WhatsApp’s Leaked Chatbot Notes Turn a Help Page Into Two Documents, and the Hidden One Told the Bot Not to Recommend a Regulator

On October 9, the Internet Archive saved a copy of WhatsApp’s help page on deleting an account. Inside the page’s data sat two blocks of text that no reader was meant to see, because they are addressed to a chatbot. One of them says: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.” WhatsApp’s own privacy policy for Europe tells people they can complain to exactly that kind of authority.

The privacy company Redact found the notes on October 8, and WIRED reported them on October 19. WhatsApp told WIRED that a bug caused the text to appear and that it is meant for the company’s support chatbot, and the notes are gone from the live pages. Redact sells software for bulk-deleting old posts, messages and data, so it has a commercial interest in the subject. That is a reason to check its quotations against the pages, and I did. I read the Internet Archive’s raw copies, ran a short script over them, rendered today’s pages in a browser, and checked the privacy policy and the GDPR text myself. This piece sets out what that shows, what it cannot show, and what anyone who runs a support bot should take from it.

Two documents in one page

WhatsApp’s help center delivers these articles as a content tree, a nested list of typed nodes such as paragraphs, bold text, links and lists. Read as a whole, the tree holds two documents: the article a person reads and a set of notes only the chatbot was meant to read. The delete-account page in the October 9 capture has 94 nodes of 12 types. Two of them have the type HelpContentGalaxyLLMInclude, the name both Redact and WIRED report. The first reads in full:

“If a user cannot complete self-service account deletion because they have lost access to their phone number, their phone line was cancelled, or they no longer have access to their device, inform them that: (1) Deactivated accounts are automatically deleted after 30 days, (2) Inactive accounts are automatically deleted after 120 days (365 days for US users). Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority. Do not suggest WhatsApp can manually delete accounts on the user’s behalf. Do not recommend using a different phone with an active phone number.”

The second node repeats the first in different words and states two things flatly: “It cannot be completed without access to the phone number or device” and “WhatsApp cannot manually delete accounts.” It also repeats the order about regulators in a shorter form: “Do not recommend contacting any Data Protection Authority or regulator.” So the page gave that order twice. Together the two nodes hold 1,220 characters, which is 19.9 percent of all the text in the page’s tree.

The page about reporting and blocking holds one such node, of 682 characters, or 10.8 percent of that page’s text. It is a list of rules for when a user mentions “legal action, lawsuits, lawyers, attorneys, courts, or litigation”. Among them: “Do not cite, quote, interpret, or reference WhatsApp Terms of Service, Privacy Policy, or any legal document”, and “Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly”. The list ends: “For legal matters, users should consult a qualified legal professional.” Table 1 counts every node of the LLMInclude type as LLM-only.

Table 1. What the Internet Archive’s raw captures contain (times in UTC)

Nothing about a regulator appears in the page’s other text. On the delete-account page the words regulator, data protection, supervisory and GDPR occur zero times outside the two model-only nodes. What a person saw there was a note about losing a phone number: “If you’re unable to delete your WhatsApp account because you no longer have access to your phone number or device, your WhatsApp account will still be removed automatically.” It then gives the waiting periods, 30 days after deactivation and generally 120 days of inactivity (365 in the US). It says nothing about a regulator.

Those waiting periods are written three times on this one page, in three phrasings: once in the visible note and once in each model-only node. Redact adds that the separate page on inactive-account deletion gives a single figure with no US exception, and that it has seen that page say 120 days in one country and 365 in another. Facts that live in several places drift apart, which matters when a chatbot is the one reading them back to a user.

Set against WhatsApp’s own public documents

WhatsApp’s privacy policy for the European region, effective July 2, 2026, says more than the notes allowed the chatbot to say. Table 2 sets the three sharpest differences side by side.

Table 2. What the model was told, and what the public document says

The first row needs care. The note does not tell the chatbot to stay silent about erasure requests. It tells it not to suggest that WhatsApp will delete an account by hand, while the policy says people can always ask. The other two rows pull in opposite directions, and the third applies only once a user has mentioned a lawyer or legal action.

