When you use WhatsApp, it can access and upload your phone's contact list to its servers, even if those contacts have never used WhatsApp.
This analysis describes what WhatsApp's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause establishes the operational mechanism and scope for contact list collection and processing. It distinguishes between handling of user contacts (who have agreed to the service) and non-user contacts (which receive specified data protection treatment during retention).
The updated policy now explicitly discloses that users 'may see other types of ads in Status and Channels,' whereas the prior language stated WhatsApp had 'no intention to introduce' new ad types. This represents a shift from a stated commitment not to expand advertising toward an explicit acknowledgment that new ad categories may appear on WhatsApp's social features. The policy also updated its regional privacy guidance by removing a reference to Thai Personal Data Protection Act rights and adding a new section directing US residents to WhatsApp's United States Regional Privacy Notice for information about their consumer privacy rights under US law.
View change record →Uploading your contacts means personal information about people who never consented to WhatsApp's policies is collected and processed. This is particularly concerning for users who have sensitive contact lists, such as journalists, lawyers, or healthcare professionals.
How other platforms handle this
Your use of the Services is also governed by our Privacy Policy, which is incorporated into these Terms by reference. By using the Services, you consent to the data collection and use practices described in the Privacy Policy. Roblox collects information you provide directly, information collected a...
We collect information about you in a variety of ways depending on how you interact with us and our products and services. This includes information you provide directly, information we collect automatically when you use our services, and information we receive from third parties. We may collect ide...
Tabnine may collect and use technical data and related information, including but not limited to technical information about your device, system and application software, and usage data regarding your use of the Services (including code completion statistics and plugin interaction data), to facilita...
Monitoring
WhatsApp has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"You can use the contact upload feature and provide us, if permitted by applicable laws, with the phone numbers in your address book on a regular basis, including those of users of our Services and your other contacts. If any of your contacts aren't yet using our Services, we'll manage this information for you in a way that ensures those contacts cannot be identified by us.— Excerpt from WhatsApp's WhatsApp Privacy Policy
Contact data processing of non-users raises serious GDPR Article 6 lawful basis and Article 14 transparency obligation issues. This practice has been the subject of regulatory scrutiny in multiple EU jurisdictions and poses ongoing compliance exposure.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The clause establishes the operational mechanism and scope for contact list collection and processing. It distinguishes between handling of user contacts (who have agreed to the service) and non-user contacts (which receive specified data protection treatment during retention).
Uploading your contacts means personal information about people who never consented to WhatsApp's policies is collected and processed. This is particularly concerning for users who have sensitive contact lists, such as journalists, lawyers, or healthcare professionals.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by WhatsApp.