WhatsApp’s Hidden Chatbot Instructions Told It Not to Recommend Privacy Regulators

WhatsApp’s help pages exposed instructions telling its AI support chatbot not to recommend privacy regulators to people unable to delete their accounts, according to research published on October 19. WhatsApp says the instructions appeared in the pages because of a bug that has now been fixed.

The finding, reported by WIRED and detailed by data-deletion software company Redact, concerns what users might be told when seeking help with their personal information. It is not evidence that WhatsApp’s message encryption was broken or that private conversations were exposed.

This article was published on October 20, 2026. Redact first found the instructions on October 8 and says they had been removed from the public pages by October 18, before its findings and WIRED’s report appeared.

What the hidden instructions said

Redact says it examined all 545 pages linked from WhatsApp’s help center and found 102 hidden blocks across 80 pages. The text was present in the underlying page code but did not appear in the normal on-screen article.

One block accompanied guidance for users who could not complete account deletion because they had lost access to their phone number or device. Alongside instructions about automatic deletion periods, it told the chatbot: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.”

WIRED independently viewed the exposed text in archived page code. It also reported another set of instructions on a page about reporting and blocking, triggered when a user mentioned legal action, lawyers, courts or litigation.

That second block directed the chatbot not to cite WhatsApp’s terms, privacy policy or legal documents, and not to make statements about the company’s legal liability. It also told it not to reference or interpret privacy regulations, including the European Union’s General Data Protection Regulation, or GDPR, even when users raised them directly.

Not all the hidden material was restrictive. Redact says most blocks were routine support guidance, such as clarifying ambiguous questions or directing people to the right help page. Some were protective, including instructions not to suggest a false age or disabling two-step verification as a login fix.

WhatsApp says the exposure was a bug

WhatsApp spokesperson Joshua Breckman told WIRED that the text was intended for the chatbot people reach through WhatsApp Support with AI, rather than directly for users.

“These are instructions to our chatbot, not directly to users, and are intended to ensure accurate and relevant responses for WhatsApp users who choose to message WhatsApp Support with AI,” Breckman said.

He also said the company wants its support chatbots focused on helping people with WhatsApp, “not to offer legal advice.” According to WIRED, the text disappeared from the pages after the publication contacted Meta.

There is an important limit to the evidence: discovering an instruction does not establish that the chatbot followed it. Redact explicitly says it examined the instructions, not the chatbot’s answers. The research does not demonstrate that users were actually denied information about regulators, or that outside AI assistants obeyed the text.

Removing the blocks from public page code also does not establish whether equivalent instructions remain inside the support system. That question is unresolved in the reporting reviewed for this article.

Why the distinction matters for account deletion

Avoiding legal advice is different from omitting the existence of a complaints process. Someone who has lost a phone number may need more than troubleshooting: they may want to know how to request deletion of personal information or challenge an unsatisfactory response.

Redact highlights a tension between the hidden instructions and WhatsApp’s published European privacy policy, which describes rights to request erasure and complain to a supervisory authority. However, the account-deletion instruction needs to be read precisely. It told the chatbot not to suggest that WhatsApp could manually delete an account; it did not explicitly prohibit mentioning every form of data-erasure request.

Nor does a right to request erasure guarantee immediate deletion of an entire account. Article 17 of the GDPR sets out grounds for erasing personal data and exceptions, including certain legal obligations and legal claims. Account ownership and identity checks can also matter when handling a request.

The separate right to complain is clearer. Article 77 allows people to complain to a supervisory authority if they consider processing of their personal data to infringe the regulation. A chatbot instruction does not remove that right.

What users can do beyond the chatbot

If account deletion or a privacy request stalls, consult the service’s published privacy information and official contact routes rather than treating an automated support answer as the final word. Keep a copy of the request, the date it was submitted and any response.

For people covered by the GDPR, a national data protection authority is an independent route for concerns about personal-data handling. Ireland’s Data Protection Commission advises contacting the organization first and provides an online form if the outcome is unsatisfactory.

The practical lesson is about access to privacy remedies, not a newly disclosed technical attack. The published evidence shows that support instructions could omit useful escalation information; it does not show that WhatsApp’s encryption failed or establish how the chatbot behaved in real conversations.