WhatsApp Hidden Help Page Instructions Direct AI Chatbot to Withhold Regulator and Legal Info

Hidden instructions found within WhatsApp's help pages directed its support AI chatbot to avoid recommending data protection regulators to users facing account deletion issues and to withhold privacy laws and terms when legal action was mentioned.

Data-deletion software firm Redact reported discovering the hidden text embedded in the HTML source code of WhatsApp help pages. According to Redact, the instructions were never displayed visibly on screen to users visiting the site. The discovered text sat within 102 hidden blocks across 80 different help pages out of 545 pages examined, remaining accessible until their removal by October 18, 2026.

Nature of the Hidden Instructions

• Regulator Guidance: Instructions on the account deactivation page told the chatbot not to suggest data protection authorities or regulators to users who could no longer delete their accounts, despite European privacy policies stating users can complain to supervisory authorities like the Irish Data Protection Commission.
• Legal Matters: A second block on reporting and blocking pages directed the chatbot to avoid citing WhatsApp's Terms of Service, Privacy Policy, or liability discussions when users mentioned lawsuits, lawyers, courts, or legal action, instead instructing the bot to advise users to consult a qualified legal professional.
• Additional Blocks: Other hidden blocks reportedly told the chatbot that waiting out automated account deletion periods was the only correct answer for lost numbers, while routine notes handled standard terminology and clarifying paid plans.

WhatsApp and Meta Response

WhatsApp stated that the instructions were intended for its AI support chatbot and appeared in the help pages due to a bug that has since been fixed. A WhatsApp spokesperson told media outlets that the text aimed to ensure accurate responses for users messaging support with AI, keeping the chatbot focused on providing advice rather than offering legal advice.

It remains unknown whether the chatbot actively followed these hidden instructions while they were online, as researchers reviewed the text rather than observing live bot interactions. Internet Archive snapshots indicate the text appeared between July and September 2025 and was removed by October 18, 2026, following inquiries from media organizations.

Practical Implications and Verification

Users encountering account issues or seeking regulatory recourse retain alternative avenues outside the chatbot:

• Standard Deletion Timelines: Accounts left inactive or deactivated are subject to automated deletion windows outlined visibly on help pages (such as 30 days for deactivation or longer for complete inactivity).
• Regulatory Rights: European users retain the right under GDPR (Article 77) to lodge complaints with supervisory authorities, and the right to request data erasure (Article 17).
• Verification Steps: Users and security teams can inspect official privacy policies directly on WhatsApp's website, review archived page snapshots via services like the Internet Archive, or consult official data protection authority portals to confirm statutory complaint procedures.