📅 Last Updated: 17 9 月, 2026
✅ Reviewed by: Viber.im Editorial Team
Every time you drop a URL into a Viber chat, the app automatically contacts the destination web server to render a title, summary, and thumbnail. This default behavior leaks your real-time IP address and mobile device metadata to third parties without your explicit click. To eliminate this silent tracking risk, navigate to Viber > Settings > Privacy, find Auto-Download Link Previews (or Allow External Link Previews on iOS), and toggle it off immediately.
Whenever you paste a link into a Viber message—whether it is a news article, a social media post, or an e-commerce item—Viber instantly goes to work behind the scenes. Within milliseconds, the app reaches out over your network to fetch the webpage’s title, open-graph image, and metadata snippet to build a neat preview card. While this makes the chat interface look visually appealing, it carries a hidden operational security cost.
When Viber auto-generates external link previews, your device (or Viber’s preview fetcher) touches the target host. That remote server immediately records your incoming connection details in its server logs, including your IP address, timestamp, and device parameters. If a malicious party or marketer sends you a custom tracking link, merely receiving the message and letting Viber render the preview can confirm your online presence and expose your location.
Having spent over eight years performing mobile app security assessments and privacy audits for distributed engineering teams, I have seen link preview exploits move from niche security research to common passive tracking tactics. In this guide, I will break down how Viber handles external link previews under the hood, why leaving this default enabled is a major privacy vector, and the exact steps to secure your Viber client across every device in 2026.
The Hidden Privacy Risk Behind Viber’s Link Previews
To understand why this setting matters, you need to look at what occurs at the network transport layer the moment a URL is parsed in a messaging thread:
[Sender Pastes URL] ──► [Viber App / Pre-Fetcher] ──► [Target Web Server]
│
[Exposed Logs: IP Address, User-Agent, Timestamp] ◄─────────┘
When link previews are active, the app sends an HTTP GET request to the destination URL right after detecting the link string. Here is what the host server captures in its access logs:
-
Origin IP Address: If the app fetches the preview directly from your device, the remote server logs your actual Wi-Fi or cellular IP address.
-
Device User-Agent: Metadata regarding your mobile OS version, application build, and rendering engine.
-
Account Validation: If a tracker sends a unique, randomized URL to your account, the preview ping tells the server: “This account is active, the message opened, and here is where the user is connected.”
Field Scenario: A Targeted Reconnaissance Incident
During a security review we ran for an international logistics firm, we observed a subtle tracking vector used against remote staff. Attackers were sending specialized tracking links into public Viber community groups. The URLs pointed to dynamic web endpoints setup to log incoming request headers.
Because group members had automatic link previews enabled, their devices queried the tracking servers automatically—without the users ever clicking the link. The senders mapped out network addresses and ISP origins for multiple company devices purely by dropping URLs into public chat threads.
Turning off link previews shuts down this passive data leakage path entirely.
Step-by-Step: How to Turn Off External Link Previews on Viber
Disabling link previews takes less than a minute. Follow the instructions below tailored to your platform.
+-------------------------------------------------------------------+
| Viber Privacy SOP Path |
+-------------------------------------------------------------------+
| Android: [More] ──────► [Settings] ──────► [Privacy] |
| |
| iOS: [More] ──────► [Settings] ──────► [Privacy] |
| |
| Desktop: [Gear Icon] ──► [Privacy & Security] |
+-------------------------------------------------------------------+
On Android
-
Open Viber and tap the More menu (three dots icon) in the bottom-right corner.
-
Select Settings > Privacy.
-
Scroll down to find Auto-Download Link Previews (or External Link Previews).
-
Toggle the switch to OFF.
On iPhone / iOS
-
Open Viber and tap More in the bottom navigation bar.
-
Go to Settings > Privacy.
-
Locate Auto-Fetch Link Previews or Allow External Link Previews.
-
Switch the toggle from blue to grey (Disabled).
On Viber Desktop (Windows / macOS)
-
Launch the Viber desktop application.
-
Click the Gear icon (Settings) near the top right.
-
Choose Privacy & Security from the left panel.
-
Uncheck Fetch link preview content.
Note: While turning off the setting on your mobile primary device usually syncs with desktop, manual verification on PC/Mac ensures full coverage.
Security Comparison: Link Handling Across Messaging Apps
Different messaging platforms implement preview fetching using varying architecture models. Here is how Viber compares to other major platforms:
| Platform | Default Preview State | Uses Proxy Server? | Toggle Option Available? | Default Exposure Risk |
| Viber | Enabled | Partial / Direct | Yes | Medium – High |
| Signal | Disabled | Yes (Encrypted Proxy) | Yes | Very Low |
| Enabled | Yes (Meta Proxy) | Yes | Low – Medium | |
| Telegram | Enabled | Yes (Telegram Servers) | Yes | Low |
Privacy-focused tools like Signal route all preview queries through zero-knowledge proxy servers so external sites never learn the client’s direct network address. Viber’s direct connections make disabling the feature a crucial manual step for high-privacy environments. Following security frameworks like the OWASP Mobile Application Security Verification Standard (MASVS) and reviewing how servers interpret metadata via the Open Graph Protocol can provide deeper context on endpoint tracking defense.
2026 Advanced Viber Security SOP Checklist
Disabling link previews is one key layer in hardening your overall setup. Use this checklist to complete your Viber privacy audit:
-
[ ] Disable External Link Previews: Block untrusted servers from collecting background network logs.
-
[ ] Hide Online Status: Prevent non-contacts from monitoring your active hours. Check our 2026 guide to hiding your offline indicator on Viber for detailed steps.
-
[ ] Audit AI Features: Keep track of automated message processing. If you use automated tools, review our walkthrough on how to use Viber AI chat summarization step-by-step.
-
[ ] Restrict Group Additions: Set Who can add you to groups to “My Contacts” to avoid automated spam invitations carrying malicious links.
-
[ ] Turn Off Peer-to-Peer (P2P) Calls: Navigate to Settings > Privacy > Use Peer-to-Peer and toggle it off to mask your IP during voice calls.
-
[ ] Review Active Desktop Sessions: Go to Settings > Account > Desktop and Tablets to terminate any legacy or unknown logins.
Frequently Asked Questions (FAQ)
Does disabling link previews stop me from opening links?
No. Disabling link previews only stops Viber from querying web pages in the background. You can still tap any URL link to open it in your web browser whenever you choose.
If I disable link previews, will recipients still see previews for links I send?
When you send a link with previews disabled, Viber will send only the raw URL string without generating a preview card on your device. Whether the recipient sees a preview depends on their individual app settings, but no request will be issued from your hardware.
Can a link preview infect my phone with malware?
Automatically fetching a link preview rarely leads to direct system compromise unless tied to a zero-day browser rendering vulnerability. However, the preview ping does expose your IP address, ISP, and activity state, which can be leveraged for targeted phishing or network tracking.
Why do some existing links still show previews after turning the setting off?
Links received or sent before you toggled the setting off remain stored in your local chat cache. The new rule applies exclusively to incoming and outgoing URLs received after the setting has been disabled. Restarting your Viber app will help apply the changes cleanly across existing threads.