What happened
WhatsApp's help pages contained instructions written for its support chatbot that were never displayed to a reader. The text sat in the page code until it was removed by October 18, and told the chatbot what not to say to users who could no longer delete their own accounts.
Whether the chatbot ever followed them is not known: Redact, a data deletion software company, found the text itself, not the chatbot's replies. WhatsApp told WIRED that the instructions were intended for the chatbot users reach by messaging WhatsApp Support with AI, and that they appeared in the pages because of a bug that has been fixed.
The first block appeared beneath a visible note about the 30 day and 120 day deletion timelines. According to Redact's copy of the page from October 8, the hidden text repeated those waiting periods and added three orders: do not recommend contacting any data protection authority, regulator or supervisory authority; do not suggest WhatsApp can manually delete accounts on a user's behalf; and do not recommend using a different phone with an active phone number.
A second block, on the page about reporting and blocking, applied whenever a user mentioned legal action, lawsuits, lawyers, attorneys or courts. From that point the chatbot was told not to cite the Terms of Service or Privacy Policy, not to discuss liability, to refer legal matters to a qualified legal professional, and not to reference or interpret privacy regulations such as the GDPR, LGPD or CCPA, including when a user raised them.
WhatsApp's privacy policy for Europe, effective July 2, 2026, says the opposite of the first instruction: it confirms the right to complain to its lead supervisory authority, the Irish Data Protection Commission, or any other competent authority.
Why this is a GRC story
A help workflow is a compliance control. Account deletion is a privacy right a user exercises in a single sitting, and the help page is where the company explains how. If the assistant answering that page is told never to mention a regulator, the route to complaint has been written out of the script, whatever the privacy notice says.
Prompts are policy documents and need the same review. A system prompt that shapes what a company tells users about their rights is an outward facing statement. It should go through legal, privacy and records review, be version controlled, and be tested like a call centre script.
Bugs that shape rights are not just bugs. The stated cause is a display fault. The harder question for a regulator is how text with that content came to exist, who approved it, and what assurance exists that the live chatbot now answers correctly. "It was a bug" answers how it was visible, not why it was written.
What to watch
Watch the Irish Data Protection Commission and the European Commission. A regulator looking at whether users were denied a route to complaint has a clear interest, and the evidence is well preserved because the text was public.
For everyone else, find the prompts behind your customer facing assistants, especially the ones handling rights requests, billing disputes and complaints. Compare them against what your published notice promises. Where the two disagree, one of them is about to become embarrassing.
Attribution: Analysis based on The Hacker News and related public reporting. This article is original commentary, not a repost of the source material.