In 2026, Meta is rolling out WhatsApp usernames in a phased schedule. For consumers, the change is straightforward: they get a username to share instead of a phone number, which protects their privacy when messaging businesses or strangers.

For Shopify merchants, the change is structural. Your customer identity model on WhatsApp has assumed phone numbers as the primary identifier for years. After the rollout, that assumption breaks for any customer who adopts a username. The replacement identifier is something called the Business-Scoped User ID, or BSUID, which behaves differently from a phone number in ways that affect your CRM, your attribution, and your Shopify integration.

Most merchants we speak to have not heard of any of this. Most BSPs have not yet updated their integrations to expose BSUID. This is the situation where the brands that prepare in May and June end up with smooth operations through the rollout, and the brands that wait discover problems with customer identity reconciliation that take months to fix.

This guide explains what is changing, the verified rollout timeline as Meta has communicated it to partners, what specifically breaks if you do nothing, and the four things to do in the next 60 days to be ready.

The verified timeline

Meta has shared a specific timeline with WhatsApp Business partners. As of May 2026, here are the confirmed dates:

• 31 March 2026 (DONE): BSUIDs started appearing in production webhooks. The new user_id field is included in all message webhooks regardless of whether the user has adopted a username.

• Early April 2026 (DONE): Meta-hosted Contact Book feature launched. Automatically stores phone-number and BSUID pairs from interactions, scoped to the business portfolio.

• Early May 2026 (NOW): REQUEST_CONTACT_INFO button became available. Businesses can include this button on utility and marketing templates to ask users to share their phone number explicitly.

• May 2026 (NOW): Send-to-BSUID API support became available. Businesses can message users using BSUID without knowing the phone number.

• June 2026 (UPCOMING): Country-level testing of usernames begins. Users in select test markets get the option to set a username and hide their phone number from new contacts. Businesses can claim usernames reserved for Official Business Accounts and Meta Verified names.

• Rest of 2026: Global rollout of usernames to all WhatsApp users.

The most important date for Shopify merchants is 31 March 2026. As of that date, your webhook integration must already handle the new user_id field correctly. If your CRM lookup logic still keys exclusively on phone number, it works today (because phone numbers continue to come through for non-username users), but it will start breaking for users who adopt usernames in June and beyond.

What is the BSUID exactly

The Business-Scoped User ID is a string identifier that uniquely identifies a user within the context of one specific business portfolio. Three properties matter:

It is unique per business portfolio. Customer Alice has one BSUID with your store and a different BSUID with another store. The two BSUIDs cannot be correlated externally.

It is durable. Once you receive a BSUID for a user, it does not change. You can use it as a stable identifier in your CRM the same way you used the phone number.

It has a specific format: {ISO 3166 alpha-2 country code}.{up to 128 alphanumeric characters}. For example, US.13491208655302741918.

The BSUID is delivered in webhook payloads in a new user_id field. The exact field name varies slightly by BSP (Twilio uses ExternalUserId, Vonage uses user_id, Microsoft Azure uses fromBSUID) but the concept is universal.

Important nuance: BSUIDs are scoped to individual business portfolios. Only business phone numbers within the same portfolio can message a given BSUID. For multi-portfolio enterprises, Meta provides a parent_BSUID concept (format US.ENT.xxxxx) but this requires Meta approval.

Authentication templates: one-tap, zero-tap, and copy-code authentication templates still require phone numbers. BSUIDs cannot be used for these template types.

The 30-day phone number visibility rule

Meta has built in a backwards-compatibility rule to soften the immediate impact.

If a WhatsApp user adopts a username, their phone number will NOT be included in your webhooks unless one of these conditions is met:

• You messaged or called their phone number in the last 30 days

• You received a message or call from their phone number in the last 30 days

• The user is in your Contact Book

These conditions are evaluated per business phone number. If you message a user from phone number A, webhooks from phone number B will not include the user's phone number unless phone number B also interacted with that user within 30 days.

In practice this means an active customer who messages your business at least monthly will continue to expose their phone number to your systems. A dormant customer who has not interacted with you in over 30 days will stop returning a phone number once they adopt a username.

The merchants most affected are those with long sales cycles, those with high seasonality (where customers can be dormant for 6+ months between purchases), and those who acquire customers through CTWA where the first interaction may not include a phone number at all.

What breaks if you do nothing

If your CRM, your analytics, and your Shopify integration use phone number as the primary key for WhatsApp customer records, several things break in waves through 2026.

The first thing to break is new customer onboarding for username adopters. A customer who taps a Click-to-WhatsApp Ad and starts a conversation with your business may not expose a phone number. Your standard "create or update customer record by phone number" logic has nothing to key on.

The second thing to break is attribution back to ad campaigns. CTWA conversion attribution typically matches the phone number from the WhatsApp conversation to the phone number on the Shopify order. With usernames, the WhatsApp conversation has a BSUID and the Shopify order has a phone number, and there is no automatic match.

The third thing to break is cross-channel customer identity reconciliation. If you use the phone number to merge a WhatsApp customer record with an email customer record (a common pattern in Klaviyo and similar tools), that merge stops working for username-only customers.

The fourth thing to break is historical data lookups. A customer messages you, your support agent searches the CRM by phone number, finds nothing because the customer is now identified by BSUID, and treats them as a new contact.

