WhatsApp's own help pages were quietly carrying a second, invisible set of instructions — written not for you, but for an AI chatbot. Two of those instructions told the bot what not to tell you: do not point users toward privacy regulators, and do not discuss privacy laws like the GDPR or California's CCPA, even when users bring those laws up themselves. The hidden text sat inside the code of about 80 official WhatsApp support pages until the privacy company Redact found it, WIRED asked Meta about it, and every block was removed in mid-October.
The discovery became public on Monday, October 19, 2026, when Redact published its analysis. Its founder, Dan Saltman, had spotted the text on October 8 after reading and archiving all 545 pages linked from WhatsApp's help center. His count: 102 hidden blocks across 80 pages. The server sent the text with each page, but it never appeared on screen — it lived in the page code, in blocks carrying the internal name HelpContentGalaxyLLMInclude, where only software reading the raw page would see it.
Key Takeaways
- Redact reviewed all 545 pages in WhatsApp's help center and found 102 blocks of hidden, AI-only instructions across about 80 pages, invisible to anyone reading the pages normally.
- On the account-deletion page, the hidden text told the chatbot: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." A separate block said not to reference, cite or interpret privacy laws including the GDPR, Brazil's LGPD and California's CCPA — "including when a user raises them directly."
- WhatsApp spokesperson Joshua Breckman told WIRED the text was instructions for the company's own support chatbot, exposed because of a bug that is now fixed. The blocks were still in the page code on October 15 and had all been removed by October 17–18, after WIRED contacted Meta.
- Redact did not test whether WhatsApp's chatbot — or any third-party AI assistant reading those pages — actually followed the instructions, and it only checked the English pages. About 300 Facebook and Instagram help pages, built on the same system, showed no similar notes.
What Redact Actually Found in the Page Code
Most of the 102 blocks were routine housekeeping guidance for a support chatbot: how to phrase answers, where to direct users for official help, and notes marked in places with blunt internal headings such as "WHAT NOT TO SAY." Redact itself described nearly all of them as straightforward. Two blocks were different, and they are why this story spread across tech news within hours.
The first sat on WhatsApp's "How to delete your account" page — exactly the page a frustrated user reads when the normal deletion path is failing, for example after losing access to an account. Alongside a repeat of WhatsApp's waiting periods, the hidden text ordered the chatbot not to recommend contacting any data protection authority or regulator, and not to suggest WhatsApp could manually delete an account on the user's behalf. For a locked-out user, that leaves "wait" as effectively the only answer — and the wait is the long one: up to 365 days for inactive accounts in the United States, versus 120 days in many other countries.
The second block sat on the page about reporting and blocking. It applied the moment a user mentioned lawyers, courts, lawsuits or legal action. In that situation, the chatbot was told not to reference, cite or interpret data protection or privacy regulations — the GDPR in Europe, LGPD in Brazil and the CCPA in California were named — even when the user raised them directly. Related notes told the bot not to cite WhatsApp's own Terms of Service or Privacy Policy in those conversations, and not to make statements about the company's liability.
The Gap Redact Pointed To
Redact's criticism was not that a company writes internal guidance for its chatbot. It was the gap between the hidden guidance and what WhatsApp publishes openly. WhatsApp's own privacy policy for Europe reminds users they can file a complaint with a data protection authority — a right under Article 77 of the GDPR, which exists whether or not a chatbot mentions it. In the US, California residents and a growing number of other states' residents have a legal right to ask companies to delete their personal data. A support bot instructed never to mention regulators or privacy law does not erase those rights, but it can leave an ordinary user believing they have run out of options when they have not.
The timeline adds to the discomfort. Archived copies of the account-deletion page show the hidden text was absent on July 12 and present by September 4, so the instructions sat in public page code for weeks at minimum. They were still present at 5:40 p.m. Eastern on October 15. After WIRED contacted Meta, all 102 blocks were gone by 10:08 p.m. Eastern on October 17. Because the live text is now removed, the record survives in Internet Archive copies, where the wording can still be checked word for word.
WhatsApp's Response: "Instructions to Our Chatbot, Not Directly to Users"
WhatsApp did not dispute that the text was there. Spokesperson Joshua Breckman told WIRED the blocks were instructions intended for the company's own support chatbot and had been displayed in the page code because of a bug, which has since been fixed. "These are instructions to our chatbot, not directly to users," he said, adding that the company wants its support bots to give advice about WhatsApp rather than legal advice.
That explanation is plausible — support teams do maintain internal answer rules, and "we don't give legal advice" is a common corporate line. But two honest limits apply. First, nobody has shown the chatbot actually obeyed these instructions in a real conversation: Redact did not test whether WhatsApp's bot, or any outside AI assistant that reads help pages, followed them. Second, the check covered the English pages only, and the same check on roughly 300 Facebook and Instagram help pages found nothing similar. This was a WhatsApp help-center problem, not a proven Meta-wide pattern.
