Facebook has been ordered to stop collecting and storing data from German users of WhatsApp, which it acquired for $19bn (£14.6bn) in 2014.
Under the latest agreement, Facebook started collecting data including mobile phone numbers from WhatsApp accounts.
But the Hamburg data regulator said in a statement that Facebook did not obtain “effective approval from WhatsApp users” beforehand.
Facebook is set to appeal the order.
In a statement, the tech giant said it had complied with Europe’s data protection rules:
“We will appeal this order and we will work with the Hamburg DPA in an effort to address their questions and resolve any concerns.”
The Hamburg DPA is authorised to issue the nationwide order because the company’s German subsidiary is based in the city.
Johannes Caspar, the Hamburg data protection commissioner, said in a statement: “It has to be their decision, whether they want to connect their account with Facebook.
“Therefore, Facebook has to ask for their permission in advance. This has not happened.”
The changes were part of Facebook’s renewed focus on monetising WhatsApp, which includes the introduction of targeted marketing messages
WhatsApp’s founders had previously been staunchly against advertising.