None of these breakages are catastrophic individually. Cumulatively they degrade the quality of your WhatsApp programme over the second half of 2026 if you do not prepare.

The four things to do in the next 60 days

1. Add a BSUID field to your Shopify customer record

Shopify customers can have arbitrary metafields. Add a metafield called whatsapp_bsuid (or similar) to your customer object. This is where the BSUID gets written when the customer interacts with you on WhatsApp.

Existing customers will be backfilled gradually. Their phone number stays as the primary identifier (because you already have a relationship), and the BSUID is added when they message you next. New customers acquired through WhatsApp after username adoption will only have a BSUID, no phone number, until they explicitly share their phone via the REQUEST_CONTACT_INFO button.

2. Update your WhatsApp identifier reconciliation logic

If you have any custom logic that creates or updates customer records based on incoming WhatsApp interactions, the lookup needs to be updated.

Old logic (will break): match on phone_number. If found, update record. If not found, create new record.

New logic (works through the transition): match on whatsapp_bsuid if present. If not found, fall back to matching on phone_number. If still not found, create new record with whichever identifier was returned. When matching by phone, write BSUID back to the record so the next interaction matches more efficiently.

3. Push your BSP for full BSUID support

Your BSP is the part of the stack that has to expose BSUID to your systems. As of March 31, BSUIDs are appearing in webhooks, but the BSP integration layer to surface them to your CRM may lag.

Three questions to ask your BSP: are BSUIDs returned in the webhook payload via the user_id field? Does your Shopify integration write BSUID to a customer metafield? Does your platform support sending to BSUID (which became available in May 2026)?

If the answers are vague or "we are working on it," push for a date. If the date is later than September 2026, you have a timing problem.

4. Update your privacy policy and consent collection

The introduction of BSUID changes the personal data you collect. Your privacy policy may need to be updated to reflect the new identifier. Your consent collection language may need to be updated to acknowledge that customer identity may be a username or a phone number.

Also consider implementing the REQUEST_CONTACT_INFO button on your post-purchase or post-conversation utility templates. This is the compliant way to ask username-adopting customers to voluntarily share their phone number for shipping or service purposes.

What this means for Meta's broader privacy direction

The username rollout is part of a larger pattern. Meta is incrementally repositioning WhatsApp as a privacy-forward channel, partly because user research has shown privacy is a meaningful purchase decision, and partly because regulatory pressure has pushed in this direction.

Other recent or upcoming privacy moves include the gradual reduction of phone number visibility in profile cards, the Contact Book that businesses can disable at any time (which deletes all stored data permanently), and tighter restrictions on businesses' ability to retain user data after relationships end.

The trend for businesses is clear: WhatsApp is going to become more like a regulated channel and less like an open contact list. The brands that build their data architecture around the assumption of restrictive identifiers, durable BSUIDs, explicit consent, and limited retention will operate cleanly through the next several years of changes.

Frequently asked questions

When exactly do WhatsApp usernames go live?

BSUIDs are already in production webhooks as of 31 March 2026. The Contact Book launched in early April. Sending to BSUID became available in May. Country-level testing of usernames in select markets begins in June 2026. Global rollout continues through the rest of 2026.

Will all users adopt usernames?

No. Usernames are opt-in. Adoption rates from comparable platforms (Telegram has had usernames for years) suggest somewhere between 20 and 50 percent of users will eventually adopt. Adoption tends to be highest among privacy-conscious demographics.

What happens to phone numbers I already have?

Nothing immediately. Phone numbers you have collected from prior interactions remain valid identifiers. You can continue to send messages to those numbers. The change applies to new interactions where the user has adopted a username and is not in your Contact Book or your 30-day interaction window.

Do I need to ask for explicit consent for the BSUID?

The BSUID is delivered as part of the standard WhatsApp interaction protocol when the user initiates contact. It is not separately collected personal data in the same way a phone number is. That said, your privacy policy should reflect that you collect and store user identifiers including BSUID.

Will my Click-to-WhatsApp Ads still work after username rollout?

Yes, but the attribution logic needs to be updated. CTWA campaigns will produce BSUID-only conversations for users who have adopted usernames, and your attribution model needs to match BSUIDs to Shopify orders rather than phone numbers.

How does BSUID affect data subject rights requests under GDPR?

Data subject access and deletion requests can be made by the user through any channel they identify themselves on. If a user requests deletion based on their BSUID, you delete the records keyed to that BSUID.

Can I correlate a BSUID with the customer's email or Shopify account?

Yes, if the customer provides additional identifying information during the interaction. A customer who provides their email in a WhatsApp Flow can be matched to their Shopify account through the email.

What if my BSP does not support BSUID by mid-2026?

You have a problem incoming. The first sign will be customer records failing to create or duplicate records appearing for known customers. Push your BSP for a timeline now. If they cannot commit to a date, evaluate alternatives.

What is the Contact Book and should I disable it?

The Contact Book is a Meta-hosted feature that automatically stores phone-number and BSUID pairs from interactions between your business portfolio and WhatsApp users. It is enabled by default. It can be disabled in Meta Business Suite, but disabling deletes all stored data permanently. For most merchants the Contact Book is helpful because it preserves phone-number visibility for users you have interacted with, even after they adopt usernames.