Paste a link into a KakaoTalk chat — the messenger nearly everyone in Korea uses — and a preview card appears a second later. Something already fetched that URL, and only two machines could have: your own phone or the platform's servers. We went looking in our own server logs and caught both, because which one your app uses quietly changes what sharing a link costs you.
Some apps fetch from your phone
Open a link in iMessage or WhatsApp and your own phone makes the request. The website on the other end sees your IP address and the rough location behind it; the messaging company may never see the link. Viber behaved the same way in Mysk's 2020 testing.
In seven weeks of pankeit.com logs, three preview fetches carried WhatsApp's own user agent, from a residential Korea Telecom address — one person's phone, telling our server where their connection sits:
User-Agent: WhatsApp/2.23.20.0
Source: Korea Telecom (residential)
Some apps fetch from their servers
KakaoTalk, Messenger, Instagram, Slack, X, and Discord work the other way: their own servers fetch the link. Your IP stays hidden from the destination, but the platform now sees every URL you send. Kakao documents this — its servers scrape the page's Open Graph tags to build the card (Kakao Developers).
Same log, other column. Four fetches carried Kakao's scraper agent, and they came from Kakao Corp's own network:
User-Agent: facebookexternalhit/1.1; kakaotalk-scrap/1.0
Source: Kakao Corp
Korea has already seen where that leads. In December 2016 the 방송통신위원회 (Korea Communications Commission) fined Kakao ₩342 million — a penalty that also covered separate business-messaging conduct — for not telling users that URLs typed into KakaoTalk chats were fed to Daum's search service. The regulator never used the word "preview"; Kakao supplied that link itself, saying it had, since January 2016, fed addresses "collected for KakaoTalk's URL preview" into Daum web search (오마이뉴스). Kakao held that the URLs contained no personal information, and stopped the day a reporter demonstrated it. The finding was about disclosure and consent, not a ruling that previews are unlawful.
Encryption does not decide which
An end-to-end encrypted app does not automatically keep your links private. LINE is end-to-end encrypted and still generates previews on its servers — the same column as KakaoTalk. (LINE used to leak the sender's IP while doing it; Mysk recorded the fix as of Android 10.18.0 and iOS 10.16.1.) Signal is also end-to-end encrypted and takes the opposite route: it builds the preview on your device and sends the fetch through a proxy.
Signal: "The Signal app establishes a TCP connection through a privacy-enhancing proxy that obscures IP addresses from the site that is being previewed. A TLS session is negotiated directly between the app and the previewed site through the proxy to ensure that the Signal service never has access to the URL."
The TLS session runs to the site through that proxy, so the site never learns who asked and Signal never learns what was asked for. Whether your link stays private is a design decision each vendor made, and the encryption on your messages tells you nothing about which one they chose.
Know which one before you share
- Learn your app's column, not just whether it's encrypted. Phone-fetch apps like iMessage and WhatsApp expose your IP; server-fetch apps like KakaoTalk and Messenger expose your links to the platform. Encryption settles neither.
- For a sensitive or suspicious link, turn previews off first. Most messengers let you disable link previews in settings; that stops the fetch before it starts.
- In an incident, treat a preview as a live call to the attacker. Pasting an attacker-controlled URL into a chat can ping their server and warn them they have been found. We walked through that trap in who fetches your link, and the per-app behaviour behind your shared photos follows the same shape.
Open your own messenger's settings right now: does it fetch previews from your phone or from its servers — and did you know which before today?
References
- Mysk, "Link Previews: How a Simple Feature Can Have Privacy and Security Risks" (2020) — https://mysk.blog/2020/10/25/link-previews/
- Signal, "I link, therefore I am" — https://signal.org/blog/i-link-therefore-i-am/
- Kakao Developers, KakaoTalk Share FAQ (the scrap server fetches the URL) — https://developers.kakao.com/docs/en/kakaotalk-share/faq
- 방송통신위원회, "방통위, ㈜카카오의 '알림톡' 및 URL 수집·이용 관련 위반행위에 3억 4,200만원 과징금 부과" (73rd commission meeting, 2016-12-26) — https://kcc.go.kr/user.do?boardId=1113&boardSeq=44252&cp=14&dc=&mode=view&page=A05030000
- 오마이뉴스, "'카톡 URL 노출' 6일 만에 사과, 풀리지 않는 의문들" (2016) — http://www.ohmynews.com/NWS_Web/View/at_pg.aspx?CNTN_CD=A0002214798
Instagram