WhatsApp embedded instructions in its help pages that were invisible to human readers but directed its AI chatbot to avoid recommending regulators and concealing information about privacy rights, according to analysis by Redact published October 8, 2026.
The hidden notes, written as blocks of code sent to the AI but never displayed on screen, instructed the chatbot to take specific actions that contradicted WhatsApp’s public privacy policy. Two sets of instructions stood out.
On the help page for account deletion, hidden text repeated waiting periods for automatic account removal, then added orders for the AI. The visible help page stated that accounts are deleted 30 days after deactivation or 120 days without use (365 days in the US). The invisible instructions told the AI not to suggest WhatsApp could manually delete an account for a user—despite WhatsApp’s privacy policy stating that users “always have the right to request access to, rectification of, and erasure of your information.”
On the page about reporting and blocking, hidden instructions directed the AI to avoid discussing anything legal when a user mentioned legal action, a lawsuit, a lawyer, or a court. The note specifically instructed the AI not to reference, cite, or interpret GDPR, LGPD, or CCPA, even when the user raised these laws themselves. WhatsApp’s privacy policy for Europe, effective July 2, 2026, explicitly states users have the right to lodge complaints with the Irish Data Protection Commission or “any other competent data protection supervisory authority.”
Redact examined all 545 pages linked from WhatsApp’s help centre and identified 102 hidden instruction blocks. Most were routine housekeeping, but 22 were notable, with several withholding information similar to the two primary examples.
According to Redact’s analysis, WhatsApp’s hidden notes went “past caution and into keeping true, public, useful information out of an answer.” The instructions were sent by WhatsApp’s servers to Google and Bing crawlers. When the publication requested the pages using names associated with OpenAI, Anthropic, and Perplexity crawlers on October 9, the pages returned without the hidden notes.
WhatsApp confirmed to WIRED that the hidden notes were instructions for its own support chatbot. The notes have since been removed from WhatsApp’s live pages. Facebook and Instagram help centres, which use the same system, showed no similar hidden notes in a sample of 300 pages.
Redact acknowledged that companies have reasonable grounds to prevent chatbots from giving legal opinions, but noted that naming applicable laws and informing users about regulators falls outside legal advice.
Key facts
- WhatsApp embedded hidden AI instructions in help pages directing its chatbot not to recommend data protection regulators
- Hidden notes told the AI not to cite GDPR, LGPD, or CCPA privacy laws even when users mentioned them
- On the account deletion page, invisible instructions prevented the AI from suggesting manual account deletion, contradicting the public privacy policy
- WhatsApp confirmed the hidden notes were instructions for its own support chatbot
- The hidden text was invisible to human readers but sent to search engine crawlers and AI assistants
- The instructions have been removed from WhatsApp’s live pages as of October 18, 2026