Amid the ongoing intense scrutiny over WhatsApp and its parent company Facebook for its upcoming data and privacy policy, a new user data violation has been reported on the WhatsApp web application which allegedly exposes personal mobile numbers on Google Search via indexing.
WhatsApp web application allows users to use the instant messaging app on desktop or PCs. Rajshekhar Rajaharia, the independent cybersecurity researcher exposed on Friday some screenshots claiming the indexing of personal contact numbers of WhatsApp web users on Google Search via web version.
Rajaharia stated that when someone uses WhatsApp on their desktops, laptop, or PCs, their mobile numbers are indexed on Google Search. He further added that these mobile numbers are not business numbers but of individual users.
Previously, WhatsApp had stated that it had asked Google not to index private group chat links and advised users against sharing chat links on public websites. Google had indexed chat invite links to private WhatsApp groups, thereby implying that anyone can join various private chat groups with a simple search. However, the indexed chat links have been now removed from Google. In this regard, Rajaharia noted that despite WhatsApp asking Google to remove the previously exposed group chat links, personal mobile numbers are now being indexed in Google via the web version.
In March 2020, a WhatsApp spokesperson had stated that WhatsApp includes a “noindex” tag on all deep link pages, and therefore according to Google, it will not be included in the indexing. The latest leak of personal contact numbers via WhatsApp Web has not yet been addressed by either the Facebook-owned platform or Google.
The issue first cropped up in February last year when an app reverse-engineer found that Google had around 4.7 lakh results for a simple search of “chat.whatsapp.com”. This is part of the URL that makes up WhatsApp group invites.
The revelation comes at a time when a number of existing WhatsApp users are switching to Signal, Telegram and other alternate instant messaging platforms following mandatory privacy policy update rolled out by WhatsApp which the users have to accept by 8th February if they wish to continue using the app. Newly crowned world’s richest person Elon Musk had also tweeted to “Use Signal” which led to a meteoric rise in the number of users deleting WhatsApp and installing Signal.
A petition was attempted against WhatsApp’s upcoming data and privacy policy in Delhi High Court on Friday. However, the single judge bench recused from hearing the petition on the ground that it violates the right to privacy of citizens of India. The plea will now be listed before another bench and would be heard on January 18.
