One of the world's most popular smartphone apps has been accused of violating "internationally accepted privacy principles".
A joint report by Canadian and Dutch data protection authorities criticised the way WhatsApp users have to provide access to their entire address book - including phone numbers of contacts who don't use the app.
Investigators say this lack of choice is against national laws.
They also say the storage of the numbers contravenes the principle that "information may only be retained for so long as it is required for the fulfilment of an identified purpose".
WhatsApp, which provides an alternative to text message for many, has hundreds of millions of users worldwide, sending more than a billion messages each day.
However the California-based company says phone numbers of non-users are "hashed" to encrypt the information and are only stored in case they later sign up to the service.
WhatsApp also told investigators it did not store names or email addresses associated with the numbers.
Currently, the only users able to manually select which contacts to upload are those with an iPhone running on the iOS6 operating system.
People signing up on Android devices, for example, have to provide access to their entire address book.
Jacob Kohnstamm, chairman of the Dutch Data Protection Authority, said: "Both users and non-users should have control over their personal data and users must be able to freely decide what contact details they wish to share with WhatsApp."
The investigation also raised concerns over messages being intercepted, as well as over third parties sending and receiving messages in the names of others.
In response, WhatsApp has now introduced message encryption and strengthened the way it authenticates the identity of users.
"Our investigation has led to WhatsApp making and committing to make further changes in order to better protect users’ personal information," said Canada's privacy commissioner Jennifer Stoddart.
However, the report says there are still some "outstanding issues" and that Canadian and Dutch authorities would be monitoring the situation.
The investigation comes at a time of increased criticism of internet companies, such as Facebook (NasdaqGS: FB - news) and Google (NasdaqGS: GOOG - news) , over the storing and sharing of personal information.
WhatsApp has been contacted for comment but has not yet responded.
More From Sky News