A support bot told to hide the regulator is a trust failure

Imagine you can't get into your old phone number, you want your WhatsApp account gone, and the support bot you ask for help has been quietly told never to mention the one body that could actually help you. Would you call that customer service?

That is roughly what researchers say they found. As Malwarebytes reports, the privacy software company Redact found hidden text in WhatsApp's help center: 102 instruction blocks across 80 pages, invisible to readers but present in the page code. On the account-deletion page, one block told the chatbot: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." Another told it not to reference privacy laws when users mentioned lawyers or legal action.

WhatsApp spokesperson Joshua Breckman confirmed to WIRED that these were instructions for "WhatsApp Support with AI," and said the company wanted its support chatbots to provide relevant product advice, "not to offer legal advice." The company blamed a bug for the exposure and says it is fixed.

"No legal advice" doesn't explain "don't mention the regulator"

We can accept the company's logic up to a point. A support bot shouldn't pretend to be your lawyer, and no company wants software improvising on the law. That is a reasonable guardrail.

But pointing someone to a regulator isn't legal advice. It's a signpost. "We can't give legal advice" and "we won't tell you where else you can seek help" are different promises, and the instruction as quoted sits firmly in the second category. In our view, the stated rationale doesn't cover the actual wording.

The context makes it worse. As Malwarebytes notes, WhatsApp's account-deletion page offers no manual route for people who can't access their account. It only describes automatic timelines: inactive accounts are generally deleted after 120 days, or 365 days for US users. Meanwhile, WhatsApp's own information-rights page says users can, depending on jurisdiction, contact their local data protection authority directly. So the one escalation path the company itself documents is the one the bot was told to keep quiet about, precisely for the people who are stuck.

Fixing the page doesn't fix the question

Two caveats matter, and we want to be fair. Redact says it didn't test whether the chatbot, or any outside AI assistant, actually obeyed these instructions. We don't know what users were really told. And removing the text from public pages doesn't tell us whether the instructions were changed or are still used internally.

That second point is the heart of it. The scandal isn't only the sentence; it's that we learned of it by accident. A "bug" exposed it. Had the pages rendered differently, we probably would never have known. When the only thing standing between users and a company's self-interest is whether a template leaks, that is not a transparency policy.

Publish the rules, or stop calling it support

Our position is simple: any messaging platform that puts an AI between its users and their rights should publish the rules that bot follows, at least the parts governing what it must and must not say about complaints, data rights and escalation. Not the full engineering prompt, but a readable policy: what the bot won't do, and what it will always tell you.

Companies will object that prompts are proprietary and that publishing them invites manipulation. Fair, but a rule saying "always mention where to complain" gives an attacker nothing. A rule saying "never mention it" is precisely the kind that shouldn't survive daylight. Our guess is that the instructions that can't be published are the ones that shouldn't exist.

There's a broader lesson for an AI-assisted support era. A human agent who was told to avoid mentioning regulators would at least be a person who could be held accountable, quoted and recorded. A bot's hidden prompt is policy without a signature.

What to do if you're stuck

Practically, don't treat the chatbot as the final word on your options. Uninstalling WhatsApp isn't deleting your account; the real option is inside the app, on your primary phone, and it can't be done via WhatsApp Web or a linked device. Export what you want to keep first, because deletion is irreversible, and WhatsApp says deleting your information can take up to 90 days. If you can recover the same number, re-register first. And if the bot runs out of answers, remember that the company's own documentation says you may be able to go to your local data protection authority.

Verdict: WhatsApp may well be telling the truth about intent, and the sentence may now be gone. But trust is built on what a company is willing to show, not what it was forced to remove. Publish the rules.