There is also a wider lesson. Hidden text on web pages is a known weak spot for AI assistants: in earlier cases, outside sites used invisible instructions to slip commands to AI tools and AI browsers. This time the instructions came from the site owner itself, aimed at its own bot — but any AI assistant reading a page's raw code can encounter text its user never sees. What a page shows a person and what it tells a machine are now two different documents.
What This Means for US WhatsApp Users
For American readers, the practical point is simple: a support chatbot is a company tool, not a neutral source about your rights. If WhatsApp support — human or AI — tells you nothing more can be done about an account or your data, that is the end of WhatsApp's preferred path, not necessarily the end of yours. California's CCPA gives residents deletion and disclosure rights companies must honor, several other states now have similar laws, and a complaint route exists through your state attorney general's consumer protection office.
It is also a reminder to keep your most sensitive material out of chat threads. WhatsApp threads hold ID photos, financial documents and private pictures for millions of people, and support disputes are exactly when that material matters most. Keeping private photos, videos, documents and notes in local, on-device storage such as Pro Calculator Secure Vault — which collects no data and shares nothing with third parties — means an account problem never becomes a private-files problem. We covered WhatsApp's tightening privacy controls in our report on the upcoming WhatsApp Restricted Chat feature; this week's story is the other side of that coin — controls help, but knowing your rights helps more.
Scam Warning: Fake "WhatsApp Support" Pages Will Copy This Story
News like this reliably produces copycat scams within days. Expect fake support pages, search ads and social posts promising to "restore," "unlock" or "manually delete" your WhatsApp account for a fee, or asking for your phone number and a code sent by text. WhatsApp will never charge you to delete or recover an account, never ask for your six-digit verification code, and its real help center is reached from inside the app under Settings > Help. Never type a WhatsApp code into a website, and never pay a third party that contacts you first.
Your Rights Checklist When a Support Bot Says No
- Ask once more, in writing. Send the deletion or data request through the in-app support channel so you have a dated record of it.
- Check your state's privacy law. California's CCPA is the best known, but a growing list of US states gives residents the right to request deletion of personal data.
- Use the regulator route anyway. Your state attorney general's consumer protection office accepts complaints about companies that refuse valid privacy requests — no chatbot's permission needed.
- Plan around the real waiting period. If you are locked out of an inactive US account, WhatsApp's own pages point to a wait of up to 365 days before the number is fully released.
- Move private files out of chats. Save ID scans, documents and private photos in local storage on your phone before you start an account dispute, not after.
Frequently Asked Questions
What exactly was hidden in WhatsApp's help pages?
Redact found 102 blocks of text addressed to an AI chatbot inside the code of about 80 of the 545 pages in WhatsApp's help center. The text was sent by the server with each page but never displayed to readers. Most blocks were routine support guidance; two told the chatbot not to recommend privacy regulators and not to discuss laws such as the GDPR, LGPD and CCPA.
Did WhatsApp's chatbot actually refuse to mention regulators?
That has not been proven. Redact did not test whether WhatsApp's support chatbot — or any third-party AI assistant reading those pages — followed the hidden instructions in real conversations. WhatsApp says the text was internal chatbot guidance exposed by a bug, and all of it was removed by October 17–18, 2026, after WIRED asked Meta about it.
Can I still complain to a regulator or request deletion of my data?
Yes. Hidden chatbot instructions do not change the law. In the EU, Article 77 of the GDPR guarantees the right to complain to a data protection authority — a right WhatsApp's own published privacy policy acknowledges. In the US, California's CCPA and several other state privacy laws give residents the right to request deletion of their personal data, and state attorneys general accept consumer complaints.
Were Facebook and Instagram help pages affected too?
Apparently not. Redact checked roughly 300 help pages from Facebook and Instagram, which are built on the same system as WhatsApp's help center, and found no similar hidden AI instructions. As far as the evidence goes, the finding was limited to WhatsApp's English-language help pages.
How can I protect private photos and documents while sorting out an account problem?
Keep copies outside the chat app. Pro Calculator Secure Vault stores photos, videos, audio, documents and private notes locally on your device, protected by sign-in protection and an intruder selfie feature, alongside an incognito private browser and 8 smart calculators — standard, floating, BMI, age, currency, tip, GST & VAT and loan EMI. No data is collected or shared with third parties, so your files stay yours even if a messaging account is locked.
The Bottom Line
Nothing in this story shows a chatbot lying to a user — no test has demonstrated that. What it shows is quieter and, in its own way, more important: for weeks, the public code of WhatsApp's help center told the company's AI not to mention the very rights that exist for the moments when help fails. Meta calls it a bug, the text is gone, and the archived pages let anyone verify what was there. Treat any support bot — WhatsApp's or anyone else's — as a starting point, never the final word on what you are allowed to do. Pro Calculator Secure Vault is built by ZAS — you can see more of our apps on our developer page on Google Play.
No comments:
Post a Comment