Joseph Cox's reporting here builds directly on his February 21 finding that Google was already indexing invite links to private WhatsApp group chats, exposing participants and their phone numbers to whoever joined. The new wrinkle is WhatsApp's own role: some invite links are set up so search engines can crawl them, meaning the leak isn't just an indexing accident but a configuration WhatsApp permits.
Members of indexed groups have their phone numbers and conversations exposed to any stranger who runs the right search and taps the link — with no action required from admins or WhatsApp.
Group admins lose practical control of 'private' status: a link shared once can surface publicly, converting an invitation mechanism into an open door.
Second-order effects
WhatsApp faces pressure to extend its 2019-style granular controls to invite links themselves — defaults on indexability, admin revocation, and expiry — or accept that 'private group' is a label users can no longer trust.
Rival messengers gain a concrete privacy talking point at WhatsApp's expense, since the exposure involves phone numbers, the identifier most resistant to rotation.
Third-order effects
The episode reinforces the 2018 expert critique that a messenger's real privacy posture lives in its metadata and sharing surfaces, not just its encryption — inviting regulators and security researchers to audit invite flows as part of 'private by default' claims.
If open-by-link groups persist, they feed the dynamics The Guardian later documented around WhatsApp's group structure amplifying misinformation, since searchable groups recruit strangers at scale rather than trusted contacts.
The trend: Messaging platforms are discovering that privacy guarantees built around encryption are undone at the edges — invite links, metadata, and defaults — pushing 'private by default' from a marketing claim toward an auditable engineering standard.
A misconfiguration by WhatsApp enabled ~470k Group Invite links to be indexed by search engines It should've been 'Disallow'ed with robots.txt or with the ‘noindex’ meta tag thanks @JordanWildon for the tip https://twitter.com/... https://twitter.com/...
Your WhatsApp groups may not be as secure as you think they are. The “Invite to Group via Link” feature allows groups to be indexed by Google and they are generally available across the internet. With some wildcard search terms you can easily find some... interesting... groups. h…
@josephfcox Search engines like Google & others list pages from the open web. That's what's happening here. It's no different than any case where a site allows URLs to be publicly listed. We do offer tools allowing sites to block content being listed in our results: https://suppo…
New: Google is letting anyone find invite links to some private WhatsApp groups. Here is one we joined that is supposed to be for United Nations NGOs judging by its description. Can see members and get numbers https://www.vice.com/... https://twitter.com/...
@wongmjane @JordanWildon Gets even worse, invite links to CP groups. �� How is this shit not taken down yet! @WhatsApp @Facebook https://twitter.com/...
Any feature in any web service that enhances your convenience is a potential source for compromising your security and privacy. Whatsapp edition. https://www.xda-developers.com/ ...
Uh, it's NOT Google's fault... it's WhatsApp's fault. May be a good time to use the URL Removal tool to hide that subdomain -> Google Is Letting People Find Invites to Some Private WhatsApp Groups https://www.vice.com/... https://twitter.com/...
@JordanWildon WhatsApp didn't comment on the search engine indexing and implied that admins are on their own I guess this is now a feature, that WhatsApp will not do their very least of unlisting the publicly-accessible group links from search engines via @josephfcox: https://www…