WhatsApp's help pages hid instructions telling its AI support chatbot not to point users to a data protection regulator and not to cite GDPR once a user mentions a lawyer; Redact found 102 hidden blocks on 80 pages, and WhatsApp removed them by 18 October, calling it a bug
Data-deletion software firm Redact published research on 19 October 2026 showing that WhatsApp's help-centre pages carried hidden text, never shown on screen, written as instructions for the WhatsApp Support with AI chatbot. On the delete-account page, the hidden text told the chatbot not to recommend contacting any data protection authority or regulator, not to suggest WhatsApp could delete an account manually, and not to suggest using another phone with an active number, even though WhatsApp's European privacy policy says users can complain to the Irish Data Protection Commission or another supervisory authority. A block on the reporting and blocking page told the chatbot that once a user mentions legal action, lawyers or courts, it must not cite WhatsApp's terms or privacy policy, discuss liability, or reference data protection laws such as GDPR, LGPD or CCPA, even when the user raises them. Redact checked all 545 linked help pages and counted 102 hidden blocks on 80 of them, most of them routine; it found none on 300 Facebook and Instagram help pages. The blocks were in the page HTML (HelpContentGalaxyLLMInclude) and were served to Google and Bing crawlers. Internet Archive copies date the delete-account text to between 12 July and 4 September. All 102 blocks were gone by 02:08 UTC on 18 October, after WIRED contacted Meta; WhatsApp told WIRED they were chatbot instructions that showed up on the pages because of a bug. Redact read the instructions, not the chatbot's answers, so it is not known whether the chatbot followed them or still does. Primary: Redact; wires: WIRED and The Hacker News (20 Oct).
- Product
- WhatsApp Help Center and the WhatsApp Support with AI chatbot (Meta)
- Versions
- Hidden blocks present from at least 4 Sep 2026 (delete-account page) until removed by 18 Oct 2026
- Exploited in Australia?
- unknown
- Patch to
- If you run an AI support or customer-service bot, review its system prompts and retrieval content for instructions that steer users away from their legal rights, regulators or complaint routes, and keep such instructions out of public page source. Australians who cannot resolve a privacy complaint with a company can complain to the OAIC. Practitioner page: /knowledge/third-party-supply-chain.
Primary: Redact — WhatsApp help pages carried hidden AI chatbot instructions (19 Oct 2026) · WIRED — WhatsApp help pages leaked hidden instructions for a Meta chatbot (Oct 2026); also The Hacker News (20 Oct)