Facebook has been ordered to stop collecting and storing data from German users of WhatsApp, which it acquired for $19bn (£14.6bn) in 2014.
The directive was issued by Hamburg’s data protection commissioner following changes to the messaging app’s privacy policy last month.
Under the latest agreement, Facebook started collecting data including mobile phone numbers from WhatsApp accounts.
But the Hamburg data regulator said in a statement that Facebook did not obtain “effective approval from WhatsApp users” beforehand.
Facebook is set to appeal the order.
In a statement, the tech giant said it had complied with Europe’s data protection rules:
“We will appeal this order and we will work with the Hamburg DPA in an effort to address their questions and resolve any concerns.”
The Hamburg DPA is authorised to issue the nationwide order because the company’s German subsidiary is based in the city.
Johannes Caspar, the Hamburg data protection commissioner, said in a statement: “It has to be their decision, whether they want to connect their account with Facebook.
“Therefore, Facebook has to ask for their permission in advance. This has not happened.”
Announcing the new privacy policy in August, WhatsApp said closer coordination would enable Facebook to make “better friends suggestions and show you more relevant ads if you have an account with them”.
The changes were part of Facebook’s renewed focus on monetising WhatsApp, which includes the introduction of targeted marketing messages
WhatsApp’s founders had previously been staunchly against advertising.
The British Information Commissioner’s Office is also looking into changes to the privacy policy.