Privacy firm Redact found hidden instructions for Meta’s WhatsApp support chatbot buried in the code of about 80 WhatsApp help pages — including a direction, under a “WHAT NOT TO SAY” heading, not to recommend contacting a data protection authority, regulator or supervisory authority. Why it matters: it is a rare public look at how a big platform coaches its support AI on sensitive topics, and at the gap between what users are told and what the bot is told.
October 19, 2026
What was found
Redact said it read 545 WhatsApp help pages and found 102 blocks of hidden text across about 80 of them, in code blocks headed “HelpContentGalaxyLLMInclude.” The text was not visible to visitors; it was written to guide how Meta’s own support chatbot answers questions. WIRED viewed the exposed text in archived versions of the pages, and Redact said the note on the delete-account page was live by early September and was found on October 8.
Most blocks were housekeeping, according to Redact — pointing people to official support channels, for example. About 20 were notable. On the page about reporting and blocking users, instructions for cases where a user mentions legal action, lawsuits, lawyers or litigation said not to cite, quote, interpret or reference WhatsApp’s Terms of Service, Privacy Policy or any legal document, and not to make statements about WhatsApp’s liability. Other instructions said not to reference data protection or privacy regulations such as GDPR, Brazil’s LGPD or California’s CCPA, even when a user raised them directly. Further notes covered how to respond when a user says they are deaf or hard of hearing, and barred mentioning unreleased features. Redact said it checked 300 Facebook and Instagram help pages, which use the same system, and found no similar notes there.
What WhatsApp said
After WIRED contacted Meta, the hidden text was removed from the pages. WhatsApp spokesperson Joshua Breckman told WIRED the text was displayed because of a bug that has now been fixed, and that the notes were instructions to the company’s chatbot, not directly to users, intended to ensure accurate and relevant responses for people who message WhatsApp Support with AI. Breckman said the company gives users transparent information about their data rights and wants its support chatbots focused on product advice, not legal advice. Redact said it had not tested whether the chatbot, or any outside AI assistant, actually acted on the instructions.
Why it matters
Support chatbots are becoming the first — and sometimes only — door users reach when something goes wrong with an account. If that door is quietly coached away from regulators and privacy law, users may never learn about options they legally have, even if the coaching was meant as legal caution. The fix here was quick once reported, but the episode is a useful reminder to verify important answers from an AI support bot against the actual policy pages — and, where the bot will not help, to go directly to the regulator or authority it would not name.
Frequently asked questions
What did the hidden WhatsApp instructions say?
Among 102 hidden blocks, the standout notes told the support chatbot not to recommend contacting a data protection authority or regulator, not to cite WhatsApp’s legal documents or privacy regulations such as GDPR when legal action was mentioned, and not to mention unreleased features.
How were the instructions found?
Privacy company Redact scanned 545 WhatsApp help pages and found the text in page code under “HelpContentGalaxyLLMInclude.” WIRED confirmed the text in archived copies; the notes have since been removed from live pages.
Did the chatbot actually follow the instructions?
That is not established. Redact said it had not tested whether the WhatsApp support chatbot or any third-party AI assistant acted on the hidden text.
Sources: WIRED via Cybernoz, Redact via Glonce