If you ever messaged WhatsApp’s support chatbot because you could not get into your account, there was a sentence written into the page you were reading that was never meant for you: do not recommend contacting any data protection authority, regulator, or supervisory authority.
What actually happened
A privacy company called Redact found the text on 8 October while reading the code behind a WhatsApp help page. Anyone can open that code in a browser. Redact then read all 545 pages linked from WhatsApp’s help centre and found 102 hidden blocks on 80 of them.
Most of the 102 were housekeeping: clearing up words people mix up, or pointing a question at a better page. A handful worked in your favour, such as one telling the chatbot never to suggest entering a false age for someone under 18. Two were different.
WhatsApp says the notes were instructions for the support chatbot you reach by messaging WhatsApp Support, and that they reached the public pages through a bug, now fixed. By 18 October all 102 blocks were gone, and the pages stayed up.
What the notes actually said
The page on deleting your account carried the line about regulators. Beside it were two more orders: do not suggest that WhatsApp could delete an account by hand for someone, and do not suggest using a different phone with an active number.
A second block sat on the page about reporting and blocking, and switched on the moment you mentioned a lawyer, a lawsuit or a court. From then on the chatbot was told not to cite WhatsApp’s terms or privacy policy, and: “Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly.”
Both instructions run against what WhatsApp publishes. Its privacy policy for Europe, in force since 2 July 2026, says you can complain to the Irish Data Protection Commission “or any other competent data protection supervisory authority”, and names the GDPR while saying so. It also says you always have the right to ask for your information to be erased.
Why it matters more than it sounds
That right does not come from WhatsApp. In Europe it comes from Article 77 of the GDPR, the EU’s data protection law, which lets you complain to a supervisory authority in the country where you live, work, or where the problem happened. Article 17 gives you the right to have your data erased. No instruction to a chatbot can take away either of them.
What it can do is make sure you never hear about them in the one place you went for help. An answer can be accurate, friendly and complete-sounding, and still leave out the sentence that would have changed what you did next.
What you can do about it
You do not have to be locked out to act on any of this.
- Delete the account from inside the app while you still can: Settings, then Account, then Delete my account. It has to be done on the phone that holds your main number.
- Ask for your data first if you want to keep your chats: Settings, then Account, then Request account info.
- If the phone or the number is gone, write to WhatsApp support and ask for erasure of your data. Use the word erasure, not deactivation.
- Know the waiting periods: a deactivated account is deleted after 30 days, and an inactive one generally after 120 days, or 365 in the United States.
- If the answer is no, or nothing comes back, complain to a data protection authority. In Germany that is the authority for your federal state. In North Rhine-Westphalia it is the LDI NRW in Düsseldorf, at ldi.nrw.de or on 0211 38424 0.
- Read the privacy policy, not the help page, when you want to know your rights. The policy is the document a company is held to; the help page only explains buttons.
Three things people get wrong
Myth: if the help page says it, that is the whole story
The help page and the privacy policy do different jobs. One explains buttons, the other is a promise. When they disagree, the promise counts.
Myth: deleting the app deletes my account
It does not. Deleting the app leaves the account on WhatsApp’s servers with your number attached. It goes when you delete it inside the app, or when the inactivity period runs out.
Myth: an AI helper is neutral
It repeats what it was told to say. Every assistant works this way, so this is not a scandal on its own. It does mean the helper is the company’s voice, not an adviser.
What to watch for next
Expect more of this. As companies put chatbots in front of support, billing and legal questions, the instructions behind them become the part of the service you never see. Redact also checked 300 Facebook and Instagram help pages and found nothing like these.
One honest gap: nobody knows whether the bot followed the two instructions. Redact read the instructions, not the answers. WhatsApp has not said whether they still apply now that the text is out of the pages.
Two dates are worth keeping. Since 2 August 2026, European rules require that you be told when you are talking to an AI rather than a person. From 2 December 2026, image and video generators already on the market must mark what they produce in a way a machine can detect.
The one thing to remember
A help page can explain a button. It cannot decide what you are entitled to. If a company’s helper will not name the regulator, look it up yourself. The address is public, and a complaint costs nothing.
Image: “Cellphone (Unsplash)” by Rodion Kutsaev, via Wikimedia Commons, CC0 1.0.