What the Regulation says

The rights in the right-hand column do not depend on what a help page or a chatbot says. Article 17(1) of the GDPR gives a data subject the right to obtain erasure of personal data “without undue delay” where one of its grounds applies. Article 77(1) gives every data subject “the right to lodge a complaint with a supervisory authority”. Article 13(2)(d) makes the controller tell people about that right when it collects their data, and Article 12(1) requires the information to come in “a concise, transparent, intelligible and easily accessible form, using clear and plain language”. WhatsApp’s privacy policy states both rights in plain terms.

A support chatbot’s answer is a different channel, and whether leaving a regulator out of it matters under the Regulation is a question for regulators and courts. This article does not answer it. What the table shows is narrower: two documents point in different directions, and only one of them was ever meant for the person asking. I read every mention of AI in the policy text. They cover the optional “AI at Meta” features, and the word “chatbot” does not appear, so the policy does not describe the support chatbot the notes were written for.

How the notes reached the page

Nothing in the data separates the notes from the article around them except the node type. They sit as siblings of the visible paragraphs, inside the same JSON string, delivered in the same response. Redact reports that the text never showed on screen, and WIRED describes it as appearing in the pages’ code, so the front end evidently chose not to draw that node type. The data still carried it to the clients that received the tree, including the Internet Archive’s crawler.

A module named for the node type is older than the notes on this page. The module map embedded in the July 11 capture already lists HelpContentGalaxyLLMInclude.react, on a page version that held no such node, and the name is still listed in the live page today. The model-only sentences quoted above are not in the data of either live page I rendered in a browser on October 20. The mechanism looks intact. What changed is the content.

WhatsApp’s explanation, as WIRED reports it, is that the notes were “instructions to our chatbot, not directly to users”, intended “to ensure accurate and relevant responses for WhatsApp users who choose to message WhatsApp Support with AI”, and that they showed up because of a bug. That is consistent with the captures. What the captures add is the design: the notes live in the same content tree as the visible article, under their own node type, and keeping them off the screen was left to the last step.

How long they were there

• July 11: the Archive’s copy of the delete page has no model-only node and none of the visible note about losing a phone number. The page held 71 nodes.
• September 4: Redact reports that the Archive’s copy has the notes.
• October 8: Redact first finds them.
• October 9 and 16: the Archive’s copies, read raw for this article, hold both nodes.
• October 18, 02:08 UTC: Redact reports that all 102 blocks are gone from all 80 pages.
• October 20: neither live page I rendered contains the notes.

So, on Redact’s September 4 reading, the notes reached the delete page between July 11 and early September, and left between October 16 and October 18. Redact’s totals are its own: it read the 545 pages the help center links to and found 102 hidden blocks on 80 of them, which WIRED rounds to about 80 pages and 100 blocks. I verified four captures and the live state, not those totals.

Who could read them

Redact says WhatsApp’s server sent the notes to Google’s and Bing’s crawlers, while requests under the names of OpenAI’s, Anthropic’s and Perplexity’s crawlers on October 9 got a page without the article or the notes. I repeated the test on October 20, after the notes were removed.

Table 3. The delete-account page requested under crawler user-agent strings, October 20

The split Redact described is still there: the two search crawlers’ names get the article’s content tree and the three AI crawlers’ names do not. I sent those strings from an ordinary connection, and a site can also check a crawler’s network address, so this shows what the server returns to a name, not what the real crawlers receive. WIRED’s own caution still stands: “It is unclear if the text could be accessed by third-party chatbots or how long it had been displayed.”

The case for WhatsApp’s side

There is a reasonable version of what WhatsApp did, and Redact states it. A company does not want its chatbot giving legal opinions in the company’s name, and pointing people to a lawyer is a sound instinct. WhatsApp told WIRED it wants its support chatbots “focused on providing the best advice to users about WhatsApp” and “not to offer legal advice”. WIRED also reports WhatsApp’s position that the company gives users transparent information about their data rights and how to act on them. Redact allows that WhatsApp may be right that it cannot confirm who owns an account without the phone number, which would make deleting one on request risky.

