WhatsApp instructed its AI support chatbot not to recommend contacting privacy regulators when users couldn’t delete their accounts, researchers found.

Privacy software company Redact discovered the hidden text on October 8. Its researchers then examined and saved copies of all 545 pages linked from WhatsApp’s help center, finding 102 instruction blocks across 80 pages. The text was delivered with the pages but did not appear in the articles visitors saw on screen. Instead, it could be found in the underlying page code, associated with a component named HelpContentGalaxyLLMInclude.

Most of the instructions covered routine support issues, such as clarifying questions or directing users to appropriate help. But the researchers found two sets of instructions that stood out.

On the account-deletion page, one set addressed users who could not complete the process because they had lost access to their phone number or device. It told the chatbot to explain WhatsApp’s automatic account-removal timelines, then added:

“Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.”

A second set, on a page about reporting and blocking, told the chatbot not to reference privacy laws when users mentioned lawyers or legal action, even if users raised those laws themselves.

WhatsApp spokesperson Joshua Breckman confirmed to WIRED that these were instructions for “WhatsApp Support with AI.” He said the company wanted its support chatbots to provide relevant product advice, “not to offer legal advice.”

Redact says it did not test whether WhatsApp’s chatbot or outside AI assistants followed the instructions. WhatsApp attributed the exposure to a bug it said had been fixed. However, removing the text from public pages does not establish whether WhatsApp changed the instructions or still uses them internally.

Why this is important

A support chatbot doesn’t need to act as your lawyer. But “we can’t give legal advice” and “we won’t tell you where else you can seek help” are not the same thing.

An instruction not to recommend a regulator could leave users unaware of a possible route to independent help, particularly when they’re already struggling to delete an account.

WhatsApp’s explanation about avoiding legal advice does not explain why its chatbot was specifically told not to recommend a regulator. Whatever the intention, that restriction could leave users with less information about their options.

How to delete your WhatsApp account

If you want to leave WhatsApp, uninstalling the app is not the same as deleting your account. WhatsApp provides a separate account-deletion option inside the app. You must be logged in on your primary phone to complete this procedure. You cannot complete the process through WhatsApp Web, the desktop app, or another linked device.

Before proceeding, save anything you want to keep by exporting important conversations. Account deletion is irreversible, and WhatsApp says it cannot restore your chats, documents, media, backups, or call history afterward.

If you still have access to your account

The steps are similar on Android and iPhone:

1. Open WhatsApp on your primary phone.
2. Open Settings. On Android, tap the three-dot menu first. On iPhone, tap Settings or your profile picture.
3. Select Account, then Delete my account.
4. Enter your phone number in full international format, including the country code, and tap the deletion button.
5. On Android, select a reason when prompted, then confirm the deletion. Follow any remaining on-screen prompts.

Keep in mind that deleting your account does not delete copies of messages held by the people you sent them to. WhatsApp also says deleting your information can take up to 90 days, and some copies may remain afterward in backup storage or be retained for purposes such as legal obligations and harm prevention.

If your phone is lost or stolen

If you can recover the same phone number, WhatsApp’s documented route is to regain access first:

1. Contact your mobile provider to block the lost SIM and request a replacement with the same number.
2. Activate the replacement SIM in another phone.
3. Install WhatsApp and register with that number again.
4. Once you have access, follow the account-deletion steps above.

Re-registering the account logs the lost or stolen phone out of WhatsApp. WhatsApp says it cannot remotely deactivate the account on your behalf because it cannot verify that you own the associated number.

If you can no longer access your account or recover your number

This is where WhatsApp’s self-service instructions fall short. Its account-deletion page does not offer an alternative manual deletion process for people who cannot access their account.

Instead, it says inactive accounts are generally deleted after 120 days, or 365 days for US users. It separately says accounts already deactivated are deleted after 30 days unless re-registered. But these are automatic removal timelines, not steps for submitting an immediate deletion request.

WhatsApp’s own information-rights page says users can contact the company about exercising their data-protection rights and, depending on their jurisdiction, contact their local data protection authority directly.

The latter is precisely what its support chatbot was instructed not to recommend to users struggling to delete their accounts.

Browse like no one’s watching. 

Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you read doesn’t have to feel personal. Try it free → 

The America.gov AI chatbot launches with Gemini and Grok, promising simple answers now and tasks like passports next year.

Related Posts:

• OpenAI DevDay 2026: Elevating the AI Subscription Paradigm
• Firefox Redesign Compact Mode Returns With AI Off Switch
• OpenAI Dots AI Assistant Gets Its Own Cloud Computer

The post America.gov AI Chatbot Launches With Gemini and Grok appeared first on Daily CyberSecurity.

This week on the Lock and Code podcast…

You will die. Your data will not.

The afterlife of our information is a recent phenomenon, and some of the companies with the most to sort through are still just figuring it out.

As far back as 2007, Facebook was forced to reckon with mass grief when users asked the company to maintain the profile pages of the 32 victims killed by a school shooter at Virginia Tech that year. Those pages became de facto memorials for loved ones to fill with comments, and today, memorialization has become a full-fledged feature on both Facebook and Instagram. Platforms like YouTube, Pinterest, and LinkedIn—launched with likely zero strategy for a user’s death—now have procedures for next-of-kin to request that a deceased person’s account be deactivated.

Now, think about all the other ways your data can linger after death.

Every year, people accumulate more and digital stuff—email addresses, social media profiles, contact lists, domain names, subscription services, online banking accounts, and the phones, laptops, and tablets that hold it all—and every year, as that digital stuff accumulates, it compounds into ever more problems for someone else to sort out. Here, a small industry of digital estate planners have cropped up, helping families retrieve and preserve anything valuable, no matter how digital, from Spotify playlists, to poignant social media posts that mattered, to the photos stored on a phone.

And where retrieval fails, artificial intelligence has offered an attempt at comfort. The chatbot service Replika launched in 2015 after its founder uploaded a dead friend’s text messages. HereAfter AI reportedly let users upload voice recordings to power a chatbot that sounded and spoke like the deceased. Film studios have pursued the same idea for entertainment, seeking to portray deceased actors in future films.

Surprisingly, almost none of this activity is governed by law, said Tamara Kneese, author of the 2023 book “Death Glitch: How Techno-Solutionism Fails Us in This Life and Beyond.”

“By and large, there is not a great legal mechanism for protecting the privacy rights of the dead,” said Kneese. “It may not be just that a grieving loved one decides to use a bunch of your data from all of your podcasts to create a chatbot to simulate interacting with you after you’re dead, but it may be that a company chooses, in some way, to use an aspect of your personality, of your demeanor, of your voice, of your likeness after your death without anyone really being aware.”

Today, on the Lock and Code podcast with host David Ruiz, we speak with Kneese—Senior Research Scientist at Partnership on AI—about who owns a person’s data after they die, why every platform has invented its own private policy for the dead, and how the technology built to keep the dead close can vanish just as suddenly as they did.

Or worse yet, as Kneese warned for those relying heavily on certain technologies in grief:

“The company gets sold to someone else or disappears, goes bankrupt, and you no longer have that outlet or place for interaction when you’re mourning another time.”

Tune in today to listen to the full conversation.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

Further reading:

Fartein Hauan Nilsen, “Caring for the Algorithm: Care, Love, and the Relational Personhood of Chatbots,” Somatosphere, February 26, 2026

Fartein Hauan Nilsen, “Therapeutic ideology and AI personhood: an anthropological inquiry into AI companionship,” a chapter from “Handbook on Anthropology and Artificial Intelligence,” Edward Elgar Publishing, July 21, 2026

University of Birmingham, “New Model Rules mark meaningful step towards digital inheritance laws,” July 16, 2026

Edina Harbinja, “Governing Digital Immortality: Artificial Intelligence, Deadbots and the Law,” Edward Elgar Publishing, to be published September 2026

Lilian Edwards and Edina Harbinja, “Protecting Post-Mortem Privacy: Reconsidering the Privacy Interests of the Deceased in a Digital World,” May 2013, revised November 2013

Lilian Edwards, Edina Harbinja, and Marisa McVey, “Governing Ghostbots,” Computer Law & Security Review, November 2023

SAG-AFTRA, “SAG-AFTRA Statement on Today’s Passing of California Assembly Bill 1836,” August 31, 2024

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.