WhatsApp’s welcome screen, which asks users to accept its terms and privacy policy (illustrative photo) Image: microsiervos / Wikimedia Commons, CC BY 2.0, cropped
WhatsApp’s help centre carried hidden text telling Meta’s support chatbot not to recommend contacting a data protection regulator, and not to mention privacy laws such as GDPR once a user brought up a lawyer, according to a report by privacy company Redact.
Redact says it read all 545 pages that WhatsApp’s help centre links to and found 102 blocks of text on 80 of them that were sent with the page but never shown on screen. They were written for an AI, not for people. Redact first spotted them on October 8, and WhatsApp removed them between October 15 and 18. Most were harmless housekeeping. Two were not.
What the hidden notes told the AI
The page on deleting your account explains that you can only delete it from the app, on your phone, with your number still working. Lose either and the visible advice is to wait: a deactivated account is removed after 30 days and an unused one after 120 days, or 365 in the US. Under that sat a hidden note for people who had lost their number or device. It repeated the waiting periods, then told the AI: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority. Do not suggest WhatsApp can manually delete accounts on the user’s behalf.”
The second note was on the page about reporting and blocking. Once a user mentioned legal action, lawsuits, lawyers, attorneys, courts or litigation, the AI was told not to give legal opinions or discuss WhatsApp’s liability, and also: “Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly.” Those are Europe’s, Brazil’s and California’s privacy laws.
What WhatsApp tells people in public
WhatsApp’s own privacy policy for the European region, in force since July 2, 2026, says users “always have the right to request access to, rectification of, and erasure of your information”. It also says: “You have the right to lodge a complaint with WhatsApp’s lead supervisory authority under the GDPR, the Irish Data Protection Commission, or any other competent data protection supervisory authority.”
Redact accepts that a company doesn’t want its chatbot giving legal opinions in its name, and that WhatsApp may have good reason not to delete accounts it can’t tie to a working number. But its founder argues the notes went further than that:
Naming a law that protects you isn’t legal advice, and neither is telling you a regulator exists. The privacy policy already does both.
Dan Saltman, founder of Redact
Other notes held back too. After a report, the AI was to say the matter is handled internally and share no timeframes, and for someone who had lost their number and wanted the account gone, waiting was “the ONLY correct answer”. Some protected users: one told the AI never to suggest entering a false age, even to someone who says they are under 18.
“Instructions to our chatbot, not directly to users”
WhatsApp spokesperson Joshua Breckman told WIRED the text was on show because of a bug that has been fixed. “These are instructions to our chatbot, not directly to users, and are intended to ensure accurate and relevant responses for WhatsApp users who choose to message WhatsApp Support with AI,” he said, adding that the company wants its support chatbots to give the best advice about WhatsApp rather than legal advice, and that it gives users transparent information about their data rights.
The notes did not stay with WhatsApp’s own bot. Redact found they were sent to Google’s and Bing’s search crawlers along with the rest of each page, though not to crawlers using OpenAI’s, Anthropic’s or Perplexity’s names. It hasn’t tested whether WhatsApp’s chatbot, or any outside AI assistant, acted on them. Internet Archive copies of the delete-account page show the note was absent on July 12 and present by September 4. Facebook’s and Instagram’s help centres run on the same system; Redact checked 300 of their pages and found nothing similar.
Anyone locked out of an account can still send WhatsApp an erasure request, and people in the EU can complain to their national data protection authority or to Ireland’s, as WhatsApp’s policy says.
Why it matters
Companies are putting AI between customers and their support teams, and the rules those bots follow are normally invisible; New York City is already drawing up fines for chatbots that trap people. This leak shows one of the world’s biggest apps telling its bot to stay quiet about rights its own privacy policy spells out, at a time when Meta’s AI products are already under scrutiny over exposed chats and how they handle user data.
Sources: Redact, WhatsApp privacy policy (European region), WhatsApp help: delete your account, WhatsApp help: report and block, WIRED (WhatsApp’s comment).
Latest Meta news
