WhatsApp placed hidden instructions inside its help pages telling its AI-powered support chatbot not to recommend data protection authorities or regulators to certain users seeking help with account deletion, according to findings by data-deletion software company Redact.
The instructions were embedded in the pages’ code and were not visible to users browsing the help centre. WhatsApp told WIRED that the material was intended for the AI chatbot available through WhatsApp Support and had appeared on the public pages because of a bug, which the company said had been fixed.
Redact said it discovered the first hidden instructions on October 8 and later examined all 545 pages linked from WhatsApp’s help centre. It identified 102 hidden instruction blocks across 80 pages. The material had been removed from the affected pages by October 18.
Hidden Instructions Restricted Regulator Advice
One set of hidden instructions appeared on a page explaining how users can delete their WhatsApp accounts.
WhatsApp allows an account to be deleted only from within the app on the user’s main phone. The visible help page states that a deactivated account is deleted after 30 days, while an inactive account is generally deleted after 120 days, or 365 days in the United States.
Hidden beneath that information was an instruction telling the chatbot not to recommend contacting a data protection authority, regulator or supervisory authority.
The same block also told the chatbot not to suggest that WhatsApp could manually delete an account on a user’s behalf and not to recommend using another phone with an active number.
The restriction appeared to conflict with WhatsApp’s European privacy policy, effective July 2, 2026, which states that users have the right to lodge a complaint with the Irish Data Protection Commission or another competent data protection supervisory authority.
Redact found a second hidden instruction block on a page covering reporting and blocking. It applied when a user mentioned legal action, lawsuits, lawyers, courts or litigation.
Once those topics were raised, the chatbot was instructed not to cite WhatsApp’s Terms of Service or Privacy Policy, not to discuss the company’s liability and not to reference or interpret privacy laws such as the GDPR, LGPD or CCPA, even if the user raised them directly.
More Than 100 Hidden Blocks Found
Redact said most of the 102 hidden blocks it identified contained routine guidance, such as clarifying commonly confused terms, directing users to the appropriate help page or describing paid services.
Some, however, placed more specific restrictions on the chatbot’s responses.
A page dealing with account deactivation reportedly instructed the chatbot that waiting was the “ONLY correct answer” for users who had lost access to their phone number.
Another instruction on the reporting and blocking page told the chatbot to say that reports were handled internally and not to provide additional steps or timeframes.
The hidden instructions appeared in the HTML under the name “HelpContentGalaxyLLMInclude” and could be read by anyone examining the page source, despite not being displayed on screen.
Redact also reviewed 300 Facebook and Instagram help pages using the same system but said it did not find comparable hidden notes.
The company found that WhatsApp’s servers sent the hidden blocks to Google and Bing crawlers along with the rest of the page. Requests made using user-agent names associated with OpenAI, Anthropic and Perplexity crawlers did not return the article or the hidden instructions.
Redact did not test whether WhatsApp’s chatbot actually followed the instructions during conversations with users.
WhatsApp Says Instructions Were for AI Support Bot
Archive records reviewed by Redact indicated that the hidden text was not present on the account-deletion page on July 12 but appeared by September 4 and remained in the page source on October 9.
The instructions were still present on the live pages late on October 15. By early October 18, all 102 blocks had been removed from the 80 affected pages while the help pages themselves remained online.
WIRED reported that WhatsApp removed the material after the publication contacted Meta and before either WIRED or Redact published the findings.
WhatsApp spokesperson Joshua Breckman said the instructions were intended for the company’s support chatbot rather than directly for users. He said the goal was to keep the chatbot focused on providing advice about WhatsApp and to prevent it from offering legal guidance.
It remains unclear whether the same restrictions continue to apply internally to the chatbot after the hidden text was removed from the help pages.
Users in Europe who are unable to resolve privacy concerns through WhatsApp still retain the right, under the company’s own privacy policy, to request erasure of their information and to complain to the Irish Data Protection Commission or another competent supervisory authority.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
