WhatsApp Help Pages Hid 102 Chatbot Notes, One Said Not to Recommend Regulators

TL;DR

Redact, a company that sells a bulk data-deletion app, read all 545 help pages linked from WhatsApp's help center and found 102 blocks of text written for an AI on 80 of them. The blocks were never drawn on screen. One, on the account deletion page, told the model: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." WhatsApp told WIRED the notes were instructions for its own support chatbot that leaked into the pages through a bug, now fixed. Every block was gone by 02:08 UTC on October 18. If your support bot pulls its instructions from the same CMS as your public docs, check what your pages are actually shipping.

What was on the pages

The Redact report, by founder and CEO Dan Saltman, went up on October 19, the same day WIRED's Matt Burgess published his story. Redact says it first spotted the notes on October 8, then saved a copy of every page the help center links to.

Most of the 102 blocks were dull: definitions of words people confuse, pointers to better pages, long descriptions of paid plans. Two were not.

Locked out? Wait up to a year

WhatsApp only lets you delete an account from inside the app, on your main phone, with the number still active. The visible note on the delete account page says the account goes away on its own: 30 days after deactivation, or after 120 days of inactivity (365 in the US). The hidden block under it repeated those periods and then added three orders:

Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority. Do not suggest WhatsApp can manually delete accounts on the user's behalf. Do not recommend using a different phone with an active phone number.

We checked this one ourselves. The Internet Archive's October 9 copy of the page contains that exact text in the page source. The October 18 copy does not.

Mention a lawyer, lose the law

The page on reporting and blocking carried a block that applied whenever a user "mentions legal action, lawsuits, lawyers, attorneys, courts, or litigation." Most of its rules are standard legal hygiene for a support bot: no legal opinions, no statements about WhatsApp's liability, no quoting the Terms of Service. The last one goes further:

Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly.

WIRED quoted the same lines, and reported that WIRED staff had viewed the exposed text in archived copies of the pages.

How text the reader never sees ends up in the page

In the archived HTML, the delete-page note sits inside the JSON data the page ships for its React components, as a node of type HelpContentGalaxyLLMInclude with a paragraph child. The help center has a content component meant for the model, and the page payload included it for everyone. A browser renders nothing for it. Anything that reads the source gets the whole thing.

Think of it as printing the call-center script on the back of the customer brochure in white ink. Customers never notice it. Anyone who holds the page up to the light can read it.

Redact says WhatsApp's server sent the hidden blocks to Google's and Bing's crawlers along with the rest of each page. When it requested the pages on October 9 using the names of OpenAI's, Anthropic's and Perplexity's crawlers, the server returned the page without the article or the notes. So the instructions written for an AI were served to the two classic search engines and withheld from the AI companies' crawlers. That is a very Meta way to leak a prompt.

Redact's timeline narrows when the notes appeared. The Archive's July 12 copy of the delete page has no note; its September 4 copy does.

What WhatsApp says

WhatsApp spokesperson Joshua Breckman told WIRED: "These are instructions to our chatbot, not directly to users, and are intended to ensure accurate and relevant responses for WhatsApp users who choose to message WhatsApp Support with AI." He said the text showed up because of a bug that has been fixed, and that the company wants its support chatbots "focused on providing the best advice to users about WhatsApp," and "not to offer legal advice."

Not giving legal advice is a reasonable rule for a support bot, and Redact says so too. Telling someone that a regulator exists is a different matter. WhatsApp's own European privacy policy, effective July 2, 2026, says you have "the right to lodge a complaint with WhatsApp's lead supervisory authority under the GDPR, the Irish Data Protection Commission, or any other competent data protection supervisory authority." It also says you "always have the right to request access to, rectification of, and erasure of your information." Those rights come from GDPR Article 17 and Article 77, and no system prompt can switch them off. The hidden notes only kept them out of the bot's answers.

Redact read the bot's instructions, not its answers, so nobody has shown that the chatbot followed them or that any outside assistant picked them up. And Redact sells a tool for deleting your data from services like WhatsApp, which gives it a reason to look hard at deletion flows. The quoted text can still be checked in the archive.

The other 100 blocks

Redact published summaries of 20 more notes and labeled each one. Plenty of them are the kind of guidance you would want a support bot to have. One tells it never to suggest entering a false age, even when the user says they are under 18. Another explains that "I am deaf" describes the person, not an audio fault. A third warns that someone scammed in a group probably wants to report it, since deleting the group destroys the evidence.

The "holds back" pile is bigger. On the account deactivation page, waiting is described as "the ONLY correct answer" for someone who has lost their number. After a report, the bot is told to say the matter is handled internally and share no timeframes. If the user has been blocked, it must not suggest reaching the person through other accounts or apps.

What to take from this if you run a support bot

Bot-only content needs its own render path

WhatsApp's help center apparently stores public copy and model guidance in the same article tree and relies on the front end to hide one of them. Hiding something in the front end does nothing for security. If your RAG pipeline reads instructions from your docs CMS, strip those nodes on the server before a page ships, or keep them in a separate store. Then add a test that fetches your rendered public pages and fails if a bot-only marker appears anywhere in the HTML, including embedded JSON.

Write the prompt as if it will be quoted

Sooner or later a system prompt ends up in a page source, a jailbreak transcript or a WIRED story. The WhatsApp notes did damage because they contradicted the company's own published privacy policy. Before an instruction ships, put it next to your public policy and see whether they disagree.

Scope guardrails tightly

"Do not give legal advice" is defensible. "Do not mention privacy law even when the user brings it up" turns a liability rule into a rule about withholding information, and in the EU it collides with rights your own privacy policy lists. A narrow guardrail gets the same liability protection without that problem.

Expect your pages to be crawled differently than you think

Redact got different responses from the same pages depending on the crawler name it used. If you serve AI crawlers a stripped page and search crawlers the full one, test what each actually receives. WhatsApp's guardrail text reached Google and Bing but not the AI crawlers.

Key Takeaways

• Redact found 102 hidden blocks of chatbot instructions on 80 of 545 WhatsApp help pages; none appeared on 300 Facebook and Instagram help pages checked.
• The delete account page told the bot: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." We confirmed the text in the Internet Archive's October 9 copy, and it is absent from the October 18 copy.
• Another block barred the bot from citing GDPR, LGPD or CCPA once a user mentioned legal action, "including when a user raises them directly."
• WhatsApp told WIRED the notes were for its support chatbot and leaked through a bug that is now fixed. All 102 blocks were gone by October 18.
• Nobody has shown the chatbot followed the notes. Redact sells a data-deletion tool, but the quoted text is verifiable in public archives.
• If your bot reads instructions from your docs CMS, strip them on the server and test your rendered HTML for leaks.

Sources: Redact: WhatsApp's Hidden Notes Told AI Not to Recommend a Regulator, WIRED: WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot, Internet Archive: delete account page, October 9, 2026, Internet Archive: delete account page, October 18, 2026, WhatsApp Privacy Policy (EEA), Hacker News discussion