A German regulator has banned Facebook from processing any data from WhatsApp users, arguing that the messaging app’s controversial new terms of service are illegal under European privacy law.

The Hamburg Commissioner for Data Protection and Freedom of Information issued an emergency order on Tuesday prohibiting Facebook’s European operations from “processing personal data from WhatsApp for its own purposes” for three months.

The German regulator opened emergency proceedings against Facebook last month, citing powers granted to it under Europe’s General Data Protection Regulation (GDPR).

In January, WhatsApp began to roll out new privacy policies stating that it would share more data with its parent company, a move that has both spooked users and drawn wider regulatory scrutiny. The move was delayed following an outcry from users concerned that their sensitive data would be shared with Facebook for the first time, but it will now be fully rolled out on Saturday.

In fact, WhatsApp has been sharing data with Facebook since 2016 but it will now also be able to share payment and transaction data in order to improve its targeted advertising as the app expands into online shopping.

“The provisions on data transfers are scattered at different levels of the privacy policy, they are unclear and hard to distinguish in their European and international versions. In addition, the contents are misleading and show considerable contradictions,” the Hamburg regulator said on Tuesday.

It also noted that “consent is not freely given” to the new terms by users, as WhatsApp is severely restricting functionality of the service for those who do not accept them.

“The order is intended to safeguard the rights and freedoms of the many millions of users who approve to the terms of use throughout Germany,” said Johannes Caspar, Hamburg’s commissioner for data protection and freedom of information.

Regulators in India, WhatsApp’s biggest market, have launched a similar probe into the policy, while their opposite numbers in Brazil, its second biggest, over the weekend requested the app suspend the rollout to users in the country over concerns about consumer rights and privacy. WhatsApp said it was following up with the Brazilian authorities for more information.

Facebook has struggled to make money from WhatsApp, which it bought in 2014 for $19bn, making a public assurance at the time that the two would not share data.

Facebook said it was considering options for appealing against the German order, which it believes to be a misuse of the GDPR’s urgency procedures.

“The Hamburg DPA’s order against Facebook is based on a fundamental misunderstanding of the purpose and effect of WhatsApp’s update and therefore has no legitimate basis,” WhatsApp said. “As the Hamburg DPA’s claims are wrong, the order will not impact the continued rollout of the update.”

The German regulator said it would seek an EU-wide ruling on the matter from the European Data Protection Board.