7 WhatsApp Privacy Settings You Should Change Right Now

WhatsApp's default settings expose more than most people realize — here's what to change.

If you've never opened WhatsApp's Privacy menu on purpose, there's a good chance strangers can see your profile picture, your online status, and — during calls — even your approximate location through your IP address. None of that requires a hack. It's just what WhatsApp ships with out of the box.

I went through every privacy-related toggle in the app on both Android and iPhone, changed the ones that actually mattered, and left the rest alone. It took under ten minutes. Below is exactly what I changed, why each setting matters, and — just as important — what you give up when you turn it on, because every one of these has a trade-off nobody mentions.

I'm Mostafa Amaan, and on Valley4Techs I write practical guides on security, privacy, and everyday tech problems. Let's go setting by setting.

Quick Reference: Every Setting Covered in This Guide

Before the deep dive, here's the full list at a glance. All of these live under Settings → Privacy unless noted otherwise.

Your Calls and Links Could Be Leaking Your IP Address

Most people assume WhatsApp calls are just as private as WhatsApp messages, since both are end-to-end encrypted. What that assumption misses is that voice and video calls are, by default, a peer-to-peer connection — your device connects directly to the other person's device rather than routing through a server in between. That direct connection is efficient, but it also means your IP address is reachable by anyone on the other end with basic network-analysis tools.

An exposed IP address on its own won't reveal your home address, but it can be used to estimate your general location, identify your ISP, and — in the worst case — be targeted with a DDoS attack that floods your connection until you're knocked offline. It's a low-probability risk for most people, but a real one if you've ever called someone you don't fully trust. (If you're concerned about IP tracking beyond WhatsApp, consider reading our VPN vs Proxy complete guide).

Fix 1: Protect IP Address in Calls

This setting forces every call through WhatsApp's own servers instead of a direct connection, which hides your IP from the other party entirely.

Routing calls through WhatsApp servers prevents your IP address from being exposed to the other party.

From my own testing, the quality drop is noticeable mainly on video calls over a weak connection — audio calls held up fine. Since the routing goes through an extra hop, you're trading a small amount of call quality for a meaningful privacy gain. I leave it on permanently and only notice it on already-shaky Wi-Fi.

Fix 2: Disable Link Previews

Every time you send a link in a chat, your phone has to briefly connect to that website to pull the thumbnail, title, and description you see in the preview card. That connection request comes from your IP address, which means the site owner (or anyone monitoring that site) can, in theory, log it — even if you never actually tap the link.

To turn it off, go back to Settings → Privacy → Advanced and enable Disable link previews. The only downside is that links you send will show up as plain text URLs instead of a preview card, which makes them slightly less informative for the person receiving them. If you frequently share suspicious-looking links, it's also worth reading our guide on how to check a suspicious link before you click it.

Disabling link previews prevents third-party websites from logging your IP address when you send a link.

Your Profile Picture Is an Open Door by Default

Here's something that surprises a lot of people: by default, anyone who has your phone number saved can see your profile picture, even if you've never saved theirs and have no idea who they are. If your number has ever ended up in a work group, a school chat, or a seller's contact list, that's a lot of unknown people with a clear view of your face.

WhatsApp lets you restrict this down to just your contacts — and you can go a step further and exclude specific people even within that list, which is useful if you have a contact you'd rather keep at arm's length without blocking them outright.

Setting your Profile Photo visibility to 'My Contacts' prevents strangers from saving or viewing your picture.

WhatsApp also blocks other people from taking a screenshot of your profile picture once it's set to contacts-only, which closes off one more way your photo could end up circulating somewhere you never intended. I set mine to My Contacts Except and excluded a handful of numbers I no longer talk to but haven't gotten around to deleting — a small compromise between privacy and convenience.

Your Phone Number Is More Exposed Than You Think

WhatsApp is built around your phone number instead of an email or a username, which is convenient for onboarding but terrible for privacy over time. Years of joining school groups, work communities, and delivery or seller chats mean your number has quietly spread to people who have no real reason to have it.

