This is the question people most want answered and most hesitate to ask. It deserves a straight answer rather than reassurance.
The two halves
The leader is bound by law. A licensed clinician running a group has the same confidentiality obligations they have with any client, with the same familiar exceptions — imminent danger to yourself or someone else, abuse of a child or dependent adult, and a court order.
The other members are bound by agreement. Not by law. They agree to confidentiality as a condition of joining, it’s taken seriously, and it’s an agreement rather than a statute.
That’s the real answer, and any group leader who tells you otherwise is overselling.
What that means in practice
Breaches are uncommon and they aren’t unknown. What’s far more common is something smaller and more ordinary: someone mentioning to a partner that a person in their group is going through something similar, without a name attached.
Good groups handle this by being specific rather than general. The usual rule is that you may talk about your own experience of the group freely, and about anything anyone else said not at all. Not their story with the name removed. Not a summary. Nothing.
Well-run groups revisit this rather than stating it once in week one.
The legal wrinkle worth knowing
In individual therapy, what you say is protected by therapist–client privilege. In some jurisdictions the presence of third parties complicates that protection.
For nearly everyone this is theoretical. It’s worth knowing if you’re involved in litigation, a custody matter, or anything where your treatment records might be subpoenaed — and if you are, say so at the screening. A leader will tell you plainly how it works where they practise.
Online specifics
The format adds its own questions, and the answers are practical.
Recording is prohibited in every properly run group, and leaders say so explicitly.
Who else is in your room is the one people underestimate. A partner in the next room hearing one side of a group session is a real breach of eight other people’s confidentiality, not just your own privacy. Headphones aren’t optional.
First names only in most groups, and screen names set accordingly.
What to do about the residual risk
Two things, and they’re the same things experienced group members do.
Disclose at your own pace. You aren’t obliged to bring the most sensitive thing in week one, or ever. Groups work perfectly well on material you’re comfortable having eight people hold.
Raise it if something happens. A suspected breach belongs in the room. It’s uncomfortable and it’s precisely the kind of thing a group is for, and leaders would far rather hear it than have someone quietly disappear.
If you recognise someone in the group, that’s a separate and more common situation with a specific answer.