WhatsApp removes hidden AI support prompts from 80 help pages
WhatsApp removed 102 hidden instruction blocks from 80 help-centre pages by October 18 after Redact, a data-deletion software company, identified text intended for the company’s AI support chatbot. The text was embedded in page HTML under the name HelpContentGalaxyLLMInclude and was not visible in the rendered help pages.
Two instructions drew particular attention. One, on the account-deletion page, told the chatbot not to recommend contacting a data protection authority, regulator or supervisory authority to people who could no longer delete their accounts. Another instructed it not to cite or interpret privacy regulations, including the GDPR, LGPD and CCPA, when a user mentioned legal action, lawyers, courts or litigation.
Hidden guidance and published privacy commitments
WhatsApp allows account deletion only from the app on a user’s main phone. Its visible help text says a deactivated account is deleted after 30 days, while an inactive account is generally deleted after 120 days, or 365 days in the United States. The hidden block repeated those periods and also told the chatbot not to suggest that WhatsApp could manually delete an account or that users should use another phone with an active number.
WhatsApp’s European privacy policy, effective July 2, 2026, states that users can complain to the Irish Data Protection Commission, WhatsApp’s lead supervisory authority under the GDPR, or another competent authority. The policy also says users may request access, rectification and erasure of their information. The GDPR provides a right to lodge a complaint in Article 77 and a right to erasure in Article 17.
How the blocks were found and removed
Redact found the first notes on October 8 and published its findings on October 19. It reviewed all 545 pages linked from WhatsApp’s help centre and counted 102 hidden blocks across 80 pages. Redact said most were routine routing or clarification instructions, although it identified other restrictive guidance, including language describing waiting as “the ONLY correct answer” for users who had lost a phone number.
The company said the content was sent with the pages to Google and Bing crawlers. Requests using user-agent names associated with OpenAI, Anthropic and Perplexity crawlers did not return the article content or the hidden notes. Redact did not test the chatbot itself, so it remains unknown whether the assistant ever acted on the embedded instructions.
Internet Archive copies indicate that the deletion-page text appeared between July 12 and September 4 and remained present on October 9. Both prominent blocks were still live at 21:40 UTC on October 15. By 02:08 UTC on October 18, all 102 blocks had been removed while the help pages remained online.
WhatsApp says a bug exposed chatbot instructions
WhatsApp told WIRED that the text was intended for the chatbot available to people who message WhatsApp Support with AI, and that a bug caused the instructions to appear in help-page code. Spokesperson Joshua Breckman said the company wanted the chatbot to provide accurate and relevant WhatsApp guidance rather than legal advice.
The incident shows why organisations using AI support systems should review both the instructions supplied to assistants and the public-facing material surrounding them. Businesses should test escalation paths for privacy, deletion and legal questions, then make sure chatbot guidance aligns with published policies and the options users can actually pursue.