WhatsApp resolves issue that exposed some users’ phone numbers in Google searches

WhatsApp has resolved an issue that caused phone numbers of some of its users to appear in Google search results.

The fix comes days after a researcher revealed that the phone number of WhatsApp users who created a simplified link to allow others to chat with them or join a group appeared in search results.

In a statement, a WhatsApp spokesperson said that this feature, called Click to Chat, is designed to help users, especially small and microbusinesses around the world connect with their customers.

“While we appreciate this researcher’s report and value the time that he took to share it with us, it did not qualify for a bounty since it merely contained a search engine index of URLs that WhatsApp users chose to make public. All WhatsApp users, including businesses, can block unwanted messages with the tap of a button,” the spokesperson added.

The Click to Chat feature allows users to create a short URL — wa.me/<phoneNumber> — that they can share with their friends or customers to facilitate quick conversation without having to first save their phone number to their contacts list.

India-based researcher Athul Jayaram, who revealed this issue, called it a privacy lapse. He claimed that as many as 300,000 phone numbers appeared in Google search results if someone looked up for “site:wa.me”.

Jayaram said the phone numbers appeared in search results because WhatsApp did not direct Google and other search engines to ignore indexing these links — a feature that search engines provide to any web administrator.

He confirmed on Tuesday that WhatsApp had made some change to inform web crawlers to not index certain links.

But Jayaram isn’t the first person to report that WhatsApp phone numbers were visible in Google search results. WaBetaInfo, a website that tracks changes in WhatsApp, reported this behaviour in February this year.

And as Jayaram points out, many WhatsApp users he contacted whose numbers appeared in Google search results were surprised to learn that this sensitive information was accessible on the public internet.

:story: TechCrunch