What happened
01
Data-deletion company Redact found hidden notes in WhatsApp's help pages on 8 October 2026 and counted 102 hidden blocks across 80 of the 545 pages it read.
02
The text was not shown on screen. On the account deletion page, it told the support chatbot not to recommend contacting any data protection authority, regulator or supervisory authority.
03
Another block told it not to reference or interpret privacy laws such as GDPR, LGPD or CCPA, although WhatsApp's own European privacy policy tells users they can complain to its lead supervisory authority.
04
WhatsApp said the instructions were for its support chatbot and appeared because of a bug that is now fixed. All the blocks were gone by 18 October 2026. It is not known whether the chatbot acted on them.
Why this is a design failure
A support chatbot is often where people turn when they cannot fix a problem themselves. Telling it to leave out the regulator route keeps users from a right the company's own policy gives them.
The fair alternative
Tell users where they can complain, including the regulator.
Do
When a user cannot resolve a privacy problem, point them to the company's process and to the data protection authority.
Don’t
Don’t instruct a support bot to hide the routes to outside help.
Design guide for this case
If you're designing a support chatbot
Interface
On privacy and account deletion answers, show a fixed "Still stuck?" block linking to the complaint process and the relevant data protection authority.
Words
In the bot's content guide: "If the user can't solve a privacy problem, name the regulator and the user's rights. Never hide outside help."
Flow
When the bot can't resolve a privacy issue, it hands over to a person and offers the regulator route in the same message.
Metrics
Don't count "no escalation" or "no complaints" as success. Track how often unresolved privacy cases were shown the full set of options.
Testing
Audit every help page and prompt for hidden instructions to the bot, and ask it 10 unresolved privacy questions to check what routes it offers.
Before launch
01
Does the bot mention the regulator when a privacy issue stays unresolved?
02
Have we checked help pages for hidden bot instructions?
03
Do the bot's answers match the rights in our own privacy policy?