European Union privacy chiefs said Facebook must stop processing user data from its WhatsApp messaging service while they are investigating the privacy policy changes the company announced in August.

The Article 29 Working Party, made up of privacy chiefs from across the 28-nation EU, told Facebook it had “serious concerns” about the sharing of WhatsApp users’ data for purposes that were not included in the terms of service and privacy policy when existing users signed up to the service, according to a statement e-mailed on Friday.

European privacy watchdogs don’t shy away from targeting big US technology firms, as previous probes into Facebook, Google or Microsoft have shown. Only their fining powers still lack teeth, which is going to change under new EU rules that will take effect across the bloc in 2018 with penalties possible of as much as 4% of a company’s global annual sales.

“We’re working with data protection authorities to address their questions,” WhatsApp said in an e-mailed statement. “We’ve had constructive conversations, including before our update, and we remain committed to respecting applicable law.”

In a separate move, the EU panel told Yahoo to notify all concerned users of adverse effects following the hacking of accounts in 2014 by cyber criminals.

The Article 29 Working Party also said it’s concerned about the alleged scanning of Yahoo customers’ incoming e-mails for US intelligence purposes at the request of US agencies and asked the company to provide information on the legal basis and the compatibility with EU law of any such activity.

Yahoo representatives didn’t immediately respond to a request for comment.