Date: 3 Sep 2026

Data & AI

The Future of WhatsApp Privacy: Navigating Usernames and Business Scoped User IDs (BSUIDs)

TL;DR: What Businesses Need to Know About WhatsApp Usernames and BSUIDs

WhatsApp is introducing Usernames and Business-Scoped User IDs (BSUIDs) to give users more privacy while allowing businesses to maintain consistent customer identification.

Phone numbers will no longer always be visible. Users communicating through a WhatsApp username may have their phone number withheld in certain interactions.
BSUID becomes the reliable WhatsApp user identifier. Each user receives a stable, business-specific ID that can be used to recognize them even when their phone number is unavailable.
Businesses should store BSUIDs alongside phone numbers and use the BSUID as the primary identifier for WhatsApp customer records.
Messages can be sent using either a BSUID or phone number, although authentication templates such as One-Tap and Zero-Tap OTPs still require a phone number.
If a phone number is required for CRM, shipping, or other workflows, businesses can use REQUEST_CONTACT_INFO to ask users to share their verified contact details.
Businesses should also update webhook logic, handle user_id_update events, and reserve their preferred WhatsApp Business username ahead of the broader rollout.

WhatsApp is undergoing one of its most significant architectural shifts to date. In a move to further prioritize user privacy, the platform is introducing USERNAMES. While this is a win for consumer privacy, it changes how businesses identify and interact with their customers.

To ensure businesses don’t lose track of their customers, Meta is simultaneously introducing Business-Scoped User IDs (BSUIDs).

In this post, we’ll break down what these changes mean for your business, how BSUIDs work, and what you need to do to keep your messaging workflows running smoothly.

1 The Big Shift: Phone Numbers are No Longer the Only Identifier

Historically, the phone number was the primary key for any WhatsApp interaction. If someone messaged you, you had their number.

With the introduction of Usernames, this is changing. Users can now choose a handle (like @john_doe) to represent themselves. If a user with a username contacts your business for the first time, WhatsApp may withhold their phone number from the webhook payload.

When will you still see the phone number?

Don’t worry—phone numbers aren’t disappearing entirely. You will still receive a user’s phone number if:

You have interacted (messaged or called) within the last 30 days.
The user is already in your Contact Book (a new feature that automatically pairs BSUIDs and phone numbers for your portfolio).
The user hasn’t set a username.
Related Read: Whatsapp Marketing Strategies

2 Meet the BSUID: Your New Constant

Since phone numbers may become optional in your incoming data, Meta has introduced the Business-Scoped User ID (BSUID).

Think of the BSUID as a permanent, anonymous “alias” for a user that is unique to your business.

Format: It looks like a country code followed by a string (e.g., MY.12345abcde…).
Stability: Unlike a phone number, which a user might change, the BSUID is designed to be your stable anchor for that customer within your specific business account.
Always Present: Every message you receive will now include a userId (the BSUID), even if the phone number is available.
Privacy-First: The same user will have a different BSUID for every business they message, preventing cross-business tracking.

3 Claiming Your Territory: Business Usernames

It’s not just for individuals—businesses can (and should) reserve usernames too.

Having a business username makes your brand more professional and easier to find. These are distributed on a first-come, first-served basis, so we recommend claiming your preferred handle in the Meta Business Suite or WhatsApp Manager as soon as possible. You may also reachout to our
partnership or account manager for assistance in claiming your business username.

Quick Rules for Business Usernames:

Must be 3–35 characters.
Limited to alphanumeric characters, underscores, and periods.
One username per phone number.

4 Handling “Anonymous” Interactions

If a new user messages you using only their username, you’ll receive a BSUID but no phone number. If your business logic requires a phone number (for example, to sync with an external CRM or for shipping updates), you can now use the REQUEST_CONTACT_INFO feature.

You can trigger a native WhatsApp template or interactive message that asks the user to share their contact card. Once they tap “Share,” their phone number is sent via webhook, and run necessary processes for updating the “Contact Book”. As part of BUSID meta is also providing contact book for business to maintain their customer contacts and shared phone numbers will be automatically added to the “Contact Book”

5 Preparing Your Integration

If you are integrated with our webhook and API services, your technical team should prioritize the following updates:

Update Database Schema: Ensure your customer records can store a userId (the BSUID) alongside the traditional phone number field.
Modify Webhook Logic: Update your code to treat the from field for incoming messages as a flexible string. It could be a phone number OR a BSUID.
Use BSUID as the Primary Key: Moving forward, use the contact.userId as the reliable way to recognize returning users.
Handle ID Updates: Monitor for user_id_update webhooks. This happens if a user changes their phone number, allowing you to bridge the old record with the new one in your internal systems.
Check Authentication Flows: Remember that One-Tap and Zero-Tap OTP templates still require a phone number and cannot be sent via BSUID.

Payload Deep Dive: What’s Changing?

All changes to the API are additive. Your existing fields won’t disappear, but new fields are being introduced to handle username-based interactions.

1 Receiving Messages (Inbound Webhooks)

When a user messages you, the contact object now includes the BSUID. If the user has a username and hasn’t messaged you in 30 days, the phone number will be omitted.