Set a Username to Hide Your Number

WhatsApp has been rolling out a username feature that lets people find and message you without ever seeing your actual number. It doesn't remove your number from chats you're already in, but it stops new or unknown contacts from seeing it going forward. This feature is being released gradually, so if you don't see the option yet under Settings → Profile, it likely hasn't reached your account or region yet.

Usernames allow you to share your contact info without revealing your actual phone number to strangers.

Control Who Can Add You to Groups

This is the setting most guides skip entirely, and it's one of the most useful ones. By default, anyone with your number can add you straight into a group without asking — which is exactly how numbers end up in random marketing or reseller catalog groups in the first place.

Between the username feature and this group setting, the amount of unsolicited contact I get from unknown numbers dropped noticeably within the first couple of weeks.

Turning Off Last Seen and Online Status

Last Seen and the green "online" dot feel harmless, but they create a quiet kind of social pressure — if someone can see you were online ten minutes ago and haven't replied, that silence gets noticed. Turning this off was, for me, the single most stress-reducing change in this whole list.

Disabling Last Seen removes the social pressure of having to reply immediately.

The Overlooked Essentials: Read Receipts, Status, and Spam Calls

While IP protection and locked chats are great for advanced privacy, don't forget the basics that affect your daily experience. Most people overlook these three settings, even though they solve some of the most common WhatsApp annoyances.

Turn Off Read Receipts (The Blue Ticks)

If you've ever felt pressured to reply instantly just because someone saw the double blue ticks, this is your way out. Disabling read receipts stops people from knowing exactly when you opened their message.

Turning off Read receipts prevents senders from knowing exactly when you've read their messages.

Silence Unknown Callers

Spam calls on WhatsApp have become a massive nuisance. Instead of letting every random number ring your phone, you can send them straight to the background. The call won't ring, but it will still show up in your Calls tab in case it was actually someone important.

This setting ensures spam calls won't ring your phone, but they will still be logged in your Calls tab.

Lock Down Your Status Updates

If you use WhatsApp Status (the 24-hour stories), make sure you aren't broadcasting your life to that delivery driver you saved three years ago. Go to Settings → Privacy → Status and set it to My Contacts or My Contacts Except… to filter out the noise.

Limit your Status visibility so that random acquaintances don't see your personal daily updates.

Two More Settings Worth Turning On: Locked Chats and Disappearing Messages

These two don't get nearly enough attention, and neither depends on trusting the person you're messaging — they protect you from someone who has physical access to your unlocked phone, which is a far more common scenario than a network-level attack.

Locked Chats hides a conversation from your main chat list entirely and requires a fingerprint, Face ID, or PIN to open it. Long-press any chat and select Lock Chat — locked chats move into a separate folder that only unlocks with biometric or PIN verification.

Locked Chats keep sensitive threads completely hidden behind an extra layer of biometric security.

Disappearing Messages automatically deletes messages after 24 hours, 7 days, or 90 days, which limits how much conversation history is sitting on a device if it's ever lost, stolen, or borrowed. You can set this per-chat under a contact's info screen, or set a default for all new chats under Settings → Privacy → Default Message Timer.

Disappearing Messages act as an automatic cleanup mechanism to reduce the amount of personal data saved on devices.

The Ultimate Security Bonus: App Lock and Two-Step Verification

Privacy keeps people out of your business, but security keeps hackers out of your account. These two settings blur the line, but they are absolutely non-negotiable.

App Lock (Screen Lock): Locked chats are great for specific threads, but what if you hand your unlocked phone to a friend? App Lock requires your Face ID, Touch ID, or device PIN just to open WhatsApp itself. Go to Settings → Privacy → App Lock (or Screen Lock) and enable it. This is also a crucial step in protecting your smartphone from spyware.

