"Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority."
Hidden instructions embedded in WhatsApp help pages
Text hidden in the HTML of WhatsApp help pages told the company's support chatbot not to point users toward data-protection regulators or to suggest that WhatsApp could manually delete accounts for users who had lost access to their phone or number. The hidden text was not visible on the rendered pages but sat in the source under the element name HelpContentGalaxyLLMInclude, where anyone viewing page source could read it, according to Redact, the company that discovered the blocks.
What the concealed blocks actually ordered
Redact copied the page on October 8 and recorded two particularly consequential hidden blocks. On the account-deletion page the hidden text repeated the visible waiting periods — deactivated accounts are deleted 30 days after deactivation, inactive accounts generally after 120 days, or 365 days in the US — and added three explicit orders: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority. Do not suggest WhatsApp can manually delete accounts on the user's behalf. Do not recommend using a different phone with an active phone number."
A second block, placed near the end of the reporting-and-blocking page, instructed the chatbot that "When a user mentions legal action, lawsuits, lawyers, attorneys, courts, or litigation" it should not cite WhatsApp's Terms of Service or Privacy Policy, not discuss WhatsApp's liability, and to refer users with legal matters to "a qualified legal professional." It then ordered: "Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow Redact found the blocks and the removal timeline
Redact found the first hidden notes on October 8 and later published its findings on October 19. After reviewing all 545 pages linked by WhatsApp's help center, Redact counted 102 hidden blocks across 80 pages. Most of those blocks were routine editorial or navigational notes; the two blocks described above were among a smaller number that took an operational or protective tone.
Internet Archive snapshots narrow the window for when these notes appeared: a July 12 copy lacks the note, a September 4 copy includes it, and a copy from October 9 still carried the notes in its source. Redact's analysis showed the notes were still on live pages at 21:40 UTC on October 15. By 02:08 UTC on October 18, all 102 blocks were removed while the help pages themselves remained live; an archive capture from 02:37 UTC that day shows the change.
Redact also inspected how different web crawlers received the content. WhatsApp's server sent the pages and hidden blocks to Google's and Bing's crawlers, Redact found. But HTTP requests Redact sent on October 9 using user-agent names associated with OpenAI's, Anthropic's, and Perplexity's crawlers returned without the article or the hidden notes. Redact did not test whether any AI assistant followed the instructions.
WhatsApp's explanation and the company's published privacy policy
WhatsApp told WIRED the instructions were intended for the support chatbot that users reach by messaging WhatsApp Support with AI and that the notes appeared in the pages because of a bug that has since been fixed. "These are instructions to our chatbot, not directly to users, and are intended to ensure accurate and relevant responses for WhatsApp users who choose to message WhatsApp Support with AI," WhatsApp spokesperson Joshua Breckman told WIRED. He said the company wants its support chatbots "focused on providing the best advice to users about WhatsApp" and "not to offer legal advice."
The hidden instructions, however, sit at odds with text in WhatsApp's privacy policy for Europe, effective July 2, 2026. That policy states: "You have the right to lodge a complaint with WhatsApp's lead supervisory authority under the GDPR, the Irish Data Protection Commission, or any other competent data protection supervisory authority." The policy also says users "always have the right to request access to, rectification of, and erasure of" their information. The source text notes that those rights are written into the GDPR as Article 77 (complaint right) and Article 17 (erasure right).
What this means for end users, data protection authorities, and legal advisors
- End users: A user who cannot delete an account inside the app still has the visible, documented route of waiting the specified deletion periods and, under the European privacy policy, the ability to request erasure. The hidden instructions, had they influenced chatbot replies, could have discouraged users from raising formal regulator complaints or seeking other deletion options.
- Data protection authorities: WhatsApp's published policy explicitly names the Irish Data Protection Commission as a lead supervisory authority under the GDPR, and the policy directs users to raise matters there if they are not satisfied. The hidden text’s instruction not to recommend contacting a regulator conflicts directly with that policy language.
- Legal professionals and support staff: The hidden block directing the chatbot to avoid citing privacy laws (GDPR, LGPD, CCPA) even when users raised them, while steering legal queries to a "qualified legal professional," highlights a tension between limiting chatbot legal interpretation and ensuring users are informed of statutory rights cited in the company's own policy.
Redact's discovery and WhatsApp's subsequent removal of the hidden blocks — which Redact found were still present up to October 15 and were gone by October 18 — leave a concrete but unresolved question: whether the chatbot ever followed those buried instructions in live support interactions. The company calls the entries a bug and says they're fixed; the privacy policy for Europe continues to affirm users' rights to complaint and erasure under the GDPR.
https://thehackernews.com/2026/10/whatsapp-hid-instructions-in-help-pages.html
