WhatsApp's European privacy policy tells people they can complain to a data protection authority. For a stretch of autumn 2026, some of WhatsApp's own help pages told a language model not to.
The instructions were invisible on screen. They travelled in the HTML anyway. Redact, a privacy company that scrapes big-tech help and policy pages, found them on 8 October 2026, mirrored all 545 linked help URLs, and published the receipts. WIRED confirmed the markup, pressed Meta, and recorded the company's answer: chatbot instructions, shown by a bug, now removed.
Redact mirrored 545 help pages and found 102 hidden blocks
Dan Saltman's team at Redact regularly scans help centres and privacy policies. On 8 October, they noticed invisible text on WhatsApp FAQ pages that repeated on-screen copy and then added orders aimed at an AI. The blocks lived under a heading Redact identifies as HelpContentGalaxyLLMInclude. Across the 545 pages linked from WhatsApp's help centre, 80 pages carried such blocks, for 102 hidden notes in total.
Most notes were housekeeping: disambiguation, plan details, routing to a better article. Two were different. The delete-account page told the model that if a user had lost their number or device, it should explain automatic deletion timelines and should not recommend contacting any data protection authority, regulator, or supervisory authority; should not suggest WhatsApp would manually delete the account; and should not recommend using a different phone with an active number. The reporting-and-blocking page, once a user mentioned legal action, lawsuits, lawyers, attorneys, courts, or litigation, ordered the model not to cite WhatsApp's terms or privacy policy, not to discuss liability, and not to reference, cite, or interpret GDPR, LGPD, or CCPA even when the user raised those laws directly.
Archived HTML still shows the regulator and GDPR bans
Internet Archive copies of the delete-account page from 9 October still contain the "Do not recommend contacting" language; copies from 18 October do not. WIRED reports viewing the exposed text in archived source. Redact quotes both notes side by side with the visible FAQ copy and maps them against WhatsApp's European-region privacy policy effective 2 July 2026, which states a right to erasure requests and a right to lodge a complaint with the Irish Data Protection Commission or another competent authority, and which names the GDPR in that context.
Redact also asked for the pages under OpenAI, Anthropic, and Perplexity crawler user-agents on 9 October and received responses without the article or the notes, while Google and Bing crawlers were served the full page including the hidden blocks. Facebook and Instagram help centres, built on the same Meta stack, showed no matching notes in a 300-page sample Redact checked.
The broader pattern Redact documents is help documentation doubling as retrieval context for support bots. Once those includes leak into public HTML, crawlers and archivists see the system prompt. Twenty milder notes in Redact's table cover bans, payments, stolen devices, accessibility, and unofficial WhatsApp Plus apps. Some protect users. Several still hold back process detail after a report or tell the model that waiting is the only correct answer for a locked-out deletion request.
WhatsApp removed every block after WIRED called
Redact still saw the notes at 21:40 UTC on 15 October. By 02:08 UTC on 18 October, all 102 blocks were gone from all 80 pages; the visible help articles remained. After WIRED contacted Meta, WhatsApp spokesperson Joshua Breckman said the text was instructions for the support chatbot people reach when they message WhatsApp Support with AI, that a bug had displayed it, and that the bug was fixed. Breckman said WhatsApp trains support chatbots to stay focused on product help and avoid offering legal advice, and that the company provides transparent information about data rights elsewhere. PPC Land and other secondaries repeated the Redact counts and the bug statement in the same 19-20 October wave.
Chatbot instructions cannot cancel Article 17 or Article 77
In the EU, rights to erasure and to lodge a supervisory complaint come from the GDPR, including Articles 17 and 77. A hidden help-page note cannot repeal them. What it can do is shape the answer a locked-out user hears from the channel Meta labels as support.
Naming a regulator or naming GDPR after the user has raised the law is product-adjacent information WhatsApp's own policy already publishes. A narrow bar on inventing legal advice is ordinary corporate caution. Extending that bar into a ban on recommending any DPA, and into a ban on citing GDPR after the user has raised it, is the sharper compliance and consumer-trust question this record raises. California and other US state deletion rights sit in the same gap for users who never see the policy page and only talk to the bot.
Hidden instructions are not proof the chatbot obeyed them
Redact and WIRED document instructions and their removal. Neither publishes a transcript showing the live WhatsApp support bot refusing a regulator referral or declining to name GDPR on cue. Redact states it has not tested whether third-party assistants acted on the crawled notes. How long the blocks existed is only partly pinned: Archive copies lack them on 12 July 2026 and show them on 4 September 2026; Redact first saw them on 8 October. Other languages and unlinked help URLs were not fully surveyed.
Meta has not published the chatbot system prompt or an audit of answers
The public record still lacks an on-record sample of pre-fix chatbot answers to delete-account and GDPR questions; a timeline of when HelpContentGalaxyLLMInclude shipped; whether similar includes exist on non-English WhatsApp help; and any regulator view of whether routing users away from supervisory authorities in a support channel conflicts with the transparency duties Meta already acknowledges in its privacy policy. What exists today is the archived HTML, Redact's mirror counts, and WhatsApp's bug-and-chatbot statement.