If you’re under the impression that you can maintain social media accounts and still have true privacy, you’re probably going to have a bad time. Although there are ways to make sure only certain people can see your Facebook posts, tweets, and photos – social media has a knack for exposing private information in ways that you wouldn’t even imagine possible.

Of course, that is until is happens to you.

The Wall Street Journal recently ran a piece on two University of Texas students whose lives hit a speed bump when their sexuality was outed on Facebook. Nobody accessed their account surreptitiously, and the students didn’t make a late night mistake and post a telling photo or check-in. It was actually a mechanism within the Facebook platform that did it. According to Bobbi Duncan and Taylor McCormick, all it took to be outed to their families was the simple act of being added to a group.

The story goes like this: The president of a gay choir group at the University decided to make a Facebook group for the choir, titled “Queer Chorus.” As you would imagine, the president began adding members to the group shortly after creating it.

And when he added Duncan and McCormick, a story about it was published on the news feeds of their parents. Even though both students had customized their privacy settings to disallow their families from seeing certain posts, the story generated by the addition to the group found its way to unwanted news feeds.

But how did this happen? How can Facebook generate a news feed story and display it to someone who’s been excluded via privacy settings?

It’s because Facebook groups have an oftentimes annoying way of circumventing privacy settings. Let’s take a closer look at how.

First off, anyone creating a group has the option to launch it in three formats from the beginning: Open, Closed, and Secret. Here’s what Facebook has to say about Open and Closed groups in terms of privacy (emphasis mine):

Open: Anyone on Facebook can see and join the group. Open groups will appear in search results and all content that members post (ex: photos, videos and files) is visible to anyone viewing the group. Friends can see that you’ve joined an open group in their news feed.

Closed: Anyone on Facebook can see the group name, its members and people invited to join the group, but only members can see posts in the group. To join a closed group, a friend needs to add you, or you can ask to join. Your friends can see that you’ve been invited or added to a closed group in their news feed.

In order for a user to not show up on their friends’ news feeds after being added to a group, that group has to be labeled secret:

Secret: These groups cannot be found in searches, and non-members can’t see anything about the group, including its name and member list. The name of the group will not display on the timelines of members. To join a secret group, you need to be added by a member of the group.

But in the case of our two students from UT, the group creator close Open. Because of that, the news that they had been added to “Queer Choir” reached the news feeds and ultimately the eyes of people that they wished to keep that kind of information from.

The other tricky part about Facebook groups is that users cannot summarily exclude themselves from being added to groups.

“Similar to being tagged in a photo, you can only be added to a group by one of your friends. When a friend adds you to a group, a story in the group (and in news feed for Open or Closed groups) will indicate that your friend has added you to a group,” says Facebook.

“When a friend adds you to a group, you’ll get a notification right away, [and] you can leave a group anytime. To do so, just go to the group page and click “Leave Group” in the right-hand column. Once you leave a group, you can’t be added by anyone else unless you explicitly request to be re-added.”

So if you catch it quick, you can leave. But that story might still be generated and shown to unwanted eyes.

There’s also a bit of misinformation when it comes to these notifications. Just for fun, I created a new, open group that the average user probably wouldn’t want to be a part of – I called it “Incestuous meth addicts, unite!” I added a couple of people to the group, and here’s the notification they received:

Notice anything? It simply states that they’ve “been invited” to join the group. But when you go to the group page, you find that they are already members:

“Our hearts go out to these young people. Their unfortunate experience reminds us that we must continue our work to empower and educate users about our robust privacy controls,” Facebook told the WSJ.

But until users have some more control of who can add them to groups, bizarre complications like the ones experienced by our two gay students will continue to occur. If you have a secret to hide, Facebook is a dangerous place – that’s common sense. But hoping to catch a notification in order to remove yourself from any group that any friend decided to throw you into on a whim – Facebook can do better than that.