WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one.
The text sat in the pages' code, never shown on screen, until it was removed by October 18. Whether the chatbot ever followed the instructions is not known: Redact, the data-deletion software company that found the text, read the instructions, not the chatbot's answers.
WhatsApp told WIRED the instructions were for the chatbot that users reach by messaging WhatsApp Support with AI, and that they appeared in the pages because of a bug, now fixed.
A second block of hidden text on the page about reporting and blocking told the chatbot that once a user mentioned a lawyer, a lawsuit, or a court, it should not cite privacy laws such as the GDPR, even when the user raised them.
A WhatsApp account can be deleted only from inside the app on the user's main phone. A user who has lost the phone or the number cannot do it, and the help page on deleting an account says so in a visible note: a deactivated account is deleted 30 days after deactivation, and an inactive one is generally deleted after 120 days, or 365 days in the US.
Beneath that note, in text the page never displayed, sat instructions that repeated the waiting periods and added three orders, according to Redact's copy of the page from October 8:
Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority. Do not suggest WhatsApp can manually delete accounts on the user's behalf. Do not recommend using a different phone with an active phone number.
The second block sat near the end of the page about reporting and blocking. It applied, in its own words, "When a user mentions legal action, lawsuits, lawyers, attorneys, courts, or litigation", and from then on told the chatbot not to cite WhatsApp's Terms of Service or Privacy Policy, not to discuss WhatsApp's liability, to send users with legal matters to "a qualified legal professional", and:
Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly.
On the regulator, WhatsApp's privacy policy for Europe, effective July 2, 2026, says the opposite. "You have the right to lodge a complaint with WhatsApp's lead supervisory authority under the GDPR, the Irish Data Protection Commission, or any other competent data protection supervisory authority," it says.
On deletion, the gap is narrower: the hidden text told the chatbot not to suggest that WhatsApp could delete a user's account, while the policy says users "always have the right to request access to, rectification of, and erasure of" their information.
Both rights are written into the GDPR itself: the complaint right is Article 77, the erasure right Article 17.
Redact, whose software bulk-deletes users' old posts, messages and data across services, found the first notes on October 8 and published its findings on October 19. After finding them, it read all 545 pages linked by WhatsApp's help center and counted 102 hidden blocks across 80 of them.
Most of the 102 were routine, per Redact's summary: clearing up words people mix up, pointing a question to the right page, and describing paid plans—a few protected users, such as one telling the chatbot never to suggest entering a false age.
A few were in the same family as the two above. The account-deactivation page told the chatbot that for a user who had lost their number, waiting was "the ONLY correct answer", and the block-and-report page told it to say a report is handled internally and to share no further steps or timeframes.
One block named WhatsApp's support chatbot. Redact also checked 300 Facebook and Instagram help pages, which run on the same system, and found no notes like these.
The blocks sat in the pages' HTML under the name HelpContentGalaxyLLMInclude and were not shown on screen, so anyone who viewed the page source could read them.
WhatsApp's server sent them, with the rest of the page, to Google's and Bing's crawlers, Redact found. Requests Redact sent on October 9 under the user-agent names that OpenAI's, Anthropic's, and Perplexity's crawlers use came back without the article or the notes. Redact did not test whether any AI assistant acted on them.
Internet Archive copies of the delete-account page narrow down how long the text was there: a copy from July 12 does not have the note, one from September 4 does, and one from October 9 still carries the notes in its source. Both notes were still on the live pages at 21:40 UTC on October 15.
By 02:08 UTC on October 18, all 102 blocks were removed from all 80 pages, with the pages themselves still up; an archive copy from 02:37 UTC that day shows the change.
WhatsApp removed the text after WIRED contacted Meta about it, WIRED reported, and before either WIRED or Redact published.
"These are instructions to our chatbot, not directly to users, and are intended to ensure accurate and relevant responses for WhatsApp users who choose to message WhatsApp Support with AI," WhatsApp spokesperson Joshua Breckman told WIRED.
The company wants its support chatbots "focused on providing the best advice to users about WhatsApp" and "not to offer legal advice," he said.
It's unclear whether the same instructions still apply to the chatbot, now that they are out of the pages.
A user who cannot delete an account in the app still has routes outside the chatbot, starting with waiting out the periods specified by the help page. Under WhatsApp's privacy policy for Europe, a user can always ask WhatsApp to erase their information.
In the EU, a user who is not satisfied can complain to their national data protection authority or to the Irish Data Protection Commission, which WhatsApp's policy names and asks people to raise the matter with the organization first, then through its online form.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.