WhatsApp Developing Four-Tier Phone Number Privacy for Usernames

November 7, 2026 Dr. Michael Lee – Health Editor Health

WhatsApp Phone Number Visibility Controls

WhatsApp is developing a four-tier visibility system for user telephone numbers that defaults to hiding the number entirely when a username is set, borncity.com reported. The system requires users to register their accounts using a phone number, but introduces tiered options—Everyone, My Contacts, My Contacts Except, and Nobody—once a username is established. If a user sets up a username, the privacy setting automatically switches to Nobody.

The Tech TL;DR:

  • WhatsApp is introducing a four-tier visibility system (Everyone, My Contacts, My Contacts Except, Nobody) to protect user phone numbers behind custom usernames.
  • Setting up a username automatically defaults phone number visibility to Nobody, though contacts who already have the number saved will continue to see it.
  • Government regulators have requested detailed security explanations from parent company Meta within three days regarding potential risks for identity theft and account abuse.

Feature Establishes Explicit Boundaries for Personal Identifiers

The upcoming feature establishes explicit boundaries for how personal identifiers appear within the application. While the software permits usernames between 3 and 35 characters long, existing contacts who already possess a user’s phone number retain visibility of that number regardless of the strictest privacy setting applied. The application triggers a warning prompt when users alter these settings, notifying them that any previously configured exception list will reset.

Usernames remain absent from any central public directory, and the platform generates no suggestions for unfamiliar accounts. Initiating contact requires knowing the exact username of the recipient, though an optional four-digit username key can be implemented for first-time interactions. The rollout is scheduled to occur gradually over the coming months, allowing early testers to reserve names through account settings—including existing profiles from Facebook or Instagram—while forcing businesses and individuals to actively manage and distribute their exact alphanumeric identifiers.

Regulatory Inquiries Into Identity Risks

Government authorities have initiated formal scrutiny over the architectural implications of the update. An official regulatory body issued a formal notice requiring parent company Meta to provide a detailed explanation of the system’s operational mechanics and implemented security controls within a three-day window. The official inquiry stems from concerns that transitioning identifiers to a username-based lookup model could expand the attack surface for bad actors, potentially elevating risks associated with identity theft, financial fraud, and unauthorized account takeovers.

Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.

Related reading