What did WhatsApp say about the hidden chatbot instructions?

WhatsApp told WIRED the hidden notes were instructions for its support chatbot that appeared on the help pages because of a bug, which has been fixed. Spokesperson Joshua Breckman said: "These are instructions to our chatbot, not directly to users." The company also said it wants its chatbots focused on giving users the best advice about WhatsApp.

Why do the WhatsApp instructions matter for EU users?

WhatsApp's European privacy policy names the GDPR and says users can complain to the Irish Data Protection Commission. The hidden notes told the support bot not to recommend any data protection authority to users who could not delete their accounts, and not to cite privacy laws when users mentioned legal action. Redact argues the two directly conflict.

Did Facebook and Instagram help pages have the same hidden notes?

Redact checked 300 Facebook and Instagram help pages and found no similar hidden notes. The hidden AI text it found was limited to WhatsApp's help centre, where 80 of the 545 linked pages carried 102 hidden blocks. Most of those blocks were routine support guidance; the regulator and privacy-law rules were the ones that stood out.

Are the WhatsApp hidden instructions still online?

Redact reports the notes were removed from WhatsApp's live help pages by October 18, 2026, at 02:08 UTC. Digit reports they are no longer in the live page code but remain in archived copies. It is still unclear how long the instructions were public or whether third-party AI assistants read and acted on them.

Redact · 2026-10-19 · major

WhatsApp help pages hid AI instructions — don't recommend a regulator

Redact found hidden text on WhatsApp help pages that told an AI support bot not to recommend contacting a data protection regulator and not to cite GDPR, LGPD or CCPA. WhatsApp blamed a bug and removed the notes.

Illustration of a robot puppeteer controlling a chatbot, for Redact's WhatsApp hidden AI notes report

Hidden notes on WhatsApp's help centre told its support chatbot to steer users away from privacy regulators and privacy law.

Quick facts

Found by	Redact (Dan Saltman)
First seen	October 8, 2026
Scale	102 hidden blocks on 80 of 545 pages
Code heading	HelpContentGalaxyLLMInclude
WhatsApp's answer	Chatbot instructions shown by a bug, now fixed
Removed	By October 18, 2026, 02:08 UTC

What is it?

Redact founder Dan Saltman found hidden text on WhatsApp help pages, invisible to users, written as instructions for an AI. On the delete-account page it said: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." On the reporting and blocking page it told the bot not to cite or interpret privacy laws such as GDPR, LGPD or CCPA when a user mentioned lawyers or courts.

How does it work?

The notes were embedded in the page code of WhatsApp's help centre, under a heading called "HelpContentGalaxyLLMInclude", so a chatbot reading the page would also read the rules. Redact found them on October 8, 2026, then saved all 545 pages the help centre links to and counted 102 hidden blocks across 80 pages. Most blocks were routine; it found nothing similar on 300 Facebook and Instagram help pages.

Why does it matter?

The hidden rules conflict with WhatsApp's own European privacy policy, which tells users they can complain to the Irish Data Protection Commission. The case shows that support bots can be quietly told what not to say, and that text meant only for an LLM can leak into public pages and be read by anyone, including other AI assistants.

Who is it for?

privacy teams, people building support chatbots, EU users

Frequently asked questions

What did WhatsApp say about the hidden chatbot instructions?: WhatsApp told WIRED the hidden notes were instructions for its support chatbot that appeared on the help pages because of a bug, which has been fixed. Spokesperson Joshua Breckman said: "These are instructions to our chatbot, not directly to users." The company also said it wants its chatbots focused on giving users the best advice about WhatsApp.
Why do the WhatsApp instructions matter for EU users?: WhatsApp's European privacy policy names the GDPR and says users can complain to the Irish Data Protection Commission. The hidden notes told the support bot not to recommend any data protection authority to users who could not delete their accounts, and not to cite privacy laws when users mentioned legal action. Redact argues the two directly conflict.
Did Facebook and Instagram help pages have the same hidden notes?: Redact checked 300 Facebook and Instagram help pages and found no similar hidden notes. The hidden AI text it found was limited to WhatsApp's help centre, where 80 of the 545 linked pages carried 102 hidden blocks. Most of those blocks were routine support guidance; the regulator and privacy-law rules were the ones that stood out.
Are the WhatsApp hidden instructions still online?: Redact reports the notes were removed from WhatsApp's live help pages by October 18, 2026, at 02:08 UTC. Digit reports they are no longer in the live page code but remain in archived copies. It is still unclear how long the instructions were public or whether third-party AI assistants read and acted on them.