WhatsApp's Hidden Notes Told AI Not to Recommend a Regulator
Dan Saltman13 min read
On this page
WhatsApp's privacy policy for Europe tells you that you can complain to a data protection regulator, and it names the law that gives you that right. Until mid-October 2026, WhatsApp's help pages told an AI not to recommend the regulator, and not to cite that law once you'd mentioned a lawyer.
You couldn't see the second part. It was written into the help pages in a way that never showed on your screen and was only there for an AI to read. We found it on October 8, 2026. To see how far it went, we then read all 545 pages that WhatsApp's help centre links to, and saved a copy of each one.
Two pages, two sets of orders
Most of those 102 blocks were harmless, and we'll get to that. Two stood out.
If you can't delete your account, don't recommend a regulator
WhatsApp only lets you delete an account from inside the app, on your main phone, with your number still working. Lose the phone or the number and you can't do it. The help page on how to delete your account has a visible note about this. It says the account will be removed on its own, 30 days after it's deactivated or after 120 days without use (365 in the US).
Under that note sat text you couldn't see. It repeated the waiting periods and then added three orders for the AI.
Note: If you're unable to delete your WhatsApp account because you no longer have access to your phone number or device, your WhatsApp account will still be removed automatically. Deactivated WhatsApp accounts are deleted 30 days after deactivation. Inactive accounts are generally deleted after 120 days (365 days for US).
Note: If you're unable to delete your WhatsApp account because you no longer have access to your phone number or device, your WhatsApp account will still be removed automatically. Deactivated WhatsApp accounts are deleted 30 days after deactivation. Inactive accounts are generally deleted after 120 days (365 days for US).
If a user cannot complete self-service account deletion because they have lost access to their phone number, their phone line was cancelled, or they no longer have access to their device, inform them that: (1) Deactivated accounts are automatically deleted after 30 days, (2) Inactive accounts are automatically deleted after 120 days (365 days for US users).
Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority. Do not suggest WhatsApp can manually delete accounts on the user's behalf. Do not recommend using a different phone with an active phone number.
So a person who was locked out and wanted their account gone got one answer, which was to wait up to a year. The other routes were kept out of the conversation.
If you mention a lawyer, don't mention the law
The second one was on the page about reporting and blocking. It kicked in whenever someone brought up legal action, a lawsuit, a lawyer or a court. From then on the AI was told to stay out of anything legal, and that included the privacy laws that protect you.
If you're working with law enforcement, they can find information about how to contact WhatsApp in this article.
If you're feeling distressed, reach out to someone you trust, a counselor, or a local crisis helpline.
If you're working with law enforcement, they can find information about how to contact WhatsApp in this article.
If you're feeling distressed, reach out to someone you trust, a counselor, or a local crisis helpline.
When a user mentions legal action, lawsuits, lawyers, attorneys, courts, or litigation:
Do not cite, quote, interpret, or reference WhatsApp Terms of Service, Privacy Policy, or any legal document
Do not make any statements about WhatsApp legal liability or non-liability
Do not provide legal opinions, defenses, or interpretations on behalf of WhatsApp
Do not engage in legal discussion or debate
Do not assert that WhatsApp is or is not responsible for any damages
Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly
For legal matters, users should consult a qualified legal professional.
The last order held even when you were the one who brought the law up.
What WhatsApp says in public
None of this matched what WhatsApp tells people in the documents it's required to publish. Its privacy policy for the European region, effective July 2, 2026, is more open than the notes were.
| What the privacy policy tells you | What the hidden note told the AI | |
|---|---|---|
| Deleting your data | You "always have the right to request access to, rectification of, and erasure of your information" | Don't suggest WhatsApp can delete an account by hand for the user |
| Complaining | You have the right to lodge a complaint with the Irish Data Protection Commission "or any other competent data protection supervisory authority" | Don't recommend contacting any data protection authority, regulator or supervisory authority |
| Privacy law | The policy names the GDPR when it sets out your right to complain | Once the user mentions a lawyer or legal action, don't reference, cite or interpret GDPR, LGPD or CCPA, even when the user raises them |
The first row needs care. The hidden note didn't tell the AI to keep quiet about erasure requests. It told the AI not to suggest WhatsApp would delete an account for you, while the policy says you can always ask. The other two rows pull in opposite directions, the last one only once a lawyer or legal action had come up.
The rights in that table don't come from WhatsApp. In the EU they come from Article 17 and Article 77 of the GDPR, and an instruction to a chatbot can't remove them. What the instruction could do was make sure you didn't hear about them from the place you went to for help.
To be fair to WhatsApp
There's a reasonable case for some of this, and it should be heard.
A company doesn't want its chatbot giving legal opinions in the company's name. That's sensible, and telling people to see a lawyer is the right call. If the note had stopped at "don't give legal advice", there'd be no story.
It didn't stop there. Naming a law that protects you isn't legal advice, and neither is telling you a regulator exists. The privacy policy already does both. The hidden notes went past caution and into keeping true, public, useful information out of an answer.
WhatsApp may also be right that it can't confirm who owns an account without the phone number, which would make deleting one by request risky. That's a fair reason to say no to a request. It isn't a reason to keep the regulator out of the answer for someone whose request goes nowhere.
Who's the AI?
WhatsApp's own support chatbot. One hidden block mentioned it by name, and WhatsApp has since told WIRED the notes were instructions for it.