Scenario A: Phone Number is Available

{
    "accountName": "your-business-account-name",
    "accountNo": "your-business-account-no",
    "data": {
        "contacts": [
            {
                "profile": {
                    "name": "John Doe"
                },
                "user_id": "MY.12345abcde",
                "wa_id": "601234xxxxx"
            }
        ],
        "custName": "John Doe",
        "custNo": "601234xxxxx",
        "id": "1b1d1d31-bd7f-4ffe-8649-d119a0fde5f0",
        "text": "Hello",
        "timestamp": "1787824250",
        "type": "text"
    },
    "eventType": "Message",
    "fromName": "John Doe",
    "fromNo": "601234xxxxx",
    "platform": "WA",
    "text": "Hello, i am looking for additional info about the promo i received earlier",
    "type": "text"
}

Scenario B: Phone Number is Hidden (Username Only) Notice that the fromNo field is empty and phoneNumber is missing from the contact object.

{
    "accountName": "your-business-account-name",
    "accountNo": "your-business-account-no",
    "data": {
        "contacts": [
            {
                "profile": {
                    "name": "John Doe"
                },
                "user_id": "MY.12345abcde",
                "username": "@john_doe",
                "wa_id": ""
            }
        ],
        "custName": "John Doe",
        "custNo": "",
        "id": "1b1d1d31-bd7f-4ffe-8649-d119a0fde5f0",
        "text": "Hello",
        "timestamp": "1787824250",
        "type": "text"
    },
    "eventType": "Message",
    "fromName": "John Doe",
    "fromNo": "",
    "platform": "WA",
    "text": "Hello, can you send me the pricing guide?",
    "type": "text"
}

2 Sending Messages (Outbound)

You can now send messages using either the phone number or the BSUID in the recipient field.

Sending to a BSUID:

{
    "from": "60123412341",
    "recipient": "MY.102938475610293847",
    "platform": "WA",
    "type": "text",
    "text": "Sure thing, John Doe! Here is our pricing guide for 2025."
}

Sending to a BSUID & Phone Number:

{
    "from": "60123412341",
    "to": "601234xxxxx",
    "recipient": "MY.102938475610293847",
    "platform": "WA",
    "type": "text",
    "text": "Sure thing, John Doe! Here is our pricing guide for 2025."
}

Note: Authentication templates (OTPs) still require a phone number and cannot be sent via BSUID.

3 Tracking Status (Delivery Reports)

Delivery reports will now echo back the BSUID, ensuring you can map the “Delivered” or “Read” status back to the correct user in your database.

{
    "accountName": "your-business-account-name",
    "accountNo": "your-business-account-no",
    "data": {
        "contacts": [
            {
                "wa_id": "601234xxxxx",
                "user_id": "MY.102938475610293847"
            }
        ],
        "conversation": {
            "id": "dbb16c8d5f0360d3f7f1cf296f0033ec",
            "origin": {
                "type": "service"
            },
            "expiration_timestamp": 0
        },
        "custName": "John Doe",
        "custNo": "601234xxxxx",
        "id": "f2ca1d98-b8dc-4098-909e-6297a9c10fe4",
        "status": "delivered",
        "timestamp": "2026-08-27 16:54:14"
    },
    "eventType": "MessageStatus",
    "platform": "WA"
}

How to Get a User’s Phone Number

If a user contacts you via username and you need their phone number for your records (e.g., for shipping or CRM syncing), you can ask for it directly using the
new REQUEST_CONTACT_INFO button.

Requesting Contact Info (Interactive):

{
    "platform": "WA",
    "from": "60123412341",
    "recipient": "MY.102938475610293847",
    "type": "template",
    "templateLang": "en",
    "templateName": "share_profile_v2",
    "text": "Please share your contact details, so we can provide you personalised support without loosing context.",
    "buttons": [
        "Share Contact Info"
    ]
}

Response

{
    "accountName": "your-business-account-name",
    "accountNo": "your-business-account-no",
    "contactAttached": [
        {
            "contact1": {
                "name": "John Doe",
                "phone": "601234xxxxx"
            }
        }
    ],
    "data": {
        "contacts": [
            {
                "profile": {
                    "name": "John Doe"
                },
                "user_id": "MY.102938475610293847",
                "wa_id": "601234xxxxx"
            }
        ],
        "custName": "John Doe",
        "custNo": "601234xxxxx",
        "id": "1fbac66a-a79b-48d3-94d1-d2175fdd71df",
        "text": "",
        "timestamp": "1788153975",
        "type": "contacts"
    },
    "eventType": "Message",
    "fromName": "John Doe",
    "fromNo": "601234xxxxx",
    "platform": "WA",
    "text": "",
    "type": "contacts"
}

When the user taps the resulting button, WhatsApp will send a webhook back to you containing their verified phone number.

Integration Checklist

To prepare for the full rollout of usernames, we recommend the following steps:

Update Your CRM: Add a new field for whatsapp_bsuid. This should become your primary key for identifying WhatsApp users.
Listen for ID Updates: If a user changes their phone number, Meta will send a user_id_update event. Ensure your system can process this to keep your customer records merged.
Reserve Your Business Username: Go to the WhatsApp Manager and claim your brand’s handle before someone else does!

Summary Table of Field Changes

Field Location	Name	Behavior
Inbound	from	Contains Phone Number OR empty.
Contact Object	userId	BSUID – The Master WA Key. Always present, always stable.
Contact Object	wa_id	Phone Number – Only present if visibility rules are met.
Outbound Message API	to or recipient	Supports both Phone Number and BSUID in outgoing payloads, you can omit phone number and use only BSUID.