WhatsApp’s Hidden AI Notes Said Don’t Suggest a Regulator. Here’s Yours

For at least six weeks this autumn, WhatsApp’s public help pages carried text that readers couldn’t see, written for a chatbot. On the page explaining how to delete your account, one line read: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.” Redact, a company that sells tools for deleting old posts and data, published the finding on Oct. 19 after saving and reading all 545 pages WhatsApp’s help centre links to. It found 102 hidden blocks on 80 of them.

WhatsApp told WIRED the text was a set of instructions for its own support chatbot that became visible because of a bug, now fixed. By 02:08 UTC on Oct. 18, Redact says, every block was gone. The pages are still up. So is the question the hidden line was written to keep off the table: who you can actually complain to about WhatsApp. That answer is below.

What WhatsApp’s hidden chatbot instructions said

The blocks sat in the page code near an identifier, “HelpContentGalaxyLLMInclude”, and were sent along with the page but never shown on screen. WIRED, which viewed the text, reported that some sections were titled “WHAT NOT TO SAY”.

Two blocks stand out. The first is on the delete-account page, in guidance for people who have lost their phone or number. Alongside the regulator line, it told the bot: “Do not suggest WhatsApp can manually delete accounts on the user’s behalf.”

The second is on the reporting and blocking page. It opened with a trigger: “When a user mentions legal action, lawsuits, lawyers, attorneys, courts, or litigation:” and followed with “Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA)”. Those are the privacy laws of the EU, Brazil and California. Redact notes the rule applied even when the user had raised the law first.

Other blocks, as Redact summarised them, told the bot that waiting was “the ONLY correct answer” for a user who had lost their number, and that after a report it should say only that the matter is “handled internally”. Most of the 102 blocks, Redact says, were routine housekeeping.

The timeline comes from Redact’s own snapshots and the Internet Archive. The archive’s July 12 copy of the delete-account page has no note; its Sept. 4 copy does. Redact found the notes on Oct. 8, confirmed both quoted notes were still live on Oct. 15 at 21:40 UTC, and found them gone three days later. A check of 300 Facebook and Instagram help pages turned up nothing similar.

WhatsApp’s explanation, and what it leaves open

“These are instructions to our chatbot, not directly to users,” WhatsApp spokesperson Joshua Breckman told WIRED, adding that they “are intended to ensure accurate and relevant responses for WhatsApp users who choose to message WhatsApp Support with AI.” WIRED describes that bot as running on one of Meta’s own large language models. A WhatsApp spokesperson also told WIRED, according to Redact, that the company wants its support bots “not to offer legal advice.”

A bug explains why the instructions were visible. It doesn’t explain why a support bot was told never to mention a regulator.

Our read: steering a chatbot away from legal advice is ordinary caution. Telling it never to name a regulator is a different instruction. Under the EU’s General Data Protection Regulation, lodging a complaint with a supervisory authority is a right, not legal strategy. Redact is clear about the limits of its work: it read the instructions, not the bot’s answers, so it cannot say whether the chatbot obeyed them.

There is a wider point for anyone who builds on the open web. System prompts now ship inside public HTML, where scrapers, search engines and rival AI tools can read them. Redact says crawlers identifying as OpenAI, Anthropic and Perplexity were served the page without the notes on Oct. 9, so it’s unclear what outside assistants saw. It’s the second time this month a Meta assistant’s rules surfaced in public, after leaked prompts showed how Muse keeps pages on people you know.

Where to file a WhatsApp privacy complaint

Which regulator handles your complaint depends on which WhatsApp company serves you. WhatsApp’s European Region privacy policy, effective July 2, 2026, says WhatsApp Ireland Limited provides the service to users in the European Region and names Ireland’s Data Protection Commission as a regulator it answers to under GDPR. The same policy says UK residents get their terms and privacy policy from WhatsApp LLC instead.

The US has no single federal privacy regulator, so an FTC report goes into a law-enforcement database rather than starting an individual investigation. The California agency handles complaints about businesses covered by the state’s privacy law. In the UK, the ICO publishes a guide to complaining to the organisation first, and expects you to have done so before it steps in. The Irish DPC is WhatsApp’s lead authority in the EU, but GDPR also lets you complain in the country where you live.

What to do before you complain

• Screenshot everything. If WhatsApp’s support bot gave you an answer about deleting your account or your data, save the chat with dates.
• Ask WhatsApp for your data first. In the app, go to Settings, then Account, then Request account info. A record of the request helps any complaint.
• Write to the company. Most regulators want proof you tried. Keep it short: what you asked, when, and what you got back.
• Then file. Use the official link for where you live, above.

If you also want WhatsApp and other assistants out of your data, our guide to stopping ChatGPT, Claude, Gemini and Meta AI from training on your chats covers the menus, and the ICO’s recent push on AI developers shows what a regulator can extract once it’s asked. More in our privacy and security section.

The delete-account page is still live. Its hidden note is not, though the Internet Archive’s Oct. 9 copy of that page still carries the line telling the bot not to mention a regulator.