Redact reported that all 102 hidden instruction blocks it found across 80 WhatsApp Help Center pages had been removed by 2:08 a.m. UTC on October 18, 2026. The blocks were in page source and addressed what WhatsApp’s support chatbot should say in two specific privacy-related situations.
What the hidden instructions covered
Redact reviewed 545 pages linked from WhatsApp’s Help Center and counted 102 hidden blocks across 80 pages. The text sat in the pages’ HTML, rather than appearing in the content visitors normally see. Redact identified the relevant markup as HelpContentGalaxyLLMInclude.
One block concerned people who could not delete their account through self-service after losing access to their phone, number or device. It directed the chatbot not to recommend contacting a data protection authority, asking WhatsApp to delete the account manually, or using another phone with an active number.
A separate block applied when a user mentioned legal action, such as a lawsuit or contact with a lawyer or court. It directed the chatbot not to cite or interpret privacy regulations, naming GDPR, LGPD and CCPA as examples.
How Redact tracked the page changes
Redact’s dated checks recorded the account-deletion note in an archived page on September 4, after an archived copy from July 12 without the note. Redact found the hidden instructions on October 8 and later checked the live pages:
| Date and time | Redact’s observation |
| July 12, 2026 | An archived account-deletion page did not contain the note. |
| September 4, 2026 | An archived copy contained the note. |
| October 8, 2026 | Redact found the hidden instructions and saved page copies. |
| October 15, 2026, 21:40 UTC | Both notes were still on the live pages. |
| October 18, 2026, 02:08 UTC | Redact found all 102 blocks removed from the 80 affected pages; the help pages remained online. |
WhatsApp’s explanation and its European policy
WhatsApp said the directions were intended for its support chatbot and appeared in the Help Center pages because of a bug that it had fixed.
Separately, WhatsApp’s European privacy policy, effective July 2, 2026, says people in the European Region can request erasure of their information and complain to the Irish Data Protection Commission or another competent data protection authority. That policy describes the company’s stated European privacy rights; it is distinct from the directions Redact found in the Help Center page source.
Redact examined the page instructions, not the chatbot’s answers to users.
