One WhatsApp Call Can Give Away Your City

In November 2023, WhatsApp’s engineers explained a trade-off most people never think about when they answer a call. To get the best sound and picture, calling apps usually connect two phones directly, which means, they wrote, that “the IP addresses are visible to both callers on a 1:1 call”. And an IP address can carry “broad geographical location or internet provider”.

Their answer was a switch called Protect IP address in calls, which Meta describes as optional: nothing changes until you turn it on. A few weeks earlier, TechCrunch had shown why it matters. A security researcher called a newly created Telegram account that had saved him as a contact, and shortly afterwards sent TechCrunch the IP address of the computer it was running on.

Without the switch, WhatsApp picks the route for you. The company told TechCrunch in 2023 that it moves between direct and relayed calls automatically, depending on latency and which gives better quality. Group calls already go through its servers, according to WhatsApp’s help centre as reported by BleepingComputer. The exposure sits in one-to-one calls, including calls from people you barely know.

Relaying hides your address from the other person, not from WhatsApp, whose servers then carry the whole call. Cooper Quintin, a security researcher at the Electronic Frontier Foundation, told TechCrunch there is no perfect design: either callers reveal their IP addresses to each other, or an app’s relay servers end up holding a list of who is calling whom.

MaxMind, a company that sells IP location data, adds two caveats. Mobile networks can spread one address across a large area, so a lookup may stop at the region. And behind a VPN, the lookup finds the VPN server, not the person using it.

So a call will not lead anyone to your door, but it can still matter. Runa Sandvik, a digital security expert who works with people at risk, says an exposed IP address can still be a risk, especially for victims of abuse, TechCrunch reported. For someone hiding from an ex, “somewhere in this country” and “this town” are very different answers.

1. Step 1Open the advanced privacy settingsIn WhatsApp, go to Settings > Privacy > Advanced. On iPhone, Settings may appear as You, Tech Advisor noted in February 2026.
2. Step 2Switch on Protect IP address in callsFrom then on, your calls are relayed through WhatsApp’s servers, and the other person sees a server address instead of yours. Trusted Reviews notes that call quality may drop as a result.
3. Step 3Switch on Disable link previewsIt sits in the same menu. When you send a link, WhatsApp fetches a preview from your phone, which shows the website your IP address. With previews off, the site only sees you if you tap the link.
4. Step 4Or use Strict account settingsLaunched in January 2026 for people at higher risk, it turns on several protections at once. TechCrunch reported that it switches off link previews, silences calls from unknown numbers and limits your profile photo, About and last seen to contacts.

Menus move and settings get renamed, so treat the paths as a guide and look for the words relay, peer-to-peer or IP address. The trade-off is the same everywhere. Telegram’s spokesperson told TechCrunch that direct calls between contacts give better quality and lower latency, and that the downside is that both sides must know each other’s IP address.

The document route catches people out. A picture sent the normal way is compressed and loses its metadata, while the same file attached as a document arrives untouched. Which apps strip EXIF data explains why, and removing the location yourself takes a minute.

Live location is the one leak you choose. WhatsApp shares it with one chat, for as long as you pick, and you can stop at any time, the company says. Snapchat’s map goes further, showing friends your battery level and when you get home, as who can see your location on Snapchat explains.

Profile photos are more public than most people think. When University of Vienna researchers checked 3.5 billion WhatsApp accounts in 2025, they could see a public profile picture for about 57% of them and an About text for at least 29%. WhatsApp has since added rate limits and stricter visibility rules for profile information, SBA Research says. What the photo shows is another matter: one selfie can reveal where you live through a house number or a window view.

The study, Careless Whisper, came from the University of Vienna and SBA Research and won the best paper award at the RAID 2025 security conference. The trick is a reaction to a message that does not exist. The target’s phone sends back a delivery receipt but shows nothing, and the timing of a steady stream of such receipts sketches the person’s day.

In one test, a volunteer switched off their home computer at 19:28 and set off for the office. The receipts showed the phone moving from Wi-Fi to mobile data, then back to Wi-Fi at 19:45, when the volunteer reached work and a work laptop came online. The paper’s conclusion is blunt: an attacker needs only the target’s phone number.

The team reported the flaw to Meta and Signal in September 2024. In December 2025, CyberInsider reported that neither had fixed it at the protocol level and that a public tool built on the method had appeared on GitHub. Signal’s stricter rate limits reduce the battery and data drain; WhatsApp had no such limits. The best defence CyberInsider suggests is Block unknown account messages, under Settings > Privacy > Advanced, which blocks high volumes of messages from unknown accounts, though slower probing may still get through.

Test a copy with the location data removed (a screenshot works) so the estimate rests on what the camera saw. On geospys.com, photo analysis comes with GeoSpy Premium, a subscription of 7.99 US dollars a week or 29.99 US dollars a year, unlimited within fair use, which you can cancel at any time. It estimates a city and country, never an address, and uploaded photos are not stored. The GeoSpy iPhone app has a free trial.

1. Check linked devices. Refuge’s WhatsApp safety guide suggests reviewing the list of devices that can access your account and logging out any you don’t recognise.
2. Review who sees what. Refuge suggests limiting Last seen, Profile photo and About to My contacts or Nobody, adjusting who sees your status, and setting live location to None.
3. Hide your IP address. Turn on Protect IP address in calls and Disable link previews, or Strict account settings to switch on a bundle of protections at once.
4. Think about safety first. Refuge cautions that some steps can be unsafe if you live with the person harming you. In the UK, the National Domestic Abuse Helpline is free on 0808 2000 247; in the US, the National Domestic Violence Hotline is on 1-800-799-7233.