App Lock ensures that even if someone has physical access to your unlocked phone, they can't open WhatsApp.

Two-Step Verification (2FA): This stops anyone from stealing your WhatsApp account by registering your number on another phone. It requires a custom 6-digit PIN whenever your account is set up on a new device. Go to Settings → Account → Two-Step Verification and set it up immediately if you haven't already.

Two-Step Verification is your primary defense against account hijacking and SIM-swap attacks.

Strict Account Settings: The Nuclear Option

If you'd rather not configure every setting above individually, WhatsApp has a single switch that applies a maximum-privacy profile in one tap: Strict Account Settings. It's aimed at people who are realistically at higher risk of being targeted — public figures, journalists, activists, or anyone who has had a stalking or harassment concern — but nothing stops anyone from turning it on.

Enabling it locks in the following, all at once:

• Blocks media and file attachments from anyone not already in your contacts
• Disables link previews for every chat
• Silences calls from unknown numbers instead of ringing
• Disables Last Seen and online status

Strict Account Settings instantly apply a maximum-privacy profile, shielding you from unknown contacts.

I tested this for a week just to see what it actually feels like day to day. The most noticeable change was media from unsaved numbers arriving as a tap-to-download prompt instead of loading automatically, which is mildly inconvenient if you regularly get files from people you haven't saved yet — think delivery riders or one-off service contacts. For most people, individually turning on the specific settings above gives nearly the same protection with fewer daily annoyances. Strict Account Settings makes more sense as an all-in-one option if you know you're a higher-risk target and don't want to manage each toggle separately.

Android vs iPhone: Where These Settings Actually Live

The setting names are identical across platforms, but the menu path to get there differs slightly, and it's a common source of confusion when following a guide written for the other operating system.

Everything from here — Advanced, Profile Photo, Groups, Last Seen & Online — sits inside that same Privacy screen on both platforms, just organized under slightly different top-level menus to reach it.

Which Settings Should You Actually Turn On?

Not everyone needs to lock everything down. Here's how I'd prioritize based on who you are and how you actually use the app:

If you're often connecting from coffee shops or airports, it's also worth pairing this with good habits around public Wi-Fi safety, since the IP protections above only cover WhatsApp itself, not the rest of your traffic.

5 Mistakes People Make When Locking Down WhatsApp Privacy

1. Assuming encryption alone is enough. End-to-end encryption protects message content in transit, not your profile photo, phone number, activity status, or IP address during calls. Those are separate settings entirely.
2. Turning on Strict Account Settings without reading what it disables. It's effective, but it also mutes calls and blocks media from unsaved numbers — which can be genuinely disruptive if you regularly deal with new contacts.
3. Forgetting that Last Seen works both ways. Hiding your own activity also hides everyone else's from you, which surprises people who only wanted privacy in one direction.
4. Ignoring WhatsApp Web sessions. If you've ever logged into WhatsApp Web on a public or shared computer and forgot to log out, that session stays active until you manually revoke it from Linked Devices. Check that list periodically and remove anything you don't recognize.
5. Never checking these settings again after the first pass. WhatsApp regularly adds new privacy features — the username system and Strict Account Settings are both relatively recent. A quick check every few months catches new protections as they roll out (you can keep up with the latest WhatsApp updates and features here).

Final Thoughts

None of these changes require technical skill, and together they take less time than scrolling through your group chats. What they buy you is control: over who sees your photo, who has your number, who knows when you're online, and who can figure out roughly where you are during a call.

Start with the ones that match how you actually use the app — if you rarely call strangers, the IP protections matter less than locking down your profile photo and group settings. Go through the quick reference table above, flip the ones that apply to you, and you're done in about five minutes.

For a broader look at keeping your phone itself secure, our smartphone privacy protection guide covers the settings outside of WhatsApp that are worth checking too, and if you've ever received a screenshot that seemed off, our guide on spotting fake WhatsApp chat screenshots is worth a read as well.

Frequently Asked Questions