Researchers at redact.dev say WhatsApp’s help pages contained hidden instructions written for an AI. These WhatsApp hidden AI notes told a chatbot not to recommend a data protection regulator. You could not see them on screen, because they were only there for an AI to read.
Redact.dev found the notes on October 8, 2026. It then read all 545 pages that WhatsApp’s help centre links to and saved a copy of each one. Most of the 102 hidden blocks were harmless, but two stood out.
The first sat on the page about deleting your account. WhatsApp only lets you delete an account inside the app, on your main phone, with your number still working. The hidden text told the AI not to suggest that WhatsApp could delete an account by hand, and not to recommend contacting any data protection authority or regulator.
So how do you delete a WhatsApp account without a phone number? The page’s visible answer was to wait. The account is removed 30 days after deactivation or after 120 days without use, or 365 days in the US.
The second note sat on the page about reporting and blocking. Once someone mentioned a lawyer, a lawsuit or a court, the AI was told not to reference, cite or interpret GDPR, LGPD or CCPA. According to redact.dev, this held even when the user raised the law.
This clashes with WhatsApp’s European privacy policy, effective July 2, 2026. It says you can complain to the Irish Data Protection Commission or any other competent supervisory authority. According to redact.dev, those rights come from Article 17 and Article 77 of the GDPR, so a chatbot instruction cannot remove them. If you want to file a WhatsApp GDPR complaint, that is the route.
In fairness, a company may not want its chatbot giving legal opinions. Redact.dev argues that naming a law or a regulator is not legal advice, and that the privacy policy already does both. WhatsApp told WIRED the notes were instructions for its support chatbot.
Redact.dev read the instructions, not the chatbot’s answers, so it cannot say whether the chatbot obeyed them. If you are locked out, plan on the longer waiting period. You can also send WhatsApp an erasure request, and if you are in the EU and unhappy with the reply, complain to your national data protection authority.
For organisations, the case shows how AI and GDPR meet in a support chatbot. Responsible AI means not hiding rights that your own privacy policy promises.
Read redact.dev article for more information.
