Facebook has been told it must not use data gathered from UK WhatsApp users to target ads on its core social network.
The country's Information Commissioner said she did not believe the firm had obtained valid consent for the move and added that people must be given "ongoing control" over their data.
Elizabeth Denham said that Facebook had agreed to "pause" its rollout but had not met all her demands.
The firm said it was having "detailed conversations" with her office.
"We remain open to working collaboratively to address their questions," a Facebook spokeswoman said.
She added that the updates "comply with applicable law, and follow the latest guidance from the UK Information Commissioner's Office".
The California-based company bought WhatsApp in 2014 and pledged to keep the chat app independent.
"I had concerns that consumers weren't being properly protected, and it's fair to say the enquiries my team have made haven't changed that view," blogged Elizabeth Denham, the Information Commissioner.
"I don't think WhatsApp has got valid consent from users to share the information.
"We've set out the law clearly to Facebook, and we're pleased that they've agreed to pause using data from UK WhatsApp users for advertisements or product improvement purposes."
Ms Denham said she now wanted Facebook and WhatsApp to:
- offer customers' more details about how their data will be used
- let WhatsApp members restrict access to their information beyond the existing 30-day cooling-off period
- let users completely opt-out of the agreement at any time
Ms Denham said that Facebook had not agreed to these terms.
"If Facebook starts using the data without valid consent, they may face enforcement action from my office," she warned.
WhatsApp has already been cautioned warned by European privacy watchdogs about sharing user data with its new parent company.