Whatever shared to the open web, Google wants them indexed. That apparently, includes WhatsApp private group chats.
According to Jordan Wildon, a multimedia journalist for a German state-owned public international media company Deutsche Welle, people of the web can discover links to private WhatsApp group chats using particular searches.
This is because Whatsapp’s “Invite to Group via Link” feature allows groups to be indexed by search engines.
As fatal as it can be, the "Invite to Group via Link" can be indexed by search engines, including Google, and are generally available across the internet, meaning that users of Google can simply use wildcard search terms to find "private" groups that share just about any topic.
Like for example, there are links to join groups that discuss topics like animal rescue to the church of satan, porn, and much more.
In a privacy perspective, this is not to anyone's liking.
This is because once someone is able to join that supposedly private group chat, the person can have access to see all of the participants and their phone numbers.
Your WhatsApp groups may not be as secure as you think they are.
The "Invite to Group via Link" feature allows groups to be indexed by Google and they are generally available across the internet. With some wildcard search terms you can easily find some… interesting… groups. pic.twitter.com/hbDlyN6g3q— Jordan Wildon (@JordanWildon) February 21, 2020
WhatsApp spokesperson tries to explain by saying that:
What WhatsApp is trying to say is that, by making links shared outside of its secure private messaging service, the messaging app won't have any control of how crawlers of the web, that includes Google, would find and index those links.
According to Danny Sullivan, Google's public search liaison: "Search engines like Google & others list pages from the open web. That’s what’s happening here. It’s no different than any case where a site allows URLs to be publicly listed. We do offer tools allowing sites to block content being listed in our results."
So this isn't a bug or anything.
Group admins do have the ability to invalidate a link to a chat they control if they want to. But Wildon said that he discovered that, in those situations, WhatsApp only generates a new link; and it doesn’t necessarily disable the original link.
In other words, it only takes one member to publicly share a WhatsApp chat group to potentially expose and compromise everyone else’s privacy.
No member of the group would know if this ever happened.
Developer Jane Manchun Wong noted that Google Search gave about 470,000 results for the chat.whatsapp.com URLs used by group invites. WhatsApp would be better off simply not allowing its chat subdomain to be indexed by Google, and using Google’s aforementioned tools to prevent the links from being indexed.
Or, users should think twice before posting sensitive info in a WhatsApp group.
After Motherboard published the news, the pages are already de-indexed from Google's search results.