For two decades, your phone number has been your identity online. It logs you into apps, receives your one-time passwords, and quietly travels through every business chat you start. On WhatsApp, it has always been the thing on the other end of the conversation — the number a brand sees the moment you say "hi."
That is about to change. And the quiet engineering decision behind it, a new identifier called the Business-Scoped User ID, may end up being one of the most meaningful privacy shifts the messaging world has seen in years.
What is a Business-Scoped User ID?
A Business-Scoped User ID — BSUID for short — is a unique code that identifies a WhatsApp user to a specific business, without revealing that user's phone number. According to Meta's developer documentation, a BSUID "uniquely identifies a WhatsApp user and is tied to a specific business."
The format is deliberately plain: an ISO 3166 alpha-2 country code, a period, and up to 128 alphanumeric characters. In practice it looks like US.13491208655302741918 — a string with no meaning to a human, and no way to dial it.
Here is the part that matters most, and it is easy to miss. The same person gets a different BSUID for every business they talk to. Your BSUID at your airline is not your BSUID at your bank, and neither one can be matched against the other. As Spotler explains, this is intentional: "Business A cannot use a BSUID to track a user's activities or interactions with Business B."
That single design choice is what separates a BSUID from just "hiding the number." A phone number is a universal key — once a company has it, it can be cross-referenced, sold, merged into a data broker's file, and tied to everything else you do. A business-scoped identifier is a key that only opens one door.
Why now? The username feature
BSUIDs did not appear in a vacuum. They are the plumbing for a feature WhatsApp users have wanted for a long time: usernames.
Starting in 2026, WhatsApp will roll out optional usernames — handles like @yourname that let you message and call businesses without handing over your phone number at all. Microsoft's documentation on the change describes the username as the public identity and the BSUID as the private backend reference that lets the business keep the conversation going.
The rules are simple. Per reporting from India TV News, usernames must be 3 to 35 characters, contain at least one letter, and use only letters, numbers, periods, and underscores. Your phone number stays attached to your account for login, authentication, and recovery — it simply stops being visible to the businesses you contact through your username.
Two details make this genuinely user-first. First, it is entirely optional: if you prefer the way WhatsApp works today, you change nothing. Second, it is free — there is no charge to create, change, or remove a username.
WhatsApp is also adding an optional safeguard called a "username key," a short PIN that someone needs in addition to your handle before they can reach your main inbox. It is a small thing that closes a real gap: a public username, on its own, could otherwise be guessed or messaged by anyone.
How safety changes for ordinary people
To understand why this is a big deal, you have to remember how much damage a leaked phone number can do.
Your number is the linchpin of SIM-swapping fraud, where a scammer convinces a carrier to move your number to their SIM and then intercepts your security codes. It is the seed for metadata harvesting, where brokers assemble a profile around the one identifier you can never easily change. And it is the thing that ends up on spam lists after a single transaction with a careless merchant.
By letting people interact with businesses through a username and a business-scoped code, WhatsApp removes the number from that exchange entirely. Coverage from the Mobile Ecosystem Forum frames the move as a direct response to long-standing vulnerabilities — the kind of structural fixes that protect people who will never read a security guide.
Think about who benefits most. A domestic-abuse survivor who needs to order from a pharmacy without leaking a reachable number. A journalist contacting a source's organization. A teenager buying concert tickets from a brand they have never dealt with before. For all of them, "message this business without giving it your number" is not a convenience — it is a safety feature.
There is a quieter benefit too. When your number is not in the webhook payload, it is not sitting in some company's database waiting to be breached. You cannot leak what you never collected. That principle — data minimization — has been the holy grail of privacy regulation for years. BSUIDs bake it into the protocol itself.
Why this lands differently around the world
WhatsApp is not one market; it is dozens, and the BSUID will mean something slightly different in each.
In Europe, the change reads almost like a compliance gift. The GDPR's data-minimization principle requires that businesses collect only the personal data they actually need. A phone number harvested "just in case" has always sat in a grey zone. A business-scoped identifier that lets a company serve a customer without ever storing a phone number is, in effect, the regulation's intent expressed as a technical default. Companies operating under European rules may find that usernames quietly shrink their compliance surface.