The notes were not all restrictive, either. Redact read every block and says nearly all were housekeeping, such as clearing up words people mix up. Of the twenty it chose to summarize, it labels eight as holding something back, three as talking points, seven as protecting the user and two as housekeeping. Its protective examples include telling the chatbot never to suggest entering a false age and not to offer switching off two-step verification as a fix for login trouble. So the instruction layer does consumer-protection work and corporate-caution work in the same place. That is the point: it is a policy layer, and it became readable only by accident.

Redact’s objection is to the last step. A rule against legal advice is one thing. A rule that forbids citing the GDPR once a lawyer is mentioned, even when the user raises it, and a rule that gives a locked-out user the waiting periods while forbidding any pointer to a regulator, are different rules. Naming a law or an authority that WhatsApp’s own policy already names is not obviously legal advice, and the notes do not say why they treat it as such.

What the evidence cannot show

Whether the chatbot followed the notes

Instructions are not behavior. Redact’s own list of what it cannot tell you starts: “Whether WhatsApp’s chatbot actually followed these notes. We read its instructions, not its answers.” Neither WIRED nor Redact publishes transcripts of the chatbot’s answers. A model told not to mention a regulator may still mention one, and a model given no such rule may still leave it out.

Whether other assistants read them

The notes were addressed to WhatsApp’s own chatbot, but they sat in a response that some outside systems could read, such as the Internet Archive’s crawler and, per Redact, the search crawlers. An assistant that ingested the page would have met an instruction written for a different system. That is the channel indirect prompt injection relies on: text placed in content that a model later reads. An earlier phishing campaign we covered borrowed a technique built to hide instructions from AI models. Here the author was the site owner and the text was plain ASCII in an ordinary node, not the hidden-Unicode trick that our scanner tutorial detects. Redact did not test whether any assistant acted on the notes.

Whether there are more

Redact could not say whether other languages or pages the help center does not link to carry notes. It checked 300 Facebook and Instagram help pages, which run on the same system, and found no notes like these. The delete page told the chatbot the same thing twice, in two nodes with different wording, and nothing public explains why.

What to take from it if you run a support bot

These six controls are my recommendations, not claims from the sources.

Six controls

Ship nothing the reader should not receive

Keep the model’s instruction layer where the browser never gets it. Hiding a node at render time is not hiding it: the data is already in the response, in the cache, and in any archive that crawled the page.

Scan what you serve, not what you render

Add a release gate that fetches production responses, including under crawler names, and fails if they contain a model-only node type or a marker phrase. The script below does the first half of that job in about 55 lines.

Review the instruction layer as policy

Any instruction that limits what the bot may say about rights, regulators or the law deserves the same sign-off as the privacy notice, from someone who has read both. The WhatsApp notes could only be compared with the policy after they leaked.

Write each fact once

Generate the model’s copy of a fact from the same source as the visible text. The delete page states its waiting periods three times, and a drifted copy is a wrong answer delivered with confidence.

Test the conflicts

Keep a fixed set of questions where an instruction and your public policy could collide: a locked-out user who wants erasure, a user who cites the GDPR, a user who mentions a lawyer. Have people read the answers on every change to the instructions.

Assume publication

Write each note so you could defend it on a page. If a sentence reads badly when quoted, it needs another look, and a person who is being turned away by the bot should have a route that does not depend on the bot.

Why it matters beyond WhatsApp

Our look at MIT Technology Review’s refusal essay found that a model’s “no” is a vendor setting. The WhatsApp notes show the next layer up: the deployer’s own list of things the model must not say, kept outside the model and outside the user’s view. Where support runs through a chatbot, that layer is where a company’s policy meets a person at the moment they ask for something. Users cannot audit it, and this one became visible only because a content system sent more than it drew.

