WhatsApp's Username Feature Sparks Privacy and Impersonation Concerns

WhatsApp’s upcoming shift from phone numbers to usernames has triggered concerns over user privacy, impersonation and deeper integration with parent Meta's broader advertising ecosystem across Facebook and Instagram. WhatsApp told ET that such fears were overblown.

The feature, expected to roll out later this year, will allow users to connect using usernames instead of sharing their phone numbers. While experts say this reduces exposure of personal phone numbers and lowers risks such as SIM-swapping and contact scraping, they warn that the move also raises fresh questions over data sharing, platform integration and identity fraud.

“Soon you will have verified username on WhatsApp, and then unverified similar-sounding usernames,” Paytm founder Vijay Shekhar Sharma posted on X.

Mobikwik chief executive Bipin Preet Singh posted, “Not a good idea at all. Will lead to proliferation of fraud and impersonation. For example, I checked, most variations of my name already taken. Wonder what can it be used for.”

WhatsApp’s move towards usernames is, at first glance, a welcome privacy enhancement, said Nikhil Narendran, partner at Trilegal and a tech policy thought leader. “It allows users to communicate without routinely exposing their mobile numbers,” he said.

Scammer Alert

Numbers “have increasingly become a universal identifier linked across multiple services,” said Narendran.

How Meta implements the feature to avoid any anti-trust challenges or data-sharing related scrutiny will need to be seen.

One of the biggest concerns is impersonation or name-squatting. For instance, several users posted that they could reserve names like @KunalShahReal, @ArnabRepublicTV and @PmNarendraModi.

Mark Zuckerberg-led Meta recently named Kunal Shah as WhatsApp’s next CEO.

Scammers could exploit lookalike usernames to impersonate brands, banks, government agencies or celebrities.

“The danger is acute on an encrypted platform because users inherently trust the identity behind the handle,” said Amit Jaju, partner and India head at New York-based Ankura Consulting Group. “A fake government or CEO account can move markets, solicit funds or spread misinformation.”

He said WhatsApp would need “active verification badges and rapid takedown protocols, not just passive reservation lists.”

Meta has not announced plans to charge businesses for usernames. Some experts said Meta may provide it to them as a premium paid service.

The move has reignited concerns that WhatsApp could become more tightly integrated into Meta's advertising ecosystem.

“The catch is that Meta’s ad model still runs on metadata,” Ankura’s Jaju said. “WhatsApp already shares account registration data, device information, IP addresses, and business-interaction patterns with Facebook and Instagram. While messages remain end-to-end encrypted, the metadata is more than enough to power targeted ads.”

WhatsApp has previously faced legal troubles in India.

In 2024, the Competition Commission of India (CCI) fined Meta Rs 213 crore and banned WhatsApp from sharing user data with other Meta apps for advertising for five years. The National Company Law Appellate Tribunal set aside the ban in November 2025, but upheld the fine. Separately, the Supreme Court of India has warned WhatsApp that continued sharing of Indian user data with Meta could trigger a complete ban, describing the practice as a “decent way of committing private data theft.”

Huzefa Tavawalla, partner at law firm Cyril Amarchand Mangaldas, said WhatsApp would have to ensure user consent is obtained "in a free, informed and fair manner" before any cross-sharing of data across Meta platforms. "Data security by design becomes paramount from a product architecture perspective," he said.

The company, however, rejected concerns that usernames would automatically lead to greater data sharing across its family of apps.

"When the feature launches later this year, usernames will not change anything about how accounts centre works," a Meta spokesperson said, adding that linking WhatsApp with Facebook or Instagram through Accounts Center would remain entirely optional.

On impersonation, the company said it has built "layered protections" into the system. Existing Facebook and Instagram usernames will be reserved for their owners during the reservation period, while usernames of public figures, celebrities, government entities and verified Meta accounts will remain protected.

Meta said it has also reserved certain lookalike derivatives and will use automated systems to detect impersonation, limit abusive account behaviour, revoke usernames and ban offending accounts.

(Catch all the Technology News News, and Latest News Updates on The Economic Times.)