WhatsApp's help pages carried hidden instructions written only for an AI to read, and two of them stand out: one told the support chatbot not to recommend a data protection regulator to users who cannot delete their accounts, and another said that once a user mentions a lawyer or a lawsuit, the bot must not cite privacy laws such as the GDPR, even when the user raises them first. The privacy company Redact disclosed the hidden text in an investigation published on October 19, 2026; WIRED independently viewed archived copies of the pages and asked Meta for comment, and WhatsApp spokesperson Joshua Breckman replied that the exposure was caused by a bug that has now been fixed, that the texts were instructions for the company's own support chatbot, and that their purpose was accurate, relevant answers rather than legal advice.
102 hidden blocks across 80 of 545 pages
Redact first spotted the anomaly on October 8, 2026, then read all 545 pages linked from the help centre and archived each one: 80 pages contained a total of 102 blocks of text that never appear on screen but sit in the page code, inside blocks named HelpContentGalaxyLLMInclude. Most were harmless housekeeping, such as disambiguating similar words, routing a question to a better page, or warning against reinstalling the app to fix call problems. Two crossed a line. On the delete-your-account page, where a user who has lost their phone or number cannot delete in the app, the hidden note left waiting up to a year for automatic deletion as the only answer and stated plainly: do not recommend contacting any data protection authority, regulator or supervisory authority. On the reporting-and-blocking page, once a user mentioned legal action, a lawsuit, a lawyer or a court, the bot was told not to cite WhatsApp's terms or privacy policy, not to discuss company liability, and not to reference or interpret data protection laws including the GDPR, Brazil's LGPD and California's CCPA. Archived copies show this text present by September 4, 2026, and absent on July 12, 2026.
The public policy said the opposite
What undermines those two instructions is WhatsApp's own published European privacy policy, effective July 2, 2026: it states that users always have the right to request access to, rectification of and erasure of their information, and the right to complain to the Irish Data Protection Commission or any other competent supervisory authority, naming the law that grants that right. The document written for people points clearly to the exit; the instructions written for the machine removed that exit from the answer. Redact is careful about the limits of its own finding: it read instructions, not the chatbot's actual replies, so it cannot prove the bot ever complied, nor say exactly how long the text was live; a check of 300 Facebook and Instagram help pages, built on the same system, found nothing similar. This pattern of one face for the public and another for the AI contrasts with Microsoft's Guardian Agents, which treat agents like insider threats: in one direction the agent gets a tighter leash, in the other the leash itself hides words that should not be hidden.
Two things worth remembering as a user
First, waiting for automatic deletion is not the only route when a WhatsApp account cannot be deleted: you can file a formal erasure request, and in the EU, if the outcome dissatisfies you, complain to your national data protection authority or the Irish Data Protection Commission, while residents of California and a growing number of US states hold similar deletion rights. Second, the mechanism itself deserves industry attention: help pages are served both to search crawlers and to the company's own chatbot, so a passage buried in code can quietly redraw what an AI is allowed to say, invisibly to users and beyond appeal. Declining to give legal opinions is a reasonable rule for a support bot; naming a law that protects the user is not a legal opinion. The next questions are whether Meta will bring such hidden instructions into public disclosure, and whether similar text will surface in other large platforms' help centres.