In markets like India, Brazil, and Indonesia — where WhatsApp is not just an app but the primary channel for commerce, government services, and daily business — the stakes are different. These are places where a leaked number can mean a relentless tide of spam calls, loan-app harassment, and fraud. For hundreds of millions of first-time internet users, the ability to transact without exposing a permanent, dialable identifier is a meaningful upgrade in everyday safety, not a niche privacy preference.
The common thread is that WhatsApp is making the private choice the easy one. Historically, protecting your number meant friction — a second SIM, a burner, a refusal to engage. Usernames and BSUIDs move that protection into the default flow, where the people who need it most are the most likely to actually use it.
Credit where it is due: this is a hard thing to do well
It is worth pausing to appreciate what Meta has actually built here, because privacy features are easy to announce and hard to engineer.
The naive version of "hide my number" breaks everything. Businesses still need a stable way to recognize a returning customer, route a support ticket, or send the shipping update you asked for. If the identifier changed every session, commerce on WhatsApp would simply stop working. If the identifier were the same everywhere, you would have just invented a new universal tracking key — privacy theater with extra steps.
The business-scoped approach threads that needle. The ID is stable enough for a business to maintain a real relationship with you, and scoped tightly enough that the relationship cannot be linked across companies. That is a careful, principled piece of design, and Meta deserves credit for shipping it as the default architecture rather than a buried setting.
Meta also handled the transition thoughtfully. As Twilio's changelog notes, businesses that already have a customer's phone number from past conversations do not lose it — they can keep messaging known contacts as before. Nobody's existing relationships break on day one. The new model is layered on top of the old one, not dropped on top of it.
What businesses will need to adjust
For the companies that message customers on WhatsApp, BSUIDs are less a threat than a heads-up. A few practical things shift.
The most important one: phone numbers can no longer be assumed. When a user adopts a username, their number may simply not appear in the webhook your systems receive. Instead, as the Vonage knowledge base details, you get a BSUID in the to and from fields. Any system that uses the phone number as its primary customer key — CRMs, ticketing tools, analytics — needs to learn to treat the BSUID as a valid identifier too.
There is one notable carve-out. According to Meta's documentation, one-tap, zero-tap, and copy-code authentication templates — the OTP messages you get when logging in — still require a phone number and cannot be sent to a BSUID. That makes sense: those flows exist precisely to verify a number. Standard marketing, utility, and service conversations, though, will work with a BSUID alone.
There is also a scoping rule worth knowing. BSUIDs are tied to a business portfolio, so only phone numbers within the same portfolio can message a given BSUID. For most businesses this is invisible; for large organizations running multiple brands under separate portfolios, it is a detail to plan around.
The honest takeaway for businesses is that this rewards good data hygiene and punishes shortcuts. Companies that quietly relied on harvesting and reselling numbers will find that well runs dry. Companies that earn a conversation and serve it well will not notice much difference at all.
The timeline
This is not a someday change — it is a calendar one. Based on guidance compiled by providers including Twilio and Meta's own documentation, the rollout runs roughly like this:
- Early April 2026: BSUIDs begin appearing in webhook payloads, and usernames enter limited beta.
- May 2026: API support arrives for messaging users with only their BSUID. You will be able to reach people by BSUID, phone number, or both.
- June 2026: WhatsApp usernames begin their broader global rollout.
For a feature that quietly redraws how a billion-plus people identify themselves to businesses, that is a remarkably short runway. The systems that handle it gracefully are the ones being prepared now.
The bigger picture
Step back, and the BSUID is part of a story much larger than one app's settings menu.
For thirty years, the internet's default has been to identify people by something permanent and reusable — an email address, a phone number, a national ID. That model is efficient and catastrophically leaky. Every reuse is a chance to be tracked, merged, and exposed. The emerging alternative, visible in everything from "Sign in with Apple's" private relay emails to Apple's Hide My Email, is scoped identity: give each relationship its own disposable key, and the leaks stop compounding.
WhatsApp putting a business-scoped identifier at the center of how a third of the planet talks to companies is the largest deployment of that idea yet attempted. If it works — if usernames catch on and businesses adapt without friction — it normalizes the expectation that you should be able to deal with a company without surrendering a permanent piece of yourself.
The phone number will not vanish overnight. But for the first time, it is no longer the price of admission to a conversation. That is a small change in a developer's webhook payload, and a large change in the world.
