WhatsApp's hidden chatbot notes said not to recommend a regulator
Redact and WIRED found support-bot instructions in help-page code. Meta says a bug exposed them and has been fixed; whether chatbots followed the notes remains untested.
A WhatsApp help page carried a direction that users could not see: do not recommend a data protection regulator. Privacy company Redact says it found that instruction among hidden notes for an AI support chatbot. WIRED reported October 19 that it had viewed the exposed text in archived page code; WhatsApp said a bug had exposed instructions intended for its own chatbot and that the issue was fixed.
The account-deletion note, reproduced in Redact’s investigation, addresses people who have lost access to their device or phone number. Alongside waiting-period information, it says: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.”
A separate note on reporting and blocking tells the bot not to cite or interpret privacy regulations, including when a user raises them directly, once legal action or lawyers enter the conversation. These are reported instructions, not a transcript demonstrating what a customer actually received.
WhatsApp says the bot should avoid legal advice
WhatsApp spokesperson Joshua Breckman told WIRED the notes were meant to ensure accurate, relevant answers for people messaging WhatsApp Support with AI. He said the company wants product-support chatbots to provide advice about WhatsApp rather than legal advice, and said it gives users transparent information about data rights.
Redact argues that directing a bot away from mentioning a regulator goes beyond avoiding legal opinions. Its investigation contrasts the hidden note with WhatsApp’s public European privacy-policy language about complaints. That is Redact’s criticism of the gap between the two sets of wording, not a court finding that WhatsApp violated privacy law.
Removal is established separately from chatbot behavior
Redact dates its discovery to October 8. It says the notes remained present at a check on October 15 at 21:40 UTC and were absent when it checked again on October 18 at 02:08 UTC. The October 19 reporting and company response bring the issue back into view; they do not move the original discovery date forward.
Redact says most hidden blocks were ordinary support guidance, and explicitly says it has not tested whether WhatsApp’s chatbot or outside AI assistants obeyed them. The live-page exposure being fixed therefore does not establish which answers were previously given, whether outside bots were affected, or whether the underlying support policy changed.