How are they matching up accounts without sharing my phone number with Facebook?
So the goal isn't to sell YOU. You are boring and prosaic. No advertiser cares about you personally.
We'll make money by selling your likes and who you're connected to in this fuzzy, aggregate format. Advertisers want to sell to a group of people who look just like you.
but the key space is way too small for a hash to be a meaningful anonymization mechanism. It's too easy to build a rainbow table for possible phone numbers.
Given any input domain, you can choose an algorithm that will make bruteforcing the entire domain take as long as you like. As an extreme example, bcrypt with a work factor of 20 takes over a minute to calculate a single hash on a high-end desktop. (Of course, whether whatsapp are actually doing any of this is another question).
I'll give you an example. Here's a hashcode from a real phone number: 1786883671916465751. What's the phone number I used to generate it?
Even with hundreds of millions of observations, the space of possible hashing algorithms that map phone numbers onto those hash codes is infinite. Well, not infinite, but the space of functions that map phone numbers onto whatever domain the hash codes have is mind bogglingly large.