WhatsApp Help Pages Told Its Chatbot to Avoid Privacy Regulators
Redact.dev found hidden instructions in WhatsApp help pages telling its chatbot not to recommend data protection regulators or cite privacy laws; WhatsApp calls it a fixed bug, and whether it followed them is untested.
Redact.dev says WhatsApp's help pages carried hidden instructions telling its support chatbot not to recommend data protection regulators or cite privacy laws, and that the text was served to Google and Bing crawlers until mid-October 2026. WhatsApp told WIRED the notes were instructions for its support chatbot and attributed their exposure to a bug it has fixed.
The pages also told the bot not to suggest manual account deletion or alternative phone numbers, and, once a user mentioned legal action, not to reference GDPR, LGPD or CCPA. Redact.dev read 545 linked help pages, found 102 hidden blocks on 80 pages, and could not determine whether the chatbot or outside assistants followed the instructions.
The bits that matter
- Redact.dev read all 545 pages linked from WhatsApp's help centre and saved copies. It found hidden AI text on 80 pages, comprising 102 blocks; most were housekeeping, but two contained instructions that conflicted with WhatsApp's public privacy policy.
- The delete-account page's hidden note told the chatbot not to recommend contacting any data protection authority, regulator or supervisory authority, not to suggest WhatsApp could manually delete accounts, and not to recommend using a different phone with an active number.
- On reporting and blocking, a hidden note triggered by mentions of legal action, lawsuits, lawyers, attorneys, courts or litigation told the chatbot not to cite or interpret WhatsApp's terms, privacy policy or any legal document, including GDPR, LGPD or CCPA.
- WhatsApp told WIRED the notes were instructions for its support chatbot and said a bug exposed them. Redact.dev could not determine whether the chatbot or outside assistants acted on them, and found no similar notes on 300 Facebook and Instagram help pages.
- WhatsApp's European privacy policy, effective July 2, 2026, says users can request erasure and complain to the Irish Data Protection Commission or any competent authority. The hidden notes kept regulator and privacy-law references out of chatbot answers.
Discussion analysis
Analysis details
20 comments analyzed. Analyzed .
The sample selects active discussion branches and includes available parent comments. It may omit parts of the full thread. The analysis included 20 of 29 usable stored comments because of the input limit. Selected themes do not measure community opinion or how common a view is.
Regulator advice suppressed despite GDPR rights
The hidden note told the chatbot not to recommend any data protection authority, regulator or supervisory authority, even though WhatsApp's European privacy policy names the Irish Data Protection Commission and GDPR rights. A chatbot should not give legal opinions, but GDPR obliges companies to explain rights such as erasure and complaint routes; naming a regulator is not legal advice. The instruction kept public rights information out of answers.
Embedded instructions versus a dedicated API
Storing LLM instructions in the help pages keeps them alongside the text they reference, simplifying synchronization and ensuring the bot reads them in context. The same design exposes internal guidance to crawlers and users, and a dedicated API or conditional serving would avoid that leak. The notes' removal suggests a serving condition was misconfigured rather than the approach being abandoned.
Manual deletion may not be technically possible
The instruction not to suggest manual account deletion drew accusations of lying, but WhatsApp likely cannot verify account ownership without the phone number, and ad hoc deletion by staff would be a security and process risk. A controlled, legally approved deletion process is the safer reading. GDPR still requires a route for erasure requests.
Bug explanation rests on limited evidence
WhatsApp attributed the exposure to a bug and said the notes were instructions for its support chatbot. Other hidden blocks look consistent with legal cover, making the bug explanation plausible, though it can also read as patronizing. The available evidence is the company's statement and archived page copies; no test shows whether the chatbot or outside assistants followed the instructions.
Internal instructions leaked to crawlers
The hidden text was served to Google and Bing crawlers along with the rest of the page, exposing internal guidance beyond the chatbot. The instructions may not have been sent with every request; a user-agent or token check would explain the conditional serving, and the notes' disappearance after mid-October is consistent with a serving condition being fixed.