What they're not telling you: I think I’ve accidently found a privacy issue with WhatsApp communities. I’m in a WhatsApp community where the Admin has hidden the member list, so members should not be able to see who else is in it. That part works as expected.
WhatsApp's "hidden members" feature is security theater—and anyone claiming surprise at this particular leak hasn't been paying attention to how metadata works. The vulnerability here isn't accidental. It's architectural. When you hide a member list, you're obfuscating *display*, not *existence*. The protocol still needs to know who's in the group to route messages. That metadata—timestamps, typing indicators, read receipts, delivery confirmations—creates a fingerprint. Extract it systematically, correlate it across sessions, and you've identified hidden members without ever seeing the roster. This is the same reason Signal's disappearing messages remain vulnerable to screenshots and analog capture. You can't engineer privacy into a system designed for communication. Someone has to know who's talking. Meta won't fix this because it requires rearchitecting Communities entirely—move to client-side encryption of membership data, accept higher latency, deal with impossible key distribution problems. Easier to issue a statement calling it "edge case behavior" and patch the *most obvious* implementation. Users should stop treating feature toggles as security controls. They're UI affordances, nothing more.
What the Documents Show
However, I noticed something odd. If I open a normal private chat with one of my contacts, go to their profile and check the “Gro.
Primary Sources
- Source: r/privacy
- Category: Tech & Privacy
- Cross-reference independently — don't take our word for it.
Disclosure: NewsAnarchist aggregates from public records, API feeds (Federal Register, CourtListener, MuckRock, Hacker News), and independent media. AI-assisted synthesis. Always verify primary sources linked above.