Access Control and Member Privacy in Large WhatsApp Groups: Invite-Link Exposure, Phone-Number Disclosure and Unwanted Entry

WhatsApp groups are identified by invite links and populated by accounts identified by phone numbers. These two design facts shape the security and privacy of every large group: whoever holds a link can join, and whoever joins can see the phone numbers of other members. This narrative review synthesises peer-reviewed measurement studies (on public group links, contact discovery and phone-number enumeration), WhatsApp Help Center documentation, WhatsApp community guidance, a 2026 Meta announcement on usernames and the Brazilian General Data Protection Law (LGPD). All sources were accessed and verified in October 2026. The review finds that invite links posted in public places are discoverable at scale and that joining a public group exposes members' phone numbers to anyone who joins; that large-scale phone-number enumeration on WhatsApp was demonstrated as recently as 2025, before remediation; and that platform defaults, such as allowing anyone to add a user to groups, favour reach over privacy. It then examines the access controls available to administrators (approval of new members, restricting who can share links, resetting links, keeping links off public web pages) and how automated group tooling can apply entry filters, daily limits, time-limited access and removal of inactive members. The review argues that access control is the main privacy lever available at group level, but that group administrators cannot change platform-level exposure. No original data are reported.