WhatsApp hid chatbot orders not to name privacy regulators
October 21: Malwarebytes reports WhatsApp confirmed the text was for WhatsApp Support with AI, cited 120- or 365-day inactive-account deletion, and noted Redact did not test the bot.
WhatsApp removed hidden help-page instructions that told its support chatbot not to recommend regulators or cite privacy laws.
Until mid-October 2026, about 80 WhatsApp help and FAQ pages carried unseen instructions for Meta’s support chatbot under the heading HelpContentGalaxyLLMInclude. Redact found them on October 8 across 80 of 545 saved pages, totaling 102 hidden blocks. On account deletion, the bot was told not to recommend a data-protection authority; after a lawyer, lawsuit, or court was mentioned, it was told not to cite or interpret GDPR, LGPD, or CCPA. WhatsApp told WIRED the text was for its own support chatbot, called the exposure a bug, and said every block was removed by October 18. Whether the chatbot followed the orders is unknown. Europe’s privacy policy, effective July 2, 2026, still describes rights to erasure and to complain to the Irish Data Protection Commission or another authority.
- Redact found the notes on October 8, 2026, on 80 of 545 help pages.
- Researchers counted 102 hidden blocks; most were housekeeping.
- Archive copies lack the deletion note on July 12 and include it on September 4.
- WhatsApp said the bug was fixed and all blocks were gone by October 18.
- Crawls posing as major AI bots on October 9 did not receive the notes.
- Checks of 300 Facebook and Instagram help pages found no similar notes.
Timeline
dated events in the reporting · oldest first- Jul 2, 2026Europe privacy policy effective, naming complaint rights · Hacker News
- Jul 12, 2026Archive copy lacks the account-deletion instruction · The Hacker News
- Sep 4, 2026Archive copy includes the account-deletion instruction · The Hacker News
- Oct 8, 2026Redact finds hidden instructions across help pages · The Hacker News
- Oct 9, 2026Crawls as major AI bots do not receive the notes · Hacker News
- Oct 18, 2026WhatsApp says every hidden block has been removed · The Hacker News
What each outlet adds
beyond the shared facts- WIREDReviewed archives; Meta said a bug exposed chatbot instructions.
- Hacker NewsBlock counts, October 9 crawler checks, and Facebook and Instagram negatives.
- The Hacker NewsJuly 12 and September 4 archive dates and October 18 removal.
- Malwarebytes LabsNamed WhatsApp Support with AI and inactive-account deletion periods.
- Products
- Organizations
- RedactIrish Data Protection Commission
- Countries
- Ireland
Coverage
oldest first · one row per article · UTC- · 6d ago
WIRED · SecurityFirst report
WhatsApp help pages exposed hidden instructions for a Meta chatbot
About 80 FAQ pages held roughly 100 hidden blocks telling a support model what not to say, including legal topics.
- · 6d ago
Hacker News · AI
WhatsApp help pages hid chatbot orders not to cite regulators
Hidden notes told WhatsApp’s support bot not to name data-protection authorities or GDPR after a lawyer was mentioned.
- · 5d ago
The Hacker News
WhatsApp help pages hid chatbot orders not to name regulators
Redact counted 102 hidden blocks on 80 pages; Meta called it a bug and removed them by October 18.
- · 4d ago
Malwarebytes Labs
WhatsApp chatbot was told not to recommend privacy regulators
Redact found the hidden text on October 8 across 80 help pages, including account-deletion guidance.