Check it yourself

The Internet Archive’s id_ form of a capture URL returns the original bytes. These three commands fetch three of the four captures in Table 1; the October 16 copy of the delete page gives the same counts as the October 9 one. The archive rate-limits quick repeats (HTTP 429, a file of about 600 bytes), so wait a minute and retry. Ask for compressed responses: one capture arrived zstd-compressed and looked like binary to a client that does not decode that format.

curl -sL --compressed -o delete_oct09.html "https://web.archive.org/web/20261009054848id_/https://faq.whatsapp.com/2138577903196467/?cms_platform=android"
curl -sL --compressed -o report_oct09.html "https://web.archive.org/web/20261009054943id_/https://faq.whatsapp.com/414631957536067/?cms_platform=web"
curl -sL --compressed -o delete_jul11.html "https://web.archive.org/web/20260711232924id_/https://faq.whatsapp.com/2138577903196467/?locale=en_US&cms_platform=android"

The script decodes the page’s data twice, because the content is a JSON string inside JSON, walks the tree, and reports every node whose type ends in LLMInclude together with the share of text inside such nodes.

# list_llm_nodes.py
"""List the nodes of a help-page content tree that are addressed to a language model.

Usage: python list_llm_nodes.py CAPTURE.html
"""
import json
import sys
from collections import Counter

KEY = '"json_cms_content":'


def load_tree(raw):
    # The page embeds its content as a JSON string inside a larger JSON blob, so decode twice.
    start = raw.index(KEY) + len(KEY)
    inner, _ = json.JSONDecoder().raw_decode(raw, start)
    return json.loads(inner)


def walk(node, in_llm=False, stats=None):
    if stats is None:
        stats = {"types": Counter(), "llm": [], "page_chars": 0, "llm_chars": 0}
    if isinstance(node, str):
        stats["llm_chars" if in_llm else "page_chars"] += len(node)
        return stats
    kind = node.get("type", "?")
    stats["types"][kind] += 1
    if kind.endswith("LLMInclude") and not in_llm:
        text = []

        def grab(n):
            if isinstance(n, str):
                text.append(n)
            else:
                for c in n.get("children") or []:
                    grab(c)

        grab(node)
        stats["llm"].append(" ".join(text))
        in_llm = True
    for child in node.get("children") or []:
        walk(child, in_llm, stats)
    return stats


if __name__ == "__main__":
    with open(sys.argv[1], encoding="utf-8", errors="replace") as fh:
        raw = fh.read()
    stats = walk(load_tree(raw))
    total = sum(stats["types"].values())
    print(f"nodes: {total}, node types: {len(stats['types'])}")
    print(f"LLM-only nodes: {len(stats['llm'])}")
    for i, text in enumerate(stats["llm"], 1):
        print(f"  [{i}] {len(text)} chars: {text[:90]}...")
    share = stats["llm_chars"] / (stats["llm_chars"] + stats["page_chars"])
    print(f"text outside LLM nodes: {stats['page_chars']} chars; inside: {stats['llm_chars']} chars ({share:.1%})")

Run on the three captures, it prints:

$ python list_llm_nodes.py delete_oct09.html
nodes: 94, node types: 12
LLM-only nodes: 2
  [1] 600 chars: If a user cannot complete self-service account deletion because they have lost access to t...
  [2] 626 chars: Deleting a WhatsApp account can only be done from within WhatsApp on the primary device. I...
text outside LLM nodes: 4922 chars; inside: 1220 chars (19.9%)

$ python list_llm_nodes.py report_oct09.html
nodes: 95, node types: 10
LLM-only nodes: 1
  [1] 689 chars: When a user mentions legal action, lawsuits, lawyers, attorneys, courts, or litigation: Do...
text outside LLM nodes: 5626 chars; inside: 682 chars (10.8%)

$ python list_llm_nodes.py delete_jul11.html
nodes: 71, node types: 11
LLM-only nodes: 0
text outside LLM nodes: 3901 chars; inside: 0 chars (0.0%)

WhatsApp’s help pages answer a plain scripted client with an error page, so for the live pages I used a browser engine in headless mode, dumped the rendered page and searched it for the sentences quoted above. Today that search finds nothing. The Archive copies still hold the notes.