Rhys MorganWhatsApp rolled out one of its most significant privacy updates in its twelve-year history on 29 June 2026: usernames. For the first time, the 2.5 billion users of the Meta-owned platform can communicate without sharing their phone number — a change that arrives just ten days after the UK's Data (Use and Access) Act 2026 received Royal Assent, reshaping how businesses must handle personal contact data.
What WhatsApp Usernames Actually Do
Until now, every WhatsApp conversation required both parties to exchange mobile numbers. The new username feature breaks that dependency. Once enabled, a sender can initiate contact using a unique handle — for example @jane.smith.london — and the recipient's phone number never becomes visible to the other party.
Meta says the rollout will be gradual, with users receiving an in-app notification once the feature is available on their account. Early access to username reservation is already live in Settings > Account > Username for users who have updated to the latest version of the app. Usernames must be between 3 and 35 characters, contain at least one letter, and may only use lowercase letters, numbers, periods, and underscores.
WhatsApp has also introduced an optional "username key" — a secondary verification layer that forces any new contact to know both the username and a unique numeric code before their first message can be sent. This zero-discovery design means there is no searchable directory; someone must already know your exact handle to reach you.
Why This Matters More in the UK Right Now
The timing of WhatsApp's launch is not accidental. In the UK, the Data (Use and Access) Act 2026 received Royal Assent on 19 June 2026, updating significant parts of the UK GDPR framework and the Data Protection Act 2018. Among its provisions: tighter requirements around the lawful basis for sharing personal contact data — which includes mobile phone numbers.
For individuals, the implications are straightforward. A WhatsApp username means your number stays private even when giving your contact details to people you do not fully trust — marketplace buyers, new colleagues, tradespeople, or online acquaintances.
For businesses, the stakes are considerably higher. The Information Commissioner's Office (ICO) has already issued reprimands to UK organisations that used WhatsApp carelessly, including a healthcare business where staff shared patient data across WhatsApp groups more than 500 times. Under the Data Act, enforcement windows have been tightened, and fines under UK GDPR remain at up to £17.5 million or 4% of global annual turnover, whichever is higher.
The Business Compliance Gap
Thousands of UK small businesses routinely use WhatsApp for customer communication — plumbers sending appointment confirmations, estate agents arranging viewings, tutors coordinating schedules. Until now, every one of those exchanges exposed the business owner's personal mobile number to a customer list of indefinite size.
WhatsApp's username rollout creates a compliance opportunity that many businesses have not yet noticed. If a sole trader switches to a username-based contact system, they can separate personal from professional communications at the application layer — a basic step that UK GDPR's "data minimisation" principle has always required but that most small operators never implemented in practice.
The question is not simply whether to use usernames — it is how to restructure your WhatsApp setup to align with your business's lawful basis for data processing. That includes updating privacy notices to reflect that phone numbers are no longer collected during first contact, and documenting the change in your records of processing activities (RoPA).
What the Feature Does Not Cover
WhatsApp usernames solve the phone number visibility problem, but they do not eliminate all data risks. The platform still processes metadata — who messaged whom, when, and from which IP address — under Meta's privacy policy. End-to-end encryption protects message content, but messages stored in cloud backups (Google Drive or iCloud) may not carry the same protection unless encrypted backup is explicitly enabled separately.
A properly configured WhatsApp setup for a UK business in 2026 therefore involves at least four steps: enabling a username, activating the username key, enabling end-to-end encrypted cloud backups, and reviewing whether WhatsApp is the appropriate channel for the data type being discussed. Financial details, medical information, or legal matters warrant dedicated secure channels rather than a consumer messaging app.
When an IT Consultant Can Help
For individuals, the Settings > Account > Username path is clear enough. For businesses managing multiple staff on a WhatsApp Business account, or operating WhatsApp-integrated CRM systems, the configuration is significantly more complex. IT consultants and data privacy specialists are increasingly advising UK clients to audit their messaging stack as part of broader GDPR compliance reviews — a process the new Data Act makes more urgent.
An IT expert can map how WhatsApp sits within a company's existing data flows, identify whether automated messages sent through WhatsApp's API trigger notification obligations under the Data Act, and configure device management policies to ensure company-issued phones enforce the username key setting by default across the organisation.
According to the ICO's guidance on data protection by design and by default, organisations are required to implement technical and organisational measures that ensure only personal data necessary for each specific purpose is processed. Switching to WhatsApp usernames — and formally documenting the switch — is one of the simplest demonstrations of that principle that any business can make right now.
Reserving Your Username Before the Rush
WhatsApp opened early reservations because availability will be first-come, first-served once the feature launches globally. Businesses with common trading names are already finding preferred handles taken. Securing a username now, before the wider rollout triggers mainstream adoption, is the one time-sensitive action any user can take today.
To check availability: update WhatsApp to the latest version, navigate to Settings > Account > Username, and enter your preferred handle. The app confirms availability in real time. If your preferred name is taken, variations with an underscore or full stop remain an option — and an IT consultant can advise on naming conventions that align with your brand's wider digital identity.
The WhatsApp username rollout is the most consequential change to how UK users share contact data in years. Configuring it correctly — and understanding what it does and does not protect — is a task worth a conversation with an IT expert.
