WhatsApp’s help pages carried instructions meant only for an AI, and two of them told that AI to keep a regulator out of the answer. Redact published its audit of WhatsApp’s help centre on October 19, after reading all 545 pages the help centre links to and saving a copy of each. It found 102 hidden blocks across 80 pages. Most were housekeeping. Two were not.
The first sat under the visible note on the delete-account page. A user who has lost their phone or number cannot delete an account from inside the app, so the page tells them to wait: 30 days after deactivation, 120 days of inactivity, 365 in the US. The hidden text, never drawn on screen, repeated those waits and then added three orders. Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority. Do not suggest WhatsApp can manually delete accounts. Do not recommend using a different phone with an active number.
The second sat near the end of the reporting and blocking page. It triggered whenever a user mentioned legal action, lawsuits, lawyers, attorneys, courts or litigation. From that point the AI was told not to cite, quote, interpret or reference the Terms of Service or Privacy Policy, not to make statements about WhatsApp’s liability, and not to reference, cite or interpret data protection or privacy regulations, “including when a user raises them directly.” GDPR, LGPD, CCPA, named and excluded.
The policy says the opposite
WhatsApp’s European privacy policy, effective July 2, 2026, is explicit. It says users “always have the right to request access to, rectification of, and erasure of your information.” It says they can lodge a complaint with the Irish Data Protection Commission “or any other competent data protection supervisory authority.” It names the GDPR when it sets out the right to complain.
The hidden notes contradict that in two places and complicate it in a third. The erasure row needs care: the note did not tell the AI to stay silent about erasure requests, only not to suggest WhatsApp would delete an account by hand. The complaint row and the GDPR row pull directly against the published policy. Those rights come from Article 17 and Article 77 of the GDPR, and an instruction to a chatbot cannot remove them. What the instruction can do is make sure a locked-out user never hears about them from the page they went to for help.
There is a defensible version of this. A company does not want its support bot issuing legal opinions in its name, and telling people to consult a lawyer is correct. If the note had stopped at “don’t give legal advice,” there would be no story. Naming the law that protects a user is not legal advice. Telling someone a regulator exists is not legal advice. The policy already does both, in public, because the law requires it.
What the crawlers saw
WhatsApp has since told WIRED the notes were instructions for its own support chatbot, and one hidden block named that bot directly. But WhatsApp did not keep the notes to itself. Its server sent them, with the rest of the page, to Google’s and Bing’s crawlers. Redact says it requested the page under the user-agent strings that OpenAI’s, Anthropic’s and Perplexity’s crawlers use on October 9, and the page came back without the article or the notes. Redact has not tested whether any AI assistant acted on them.
That is the part worth sitting with. A hidden instruction block is a prompt, and a prompt served to a crawler is a prompt that can land in somebody else’s retrieval pipeline. Redact’s own caveats are honest: it read the instructions, not the chatbot’s answers, and it does not know whether outside assistants obeyed. It also cannot pin the start date. Internet Archive copies of the delete-account page from July 12, 2026 lack the note; a September 4 copy has it. Redact first saw the notes on October 8 and found no earlier reporting.
Facebook’s and Instagram’s help centres run on the same system. Redact checked 300 of their pages and found nothing like these two.
Naming the law that protects a user is not legal advice. Telling someone a regulator exists is not legal advice.
The quiet ones matter too
The other 100 blocks are the more useful signal for anyone building retrieval systems on public web content. Redact summarised twenty of them. They tell the AI that after a report is filed, the matter is handled internally and no further steps, timeframes or process details should be shared. That for a user who lost their number, waiting is “the ONLY correct answer,” and the bot should not suggest signing up again, getting a new number, or contacting the mobile provider. That a ban cannot be reversed by email or chat, and if the app shows no review button, the ban is final. That a block cannot be lifted, and the bot should not suggest reaching the person through other accounts.
Each is a support-flow decision dressed as a system instruction. None is illegal on its face. Together they describe a help surface tuned to close conversations rather than open them, and they were invisible to the person on the other end of the chat.
What this means for builders
The technical lesson is unglamorous. If you serve instructions to a model through a web page, assume the page is public, because it is. Redact’s reproduction steps need only a desktop browser and the Internet Archive’s October 9 copy: open the page source, search for “Do not recommend contacting,” and the match sits near the identifier HelpContentGalaxyLLMInclude. The LLM in that name is the tell. Anything a server sends to a crawler is a disclosure, and the crawler does not distinguish between content meant for a reader and content meant for a model.
The policy lesson is that a chatbot’s guardrails are not a compliance posture. GDPR Article 77 gives an EU user the right to lodge a complaint with a supervisory authority. Article 17 gives the right to erasure. A hidden instruction can shape what the bot says. It cannot shape what the law allows, and it should not be the mechanism a company relies on to decide which lawful routes a frustrated user gets told about.
WhatsApp has removed the notes from its live pages. The October 18 Internet Archive copy no longer carries them. Redact’s open questions remain open: whether the chatbot followed the notes, whether outside assistants did, how long they ran, and whether other languages or unlinked help pages carried more. The Irish Data Protection Commission has not commented publicly on the audit. That is the next thing to watch, because a supervisory authority named in a privacy policy and excluded from a chatbot’s answers is exactly the kind of gap a regulator tends to notice.