WhatsApp’s help pages carried hidden instructions for its AI support chatbot, including one not to recommend a data protection authority to people who cannot delete their account. Privacy company Redact published the findings on 19 October 2026: 102 hidden text blocks on 80 of the 545 help pages it checked. WhatsApp told WIRED that a bug made the notes visible and that the bug has been fixed.
The notes were sent along with each page but never shown on screen. The note on the account deletion page covers people who lost access to their phone number and cannot delete their account themselves. It reads: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.” A note on the reporting and blocking page applies when a user mentions lawyers, courts or legal action. It tells the bot not to “reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA)”, even when the user brings them up. Redact describes most of the other notes as routine guidance, such as pointing users to official support channels.
WhatsApp explains the leak, not the instruction
WhatsApp spokesperson Joshua Breckman told WIRED: “These are instructions to our chatbot, not directly to users.” He added that WhatsApp wants its support chatbots to give advice about WhatsApp, not legal advice. Redact saw both notes online on 15 October and found all 102 removed by 18 October.
That answer covers why outsiders could read the text. WhatsApp did not say whether the chatbot still works with the same rules. Redact read the instructions, not the chatbot’s answers, so nobody has shown that the bot followed them. Internet Archive copies show the deletion note appeared between 12 July and 4 September 2026, but how long all notes were online is unknown. Redact has not confirmed whether help pages in other languages carried them. It found nothing similar on 300 Facebook and Instagram help pages.
Can you complain to a privacy regulator about WhatsApp?
Yes. Article 77 of the GDPR gives everyone in the EU the right to complain to a data protection authority, in particular in the country where they live. In the Netherlands that is the Autoriteit Persoonsgegevens. WhatsApp’s European privacy policy names the Irish Data Protection Commission as the authority for WhatsApp, and the Dutch regulator works with it on cross-border complaints. If you lost your phone number and cannot delete your account in the app, that route is open to you, whatever a chatbot says.
A support bot may decline legal advice, but should not hide the complaint route
Keeping a support bot away from legal advice is sensible. A chatbot that interprets privacy law for an angry customer can give wrong answers that the company then has to stand behind. The deletion note goes further. Article 12(4) of the GDPR covers what happens when a company does not act on a request, such as deleting data. The company must then tell the person they can complain to a supervisory authority. A rule that stops the bot from ever naming that route pulls in the opposite direction.
For organisations, the lesson is that a chatbot’s instructions are policy. They decide what customers hear about their rights, so they deserve the same review as your privacy statement or terms. If you run a support bot, or plan to, check four things:
- Search the system prompt and every knowledge base note for “do not mention” rules about complaints, cancellations, refunds, regulators or legal rights.
- Replace blanket bans with a safe answer: the bot does not interpret the law, but it names your privacy contact and the Autoriteit Persoonsgegevens.
- Test the bot with the questions a frustrated customer asks, such as “I can’t delete my account, where can I complain?”, and repeat that test after every prompt change.
- Keep instructions out of public web pages, and write them as if they will be published one day. Bot instructions leak through bugs and through prompt extraction, where users coax a bot into repeating its rules.
Hidden text on public pages also reaches other AI systems
The bug made the notes part of public web pages. On 9 October, Redact found that Google’s and Bing’s crawlers received them, while requests made with the crawler names of OpenAI, Anthropic and Perplexity did not. A search assistant that summarises WhatsApp’s help pages could therefore have read text written for a different bot. Redact could not confirm that any outside assistant followed the notes. Hidden text that tells an AI what to say is also how prompt injection works, so web teams should know what their pages send that people never see.
DataNorth’s advice is short: let your bot say what it cannot do, and never let it hide what the customer can do.
For more information, visit the report on WhatsApp’s hidden AI instructions on the Redact blog.
