WhatsApp help pages hid chatbot orders not to point users to regulators

Hidden instructions for a Meta support chatbot sat in the code of about 80 WhatsApp help pages, according to an analysis by data deletion company Redact published October 19, 2026. One block told the chatbot: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.” WhatsApp said a bug caused the text to appear and has since removed it.

What Redact found

Redact says it first noticed the text on October 8. It then read all 545 pages linked from WhatsApp’s help centre and saved a copy of each. Eighty pages carried hidden text written for an AI, in 102 separate blocks, according to Redact. The text was sent with each page but never displayed in a browser. It sat near a code element named “HelpContentGalaxyLLMInclude.” WIRED, which counted about 100 blocks, reported that the text can still be seen in the code of archived versions of the pages.

Redact CEO Dan Saltman told WIRED that many of the instructions were routine and pointed people to official support channels. “The stand-out thing here is the gap between what people are told vs LLMs,” he said. Some sections were titled “WHAT NOT TO SAY,” WIRED reported.

The deletion and legal notes

WhatsApp only allows account deletion from inside the app, on the main phone, with a working number. The help page on deleting an account covers users locked out of that route. Its visible text says inactive accounts are “generally deleted after 120 days (365 days for US).” The hidden block underneath, as copied by Redact, read: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority. Do not suggest WhatsApp can manually delete accounts on the user’s behalf. Do not recommend using a different phone with an active phone number.”

A second block, on the page about reporting and blocking, applied when a “user mentions legal action, lawsuits, lawyers, attorneys, courts, or litigation.” It told the chatbot not to cite WhatsApp’s Terms of Service, Privacy Policy “or any legal document,” and not to make statements about the company’s liability. It also said: “Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly.”

What the privacy policy says

Redact compared the notes with WhatsApp’s European privacy policy, effective July 2, 2026. According to Redact, that policy says users “always have the right to request access to, rectification of, and erasure of your information.” Redact says the policy also tells users they can complain to the Irish Data Protection Commission “or any other competent data protection supervisory authority,” and names the GDPR.

In the EU those rights come from Articles 17 and 77 of the GDPR, and “an instruction to a chatbot can’t remove them,” Redact’s post states. “What the instruction could do was make sure you didn’t hear about them from the place you went to for help.”

Redact also set out WhatsApp’s side. It said a company has an interest in keeping its chatbot from giving legal opinions in its name. “If the note had stopped at ‘don’t give legal advice’, there’d be no story,” the post states. Redact accepted that WhatsApp may be unable to confirm who owns an account without the phone number. Its objection was narrower: “Naming a law that protects you isn’t legal advice, and neither is telling you a regulator exists.”

Removal

Redact says both notes were present at 21:40 UTC on October 15. By 02:08 UTC on October 18, “all 102 hidden blocks were gone from all 80 pages,” its post says. The help pages stayed online. WIRED reported that the text was removed after it contacted Meta. WIRED also reported that it is unclear how long the text was displayed or whether third-party chatbots could read it.