WhatsApp has started rolling out usernames, letting its three billion users connect without ever handing over a phone number. The change is arriving gradually over the coming months, and reserving a name is optional rather than compulsory. Once it is live, two people can add each other on a username alone, and phone numbers will no longer be visible on the platform.

On the face of it, this is a clear privacy gain. Numbers are personal, awkward to change and easy to misuse, so taking them out of everyday contact makes sense. Signal introduced the same idea back in 2024, so the direction of travel is well established.

But a username feature and a private platform are not the same thing, and the difference matters for any business weighing up where consumer tools belong in its operations. As Oxford privacy researcher Carisa Veliz noted, WhatsApp still gathers a significant amount of metadata for marketing, and it remains owned by a company with one of the weaker reputations on data. Message content stays protected by end-to-end encryption, but information such as general location and basic account details still feeds advertising.

There is a security wrinkle too. Removing phone numbers also removes one of the signals people instinctively use to judge whether a contact is genuine. WhatsApp has built in optional username keys, short numbered codes that stop strangers reaching you on a username alone, and says its systems detect abuse patterns. Useful to know, because plenty of users will never switch those protections on.

For organisations, the real takeaway is less about WhatsApp and more about a habit worth examining. Consumer messaging apps are convenient, and staff reach for them at work precisely because they are frictionless. Convenience is not the same as governance, though. Knowing what a tool collects, where that data travels, and whether sensitive business conversations belong there at all is a question worth asking before the next handy feature lands.

The lesson from this rollout is a simple one. Privacy controls give you options, not guarantees. The guarantees come from understanding the tools you rely on and choosing them deliberately.

That is the thinking Shoothill brings to managed IT and cyber security: helping businesses see where their data sits, where it leaks, and how to stop day-to-day convenience quietly turning into risk. If consumer apps have crept into how a team communicates, it is worth a conversation about doing it safely.