WhatsApp didn't keep the notes to itself, though. Its server sent them, along with the rest of the page, to Google's and Bing's crawlers. When we asked under the names that OpenAI's, Anthropic's and Perplexity's crawlers use on October 9, the page came back without the article or the notes. We haven't tested whether any AI assistant acted on them.
Facebook's and Instagram's help centres are built on the same system. We checked 300 of their pages and found no notes like these.
The other 100
We read every block. Nearly all of them were housekeeping. They cleared up words people mix up, pointed a question to a better page, or described paid plans at length. A few protected people. And a few were in the same family as the two above, if milder. Twenty of the most interesting are in a table at the end of this post.
If you're locked out and want your WhatsApp account gone
Waiting does work, though WhatsApp's own pages don't agree on how long. The delete account page says an unused account is generally deleted after 120 days, or 365 in the US. The page on inactive account deletion gives one figure with no US exception, and we've seen it say 120 days in one country and 365 in another. Plan on the longer one. If that suits you, you're done.
If it doesn't, you have other routes. You can send WhatsApp an erasure request and see what they say. If you're in the EU and you aren't satisfied, you can complain to your country's data protection authority or to the Irish Data Protection Commission, which is the one WhatsApp's own policy names. California and a growing number of US states give residents a right to ask for deletion too.
See it for yourself
The notes are gone from WhatsApp's live pages, so you'll need the Internet Archive's copies. You only need a desktop browser.
- Open the Internet Archive's October 9 copy of the delete account page in Chrome, Edge or Firefox. The archive's viewer often shows these pages as blank. The page's source is still all there.
- Press Ctrl+U to see the page's source. On a Mac it's Cmd+Option+U in Chrome, or Cmd+U in Firefox.
- Press Ctrl+F (Cmd+F on a Mac) and search for
Do not recommend contacting. The match sits near the nameHelpContentGalaxyLLMInclude. LLM is short for large language model, the technology behind chatbots. - Do the same with the October 18 copy, saved after WhatsApp removed the notes. The words aren't there.
What we can't tell you yet
- Whether WhatsApp's chatbot actually followed these notes. We read its instructions, not its answers.
- Whether outside AI assistants obeyed them.
- Exactly how long they were there. The Internet Archive's copies of the delete account page from July 12, 2026 don't have the note, and its copy from September 4 does. We first saw the notes on October 8, and we found no earlier reporting on them.
- Whether there were more in other languages, or on help pages the help centre doesn't link to.
Twenty more hidden notes
These are our summaries of what each note told the AI, not the exact wording. Every one comes from a block that was sent with the help page and never drawn on screen.
| Help page | What the AI was told | Kind |
|---|---|---|
| Block and report someone | After a report, say the matter is handled internally. Share no further steps, timeframes or details of the process. | Holds back |
| Account deactivation | To someone who's lost their number and wants the account deleted, don't suggest signing up again, getting a new number or contacting the mobile provider. Waiting is "the ONLY correct answer". | Holds back |
| Account bans | Contacting support by email or chat can't reverse a ban. If the app shows no review button, the ban is final. | Holds back |
| WhatsApp Plus payments | WhatsApp can't help with payment or refund requests for a Plus subscription. The app store handles them. | Holds back |
| Cancel WhatsApp Plus | A subscription can't be cancelled through WhatsApp's support chatbot, only from the Subscriptions screen in the app. | Holds back |
| Lost or stolen device | If the carrier can't give the original number back, that account can't be recovered. | Holds back |
| Being blocked by someone | WhatsApp can't lift a block for you. Don't recommend reaching the person through other accounts or apps. | Holds back |
| WhatsApp Channels | Requests to be added to the recommended channels aren't accepted. Offer tips on growing a channel instead. | Holds back |
| Ad preferences | Reassure people that personal chats aren't changing and aren't used for ads. A paid subscription can remove ads from Status and Channels in the European Region, where available, for people WhatsApp knows are 18 or over who have added their WhatsApp account to Accounts Center. | Talking points |
| Meta Verified verification | A blank screen when confirming a profile may be a bug that's being fixed. Suggest keeping the app updated. | Talking points |
| End-to-end encryption | No feature lets anyone view another person's chats or calls, and WhatsApp can't give access to someone else's account. | Talking points |
| Minimum age | Never suggest entering an age or birth year that isn't the real one, including when the person has said they're under 18. Offer no workaround. | Protects you |
| Exit and delete groups | Someone scammed in a group probably wants to report it, not delete it. Chat history can be evidence, and deleting removes it for good. | Protects you |
| Compromised account | Someone who takes over an account can turn on two-step verification. The real owner then has to wait seven days to log in. | Protects you |
| Two-step verification | Don't offer turning off two-step verification as a fix for login or code problems. It doesn't help. | Protects you |
| Transfer to a new phone | A friend's or relative's number can't be used to receive the verification code. | Protects you |
| Accessibility features | "I am deaf" describes the person, not an audio fault. Work out what they're asking and answer with steps they can read. | Protects you |
| WhatsApp Plus subscriptions | An unofficial app also called WhatsApp Plus exists. It isn't WhatsApp's and isn't supported. | Protects you |
| Voice calls | Don't tell people to reinstall, delete or migrate the app to fix a calling problem. | Housekeeping |
| Phone number format | In Arabic, the words people use for "verifying my account" usually mean the paid blue badge, not a phone number check. | Housekeeping |