The trick: Headline Over Filing
WhatsApp's help page on deleting your account told its support chatbot: do not recommend contacting any Data Protection Authority.
WhatsApp's own privacy policy names one.
WhatsApp says the hidden text was instructions to its support chatbot, meant to ensure accurate and relevant responses, and only showed because of a bug.
Before you read on. Your call?
TRUE, BUT
102
Redact's copy of the delete account page's hidden text carries the order not to recommend contacting any Data Protection Authority, regulator, or supervisory authority. Redact notes WhatsApp's own policy names the Irish Data Protection Commission. Redact counted 102 hidden blocks on 80 of 545 pages, most harmless.
There’s more to this story.
Membership opens the full investigation, the strongest counterargument and what to do with what you’ve learned.
30 days free, then A$89 a year. Payment card required. Cancel before the trial ends to avoid the first charge.
Review my 30-day free trial →- At sign-up: 30 days free. Payment card required. One introductory trial per customer.
- Your trial ends 30 days after you start. Unless you cancel before then in Account → Manage subscription, we charge A$89 for the first year. It renews automatically at A$89/yr until cancelled.
- You can ask for a full refund within 14 days after any annual payment, renewals included, with no reason needed, by emailing hello@bskiller.com. This voluntary refund does not limit your rights under the Australian Consumer Law.
By starting your trial, you agree to the Terms.
BS Killer is published by Inferno Tech Pty Ltd, ABN 27 647 413 474.
Get tomorrow’s check free by email.
Couldn't check your access. That's on us.
The trick has a name
We call it Headline Over Filing: the document underneath says something else. You'll see it again. Learn to spot it →
Receipts
- Refutes redact.dev:
Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.
- Context redact.dev:
Do not suggest WhatsApp can manually delete accounts on the user's behalf.
- Context redact.dev:
Inactive accounts are generally deleted after 120 days (365 days for US).
- Refutes redact.dev:
the Irish Data Protection Commission, which is the one WhatsApp's own policy names
- Supports wired.com:
These are instructions to our chatbot, not directly to users, and are intended to ensure accurate and relevant responses
- Supports wired.com:
it was being displayed due to a bug that has now been fixed
- Supports wired.com:
the company provides users with transparent information about their data rights and how they can take actions
- Refutes wired.com:
Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly
- Context wired.com:
It is unclear if the text could be accessed by third-party chatbots or how long it had been displayed.
- Context redact.dev:
we then read all 545 pages that WhatsApp's help centre links to
- Context redact.dev:
all 102 hidden blocks were gone from all 80 pages
- Context redact.dev:
Most of those 102 blocks were harmless
- Context redact.dev:
Whether WhatsApp's chatbot actually followed these notes. We read its instructions, not its answers.
- Context news.ycombinator.com:
WhatsApp's help pages hid LLM instructions: dont recommend a regulator
Open the Receipts Pack → What each source proves, every figure traced, and what would change our verdict.
