When the messaging service WhatsApp announced last month that it was starting to share some of its users’ online information with Facebook, its parent company, many users expressed anger that their digital privacy could be at risk.
Now, a German regulator thinks so, too.
The city of Hamburg’s data protection commissioner ordered Facebook on Tuesday to stop collecting and storing data on WhatsApp users in Germany, the first time a privacy watchdog has waded into the debate. The regulator also called on the social network to delete all information already forwarded from WhatsApp on roughly 35 million German users.
“It has to be their decision, whether they want to connect their account with Facebook,” Johannes Caspar, the Hamburg data protection commissioner, said in a statement. “Therefore, Facebook has to ask for their permission in advance. This has not happened.”
Facebook said on Tuesday, after the order had been issued, that it had complied with Europe’s privacy rules and that it was willing to work with the regulator to address its concerns. The Hamburg regulator has authority over Facebook’s activities in Germany because the company’s German subsidiary is based in the city.
The privacy pushback comes as WhatsApp, which was acquired by Facebook in 2014 for $19 billion, is trying to forge closer links with the social network and to look for new ways to generate revenue from its more than one billion users worldwide.
As part of its proposed overhaul, WhatsApp said it would start disclosing the phone numbers and analytics data of its users to Facebook. WhatsApp also has plans to allow businesses to contact customers directly through its platform. A similar strategy is being tested on Facebook Messenger, a separate messaging service Facebook owns.
While WhatsApp has framed the changes as a way to give people a better service, not everyone is convinced. A day after the announcement, the British privacy regulator said that it was looking into the changes.
More than any other region, Europe has pushed back against American technology giants’ use of people’s digital information, routinely forcing companies like Google and Facebook to change their policies after they breached the European Union’s tough data protection rules.
In its decision on Tuesday, which would affect only WhatsApp users in Germany, the Hamburg regulator said that neither the internet messenger nor Facebook had received individuals’ permission to share the information and had potentially misled people over how their data would be used in the future.
The watchdog added that millions of people whose contact details had been uploaded to WhatsApp could now have that information shared with Facebook against their will, which would infringe German law.
“Facebook’s answer, that this has merely not been done for the time being, is cause for concern that the gravity of the data protection breach” will have a more severe impact, Mr. Caspar said.
