Redact reported on October 8, 2026, that it found hidden instructions in WhatsApp Help Center pages telling the AI support chatbot not to recommend contacting a data protection authority to some users who could not delete their accounts. Redact examined 545 pages linked from the Help Center and found 102 hidden instruction blocks across 80 pages. WhatsApp said the notes were for WhatsApp Support with AI and that a bug it had fixed exposed them.
What the hidden instructions said
On an account-deletion page, an instruction addressed users who could not complete self-service deletion after losing access to their phone number, line, or device. It told the chatbot not to recommend contacting a data protection authority, regulator, or supervisory authority. It also said not to suggest that WhatsApp delete the account manually or that the user try another phone with an active number.
A separate instruction appeared on a reporting-and-blocking page. It told the chatbot not to cite or discuss privacy laws, including the GDPR, Brazil’s LGPD, and California’s CCPA, when users mentioned legal action, lawsuits, lawyers, courts, or related terms. The hidden text was part of the page content but wasn’t displayed to ordinary visitors. Redact associated it with a page-code component named HelpContentGalaxyLLMInclude.
What Redact’s dated page checks show
Redact’s archived copy of the account-deletion page from July 12, 2026, did not contain the note. Its September 4 copy did. Those snapshots bracket when the note appeared on that page, but Redact did not determine its exact start date.
Redact reported that the two highlighted instructions were still on the pages at 21:40 UTC on October 15. By 02:08 UTC on October 18, Redact found all 102 blocks absent from the 80 pages it checked. The Help Center pages remained online.
WhatsApp’s explanation and the European policy wording
In an explanation to WIRED relayed by Redact, WhatsApp spokesperson Joshua Breckman said the notes were for WhatsApp Support with AI. WhatsApp described the chatbot’s purpose as giving users advice about WhatsApp rather than legal advice, and attributed the notes’ exposure to a bug it said had been fixed.
Redact also reported that WhatsApp’s European privacy policy, effective July 2, 2026, says users may complain to the Irish Data Protection Commission or another competent supervisory authority. That policy wording contrasts with the hidden instruction against recommending a regulator.
Did the chatbot follow the instructions?
Redact did not test WhatsApp’s chatbot or outside AI assistants. Its findings describe instructions in Help Center page content, not observed chatbot replies.
