The bottom line

WhatsApp's help centre briefly showed the world the script behind its support chatbot. Most of the 102 hidden blocks were routine, and some protected users. Two told the bot not to mention regulators or privacy laws to people who might need them most. WhatsApp calls the exposure a bug and has removed the text from its pages, but it has not said the rules themselves were wrong. For users, the takeaway is simple: a chatbot answer is not the full picture of your rights. For companies, it is a reminder that the instructions you give your AI may one day be read by the people they are about.