WhatsApp help pages held hidden AI notes against naming regulators, a report says

A report from redact.dev says WhatsApp’s help pages contained text, invisible to readers, that told an AI not to recommend data protection regulators. The researchers found it on October 8, 2026, and say it was gone by mid-October.

Eighty pages, 102 blocks, two that stand out

According to redact.dev, the team read all 545 pages linked from WhatsApp’s help centre and saved a copy of each. They report that 80 pages held hidden blocks meant for an AI, 102 blocks in total. The authors describe most of them as routine: clarifying terms, redirecting a question to a better page, or describing paid plans.

Two blocks drew the attention. The first sat on the page about deleting an account, under a visible note saying that locked-out accounts are removed automatically after a waiting period. WhatsApp can only delete accounts from inside the app, so someone who has lost a phone or number cannot do it themselves. The hidden text, as quoted by redact.dev, repeated the waiting periods (30 days after deactivation, and generally 120 days of inactivity, 365 in the US). It then told the AI not to recommend contacting any data protection authority or regulator, not to suggest that WhatsApp can delete accounts manually, and not to suggest using a different phone with an active number.

The second was on the page about reporting and blocking. Redact.dev says it applied whenever a user mentioned a lawsuit, lawyer or court. It told the AI not to cite WhatsApp’s terms or privacy policy, not to discuss liability, and not to reference or interpret data protection laws such as GDPR, LGPD or CCPA, “including when a user raises them directly”.

The researchers say the text was labelled with the name HelpContentGalaxyLLMInclude in the page source and was served to Google’s and Bing’s crawlers. When they requested the page under the names used by OpenAI’s, Anthropic’s and Perplexity’s crawlers on October 9, they report it came back without the article or the notes. They checked 300 Facebook and Instagram help pages, which run on the same system, and found no comparable notes.

What WhatsApp has said, and what remains unproven

Redact.dev says WhatsApp told WIRED that the notes were instructions for its own support chatbot. We have not seen that statement ourselves. The report also does not claim to know how the chatbot behaved: the authors write that they read its instructions, not its answers, and have not tested whether any outside AI assistant followed the notes.

The timeline is also loose. According to the report, Internet Archive copies of the delete account page from July 12 lack the note and one from September 4 has it, while an October 18 copy no longer does. Whether other languages or unlinked pages carried similar text is unknown. The report itself gives WhatsApp some credit: a company does not want a chatbot offering legal opinions in its name, and redact.dev says the story would not exist if the notes had stopped there.

A gap between the privacy policy and the bot’s brief

The analysis sets the notes against WhatsApp’s European privacy policy, effective July 2, 2026, which per redact.dev states a right to request erasure and a right to complain to the Irish Data Protection Commission or another competent authority. Those rights stem from Articles 17 and 77 of the GDPR, not from company policy, so an instruction to a chatbot cannot remove them. What it could do, the report argues, is keep them out of the one conversation where a locked-out user might hear about them.

Regulators have looked at WhatsApp’s transparency before. In September 2021 the Irish DPC fined the company EUR 225 million after an inquiry into whether it explained its data handling clearly enough, a decision the IAPP reported, and WhatsApp said at the time it would appeal. That case concerned privacy notices, not chatbots, and nothing in the redact.dev report suggests a regulator is examining the help pages. Whether the notes breach any rule is a question for regulators; the report makes no such finding.

The scale of the support problem is also large. WhatsApp said in 2025 that it had banned more than 6.8 million accounts linked to scam centers, as we reported then, and the report’s own list of other hidden notes includes some that appear to protect users, such as warnings about unofficial apps and advice to keep chat evidence after a group scam.

What affected users can still do

Redact.dev notes that waiting for automatic deletion does work, but WhatsApp’s pages disagree on how long, so it advises planning for the longer figure. Users can also send WhatsApp an erasure request, and those in the EU who are unhappy with the answer can complain to their national data protection authority or to the Irish DPC. Residents of California and a growing number of US states have deletion rights as well. The notes have been removed from live pages, so anyone wanting to check the original text needs the Internet Archive’s October 9 copy and a search of its page source.