6 min read
When you are locked out of an app and want your account gone, you usually end up on its help pages. More and more often, a chatbot answers your questions there. Few of us ever wonder what that chatbot has been told to say, or told to leave out.
This month, a privacy company read the code behind WhatsApp's help center and found notes written for an AI, never shown to the people reading the pages. Two of those notes told the AI not to point people to privacy regulators or to discuss privacy laws. WhatsApp says the notes became visible because of a bug, and they are now gone from the pages.
What happened
The discovery came from Redact, a company that makes software for erasing posts, messages and other personal data online. Its founder and CEO, Dan Saltman, says he first noticed the hidden text on October 8, 2026. His team then read all 545 pages linked from WhatsApp's help center and saved copies. They counted 102 hidden blocks of text spread across 80 of those pages.
The blocks sat in the page code under a label called HelpContentGalaxyLLMInclude. LLM stands for large language model, the type of AI that powers chatbots. Visitors did not see them, but anyone viewing the page's source code, the raw text a browser turns into a page, could.
Not every note was restrictive. eSecurity Planet reported that some clarified confusing topics or sent users to more useful pages, and Redact found some that protected users, such as a ban on suggesting a false age. Two blocks stood out.
The first was on the page about deleting an account. The visible text explains waiting periods: a deactivated account is deleted 30 days after deactivation, and an inactive one is generally deleted after 120 days, or 365 days in the US. Underneath, a hidden note covered people who could not delete their account after losing their phone or number. It told the AI not to recommend contacting any data protection authority, regulator or supervisory authority. It also told the AI not to suggest that WhatsApp could delete the account by hand, and not to suggest using a different phone with an active number.
The second was on a page about reporting and blocking. It kicked in whenever a user mentioned lawsuits, lawyers, attorneys, courts or litigation. It told the AI not to cite WhatsApp's terms or privacy policy and not to discuss WhatsApp's liability. It also told the AI not to reference or interpret privacy laws, naming Europe's GDPR, Brazil's LGPD and California's CCPA, even when the user raised those laws directly. Users were to be pointed to a qualified legal professional instead.
According to Redact, an Internet Archive copy of the deletion page from July 12 has no note, and one from September 4 does. The notes were still on the live pages on October 15. After WIRED contacted Meta, WhatsApp's parent company, all 102 blocks disappeared from all 80 pages by 02:08 UTC on October 18. The help pages themselves stayed online. Redact published its findings on October 19, and WIRED reported the story.
WhatsApp told WIRED the notes were instructions for its AI support chatbot and appeared on the pages because of a bug that is now fixed. Spokesperson Joshua Breckman said the notes were meant "to our chatbot, not directly to users." He said the company wants its support chatbots to give users the best advice about WhatsApp, and not to give legal advice. In the coverage I read through October 21, no regulator had commented publicly.
KRUDO's Fine Print
Redact did not test the chatbot. Redact read the instructions, not the chatbot's answers. Redact says it did not check whether WhatsApp's chatbot ever followed the notes in real conversations. Removing the text from public pages also does not tell us whether the same rules still guide the chatbot behind the scenes.
Your rights did not change. WhatsApp's own European privacy policy, effective July 2, 2026, says users can always ask for access to, correction of and erasure of their information. It also says users can complain to the Irish Data Protection Commission, WhatsApp's lead regulator in Europe, or to another competent authority. Redact points out that these rights come from the GDPR itself, under Articles 17 and 77, so a chatbot's silence cannot remove them.
The deletion note was narrow. According to Redact's write-up, the note did not stop the AI from talking about erasure in general. It blocked mentions of regulators, manual deletion by WhatsApp and the switch-phones workaround.
This is not a legal finding. eSecurity Planet notes that the discovery does not establish that WhatsApp broke any privacy law. Redact itself accepts that a company can reasonably keep a chatbot from giving legal opinions. Its argument is that naming a law or a regulator is not legal advice.
Limits of the check. Redact looked at 300 Facebook and Instagram help pages on the same system and found no similar notes. It did not check WhatsApp pages in other languages, or help pages not linked from the help center. Redact sells data deletion tools, so it has a business interest in this subject. Its timeline, though, rests on Internet Archive copies that anyone can look up.
How this kind of thing happens
A support chatbot does not know a company's rules on its own. Companies feed it background instructions, often called a system prompt, plus reference material such as help articles. A common setup has the bot look up the relevant help page and answer from it. Putting bot-only notes inside each help page is one way to give the AI extra direction on that topic.
Those notes are supposed to stay out of what the public sees. If the website's template sends the full page, notes included, to every visitor, anyone who views the page code can read them. WhatsApp has said only that a bug caused the notes to appear; it has not explained the technical details.
What it means for you
A company chatbot is a convenience built by the company, and it works within limits the company sets. Some of those limits are sensible, such as refusing to guess at legal questions. Others may leave out options that matter to you.
The people these two notes were written about were in hard spots. Someone who lost their phone and cannot delete their account, or someone thinking about legal action, is exactly the person who needs to know every route available. The safer habit is to treat any bot's answer as a starting point and check the company's written policy for yourself.
What you can do
- Delete from inside the app. WhatsApp's help center says to go to Settings, then Account, then Delete my account, on your primary phone. Its US privacy policy warns that just uninstalling the app leaves your information stored longer.
- Save what you want first. WhatsApp's help center calls deletion irreversible and says it can take up to 90 days to finish.
- Request your account information. WhatsApp's privacy policies point to the Request Account Info feature under Settings, then Account.
- Lost your phone? Malwarebytes suggests getting a replacement SIM with the same number from your carrier, setting WhatsApp up again, then deleting the account.
- In Europe, you can go to a regulator. Ireland's Data Protection Commission asks people to raise the issue with the company first, then use its online form. WhatsApp's European privacy policy says you can also complain to any other competent data protection authority.
- In the US, check your state. Redact notes that California and a growing number of states give residents a right to request deletion. WhatsApp's US policy points readers to its separate US Regional Privacy Notice for those rights.
From the publisher · KRUDO Designs
This part is about our own product.
HOLLIS H-Ai from KRUDO Designs is built and now in testing before launch. It is a household assistant that runs on your own computer, built for your household's daily tasks: reminders, calendar, shopping list, pantry, expenses, food and macro targets. Your information stays in your household.
Sources
- Redact, Oct 19, 2026
- The Hacker News, Oct 20, 2026
- eSecurity Planet, Oct 21, 2026
- Malwarebytes, Oct 21, 2026
- CyberInsider, Oct 20, 2026
- WhatsApp Privacy Policy (EEA), Jul 2, 2026
- WhatsApp Privacy Policy (US), Jan 4, 2021
- WhatsApp Help Center, accessed Oct 25, 2026
- Irish Data Protection Commission, accessed Oct 25, 2026
This article is based on the published reports listed above, written in our own words. Details are as reported on the dates shown. Spotted an error? Email support@krudodesigns.net and we will correct it.
