4 ms·

Apparently, the phone numbers only get indexed if a website owner includes a "Click to Chat" widget on their website - effectively publishing the number anyway.

Apparently, the phone numbers only get indexed if a website owner includes a "Click to Chat" widget on their website - effectively publishing the number anyway. The only difference is that "Click to chat" only displays a QR code which visitors scan. They are then redirected to the WhatsApp chat of the website owner, where the number is public anyway. Maybe WhatsApp should make clear that the "Click to chat" widget allows anyone to see your phone number. But I don't really see any other mistake on their part.

twhitmore 6y ago
It's definitely a mistake of WhatsApp to expose the number in clear text in the URL. Private user data, personal identifiers or contact details should never be used as the primary key publicly. A meaningless surrogate key should be used. If people then want to go thru and scan the QR code or whatever to contact them and gain access to the phone number, that's fine, but it absolutely shouldn't be exposed where Google is indexing it unless there was a specific intent and agreement -- on the part of both those users & WhatsApp -- that they wanted their phone number published & indexed on Google. Because explicit permission comes first. Both morally, and for GDPR
- njb311 6y ago
  I wasn’t aware of the click to chat function, so I checked it out. On the Whatsapp website it gives clear instructions on how to place the link on your website. It’s a hyperlink that couldn’t be more obvious that your Whatsapp number is in clear text (and will show if you hover over the link, even if it isn’t visible as such). So on the face of it you are publishing your own personal information to the web, it’s obvious it will be visible to search bots, and there is no GDPR issue assuming you are using your own number. The article and Many comments refer to a QR code/widget. This does not appear to be provided by Whatsapp – there was nothing came up on the Whatsapp website and search results were all for third party services. The article also notes that you have to go to a third party for the QR code. I just quickly made a QR code for my Whatsapp and there was no alt text for the image or other metadata. So if there is a data processing issue then it is with the individual’s use of whichever service they pick. But underlying both these things are two questions: first, unless the link is being embedded in a user comment on someone else’s website, then the individual using the link or widget is putting it on a website they control. As webmaster (or at least content contributor), they have to take responsibility for the code. As you mention GDPR, then that person is also legally responsible for what PI they publish there, so if they put someone else’s PI (knowingly or not) then they are the one that is potentially in breach. This leads to another question, which is what proportion of people are using this in an individual capacity (i.e. it is their personal number) and how much is for business use? I suspect the majority is for business use, and in that case then why would you be hiding your contact number? The article talks about identity fraud, but if you’re a business then all the information cited should be public domain anyway, and discoverable. And similarly from a legal perspective, posting a contact link that is obscured could be contrary to the Disability Discrimination Act. I wouldn’t generally defend WA or any part of the social media commercialisation of privacy, but as many others have said, I don’t believe this is a Whatsapp issue. If there are genuine cases where private information is being leaked, then it points to people either lacking competence or failing to take responsibility for their own actions.
ldjb 6y ago
In fact, Click to Chat links are not QR codes but URLs that are manually constructed from a phone number. https://faq.whatsapp.com/general/chats/how-to-use-click-to-chat/ https://faq.whatsapp.com/general/chats/how-to-use-click-to-c... Of course, you can generate a QR code from this URL using third-party tools, which I think is what's happening here. Click to Chat's stated purpose is to allow you to chat to someone whose phone number you know, but you don't want to add them to your address book. Clearly, some people are using it for a different purpose – to make it easier for other people to send them WhatsApp message. Maybe WhatsApp should be clearer about the dangers of sharing a URL containing your phone number, but it seems like a useful feature when used for their intended purpose.
- NicoJuicy 6y ago
  You can just check if someone has WhatsApp by going to wa.me/+(countrycode)(number)

twhitmore 6y ago

It's definitely a mistake of WhatsApp to expose the number in clear text in the URL. Private user data, personal identifiers or contact details should never be used as the primary key publicly. A meaningless surrogate key should be used. If people then want to go thru and scan the QR code or whatever to contact them and gain access to the phone number, that's fine, but it absolutely shouldn't be exposed where Google is indexing it unless there was a specific intent and agreement -- on the part of both those users & WhatsApp -- that they wanted their phone number published & indexed on Google. Because explicit permission comes first. Both morally, and for GDPR

njb311 6y ago
I wasn’t aware of the click to chat function, so I checked it out. On the Whatsapp website it gives clear instructions on how to place the link on your website. It’s a hyperlink that couldn’t be more obvious that your Whatsapp number is in clear text (and will show if you hover over the link, even if it isn’t visible as such). So on the face of it you are publishing your own personal information to the web, it’s obvious it will be visible to search bots, and there is no GDPR issue assuming you are using your own number. The article and Many comments refer to a QR code/widget. This does not appear to be provided by Whatsapp – there was nothing came up on the Whatsapp website and search results were all for third party services. The article also notes that you have to go to a third party for the QR code. I just quickly made a QR code for my Whatsapp and there was no alt text for the image or other metadata. So if there is a data processing issue then it is with the individual’s use of whichever service they pick. But underlying both these things are two questions: first, unless the link is being embedded in a user comment on someone else’s website, then the individual using the link or widget is putting it on a website they control. As webmaster (or at least content contributor), they have to take responsibility for the code. As you mention GDPR, then that person is also legally responsible for what PI they publish there, so if they put someone else’s PI (knowingly or not) then they are the one that is potentially in breach. This leads to another question, which is what proportion of people are using this in an individual capacity (i.e. it is their personal number) and how much is for business use? I suspect the majority is for business use, and in that case then why would you be hiding your contact number? The article talks about identity fraud, but if you’re a business then all the information cited should be public domain anyway, and discoverable. And similarly from a legal perspective, posting a contact link that is obscured could be contrary to the Disability Discrimination Act. I wouldn’t generally defend WA or any part of the social media commercialisation of privacy, but as many others have said, I don’t believe this is a Whatsapp issue. If there are genuine cases where private information is being leaked, then it points to people either lacking competence or failing to take responsibility for their own actions.

ldjb 6y ago

In fact, Click to Chat links are not QR codes but URLs that are manually constructed from a phone number. https://faq.whatsapp.com/general/chats/how-to-use-click-to-chat/ https://faq.whatsapp.com/general/chats/how-to-use-click-to-c... Of course, you can generate a QR code from this URL using third-party tools, which I think is what's happening here. Click to Chat's stated purpose is to allow you to chat to someone whose phone number you know, but you don't want to add them to your address book. Clearly, some people are using it for a different purpose – to make it easier for other people to send them WhatsApp message. Maybe WhatsApp should be clearer about the dangers of sharing a URL containing your phone number, but it seems like a useful feature when used for their intended purpose.

NicoJuicy 6y ago
You can just check if someone has WhatsApp by going to wa.me/+(countrycode)(number)