WhatsApp username and BSUID: what changes in 2026

For years, the phone number was every customer's identity on WhatsApp: it was what the business saw, what fed contact lists, and what campaigns were built on. That is changing. Meta announced WhatsApp usernames — handles a user can share instead of revealing their number — and, alongside them, a new identifier called the BSUID (business-scoped user ID). In practice, the phone number stops being shared automatically with businesses. For anyone selling and supporting customers over WhatsApp, this is the most significant identity change in years, and it happens throughout 2026.

What the WhatsApp username is and why Meta is changing it

The WhatsApp username is a handle: a user-chosen name that a person can share instead of revealing their number. Anyone who wants to reach out uses the username, not the phone. The goal is more privacy for the user, who now controls what they share — and no longer exposes their number to every business they talk to.

The format follows clear rules: 3 to 35 characters, with lowercase letters, numbers, dots and underscores; it must include at least one letter; and it can't contain "www" or endings like .com or .net. It's a public, readable identifier, similar to handles on other networks — but inside the WhatsApp ecosystem.

The direct consequence for businesses is this: the phone number stops being shared automatically. When a user adopts a username, the business no longer receives the number the way it used to. And that's where the BSUID comes in.

What the BSUID (business-scoped user ID) is and why it matters

A quick caveat: BSUID is a technical, behind-the-scenes term — your customer will never hear about it; for the end user, only the username exists. The BSUID (business-scoped user ID) is the internal code that replaces the phone number once a user adopts a username. It is a non-global identifier: it only works inside your business. It has two characteristics that change everything for anyone working with contact data.

First, it is anonymous and unique per business. Two different businesses see different BSUIDs for the same user. In other words: the identifier your store receives is useless to any other business, which prevents cross-business tracking. No one can cross-reference databases to reconstruct who the person behind the contact really is.

Second, the BSUID becomes the contact's identifier in the API and webhooks. Instead of the phone number, it's the BSUID that arrives when a conversation starts, and it's how the business recognizes, organizes and continues serving that customer. Anyone operating on the official API receives and handles this identifier in a structured way — and that's exactly what separates those who are ready from those who aren't.

This doesn't mean the phone number disappears for good. Meta offers a button called REQUEST_CONTACT_INFO, which can be used in utility and marketing templates or in interactive messages. When the customer taps it, they choose to share their number, which reaches the business through a contact webhook. The phone number stops being handed over automatically and becomes something that depends on the person's consent — asked at the right moment and in the right context.

There's also a continuity layer: customers you've messaged recently — and contacts already mapped by Meta's Contact Book — keep showing up with their number even if they adopt a username. The blind spot is the new contact who arrives with only a username: there's no phone number — only the BSUID to work with. And since the BSUID only arrives through the official API, anyone operating outside it simply doesn't receive it.

The PIN and the public resolution of the username

Alongside the username, the user can set a PIN — a code that restricts the public resolution of the handle. With the PIN on, messages from people the user doesn't know only arrive if the sender knows the code. Without the PIN, the contact is blocked at the door, before it ever becomes a conversation.

In practice, the PIN works as an anti-spam filter controlled by the user. When a conversation does happen, it stays protected with end-to-end encryption — the PIN doesn't change message security, it decides who can start the contact. For a brand, that means cold, unsolicited outreach gets even harder: the user can simply choose not to let it in.

The pain for those running campaigns outside the official API

Here is the most serious impact, and the one that most separates operations. Anyone blasting messages through unofficial tools, phone lists and number-based sends will face real difficulties. The logic is simple: with no number shared and the BSUID available only through the official API, those tools have no way to identify or reach the contact.

Phone-based lists stop working once the user adopts a username — there's no number left to dial. The BSUID, which would be the alternative, never reaches anyone outside the official API. And the PIN blocks any cold approach from a sender without permission. Put the three effects together and mass number-based blasting, operating on the margins of Meta's rules, loses the very ground it always stood on.

It's worth understanding the identifier that's left in this scenario. In unofficial tools, the contact shows up as a @lid — an internal identifier that cannot be used in the official API. Worse: in those tools, the @lid may simply fail to resolve if the user adopts a PIN. In other words, what's left outside the official channel is an identifier that doesn't talk to the API and may not even point to someone you can reach.

By contrast, anyone on the official API — like Merge — receives and handles the BSUID correctly, recognizes each contact by the right identifier, and keeps the conversation going within the platform's rules. The difference is no longer a matter of preference but of viability: either you're on the official channel, or you simply can't operate under the new identity model.

How to prepare now: reserve the username and be on the official API

There are two concrete actions, and the first one is time-sensitive. Businesses can already reserve their username ahead of time in Business Manager — via WhatsApp Manager, Meta Business Suite or the API — before the broad launch. The reservation can be based on the Display Name, the Official Business Account, the Meta Verified Name or the Facebook/Instagram handle. The message is blunt: secure your brand's handle before someone else takes it. A username is unique, and whoever gets there first keeps the name.

The second action is structural: be on the official API to be ready for the BSUID. Since the new identifier only arrives through it, the official API is what guarantees your operation keeps recognizing and serving contacts once the phone number stops being shared. This isn't something to sort out after launch — it's the foundation that has to be in place beforehand.

How Merge solves this

Merge runs on Meta's official WhatsApp Business API. That means that as the username and the BSUID roll out throughout 2026, your operation is already on the only channel that receives and handles the new contact identifier correctly — no workarounds, and within the rules.

In practice, Merge delivers the complete operation on top of the API: an inbox where the whole team serves customers with each one's history, a CRM with a visible sales pipeline, automations for welcome messages, order confirmation and cart recovery, and segmented campaigns with approved templates. When the contact's identifier becomes the BSUID, this is the layer that keeps every conversation with context, ownership and a next step — whether or not the customer shares their number.

With 79% of Brazilians using WhatsApp to talk to businesses, losing the ability to identify and reach the contact isn't a technical detail — it's lost sales. Reserve your brand's username in Business Manager now and make sure your operation is on the official API. Merge handles the technical side so that WhatsApp's identity change becomes an opportunity, not a problem.