It's not about WhatsApp. Every app that is closed source and close servers can do the same. Even those who claim they are private. Including Signal themselves. 

 I know  .. but whatAp is  double a whammy  .. it is closed source evil :-)  

 Signal leaks metadata and group membership