I will preface this with a note that I personally do not support W Social and this alt text is not an endorsement of their statements. I just think it’s important that we all know what exactly has or hasn’t been said. I’ve avoided commentary, but have added a bit of context where I think it’s essential.
Note that I copy-and-pasted the text from the images. I casually went through and checked for any OCR errors as I formatted the text, but I wasn’t thorough and may have missed something.
[The images are the full pages of a four-page document, including one screenshot embedded in the second page. They have pagination on the bottom right, which I’ve omitted in the alt text.]
[W Social logo with the “Trust your feed” tagline]
Key Allegations & Answers
Verification and privacy on W Social • Prepared with our Data Protection Officer • October 2026
As W Social grows, we receive more questions about how verification and privacy work on our platform. Some of these questions raise fair points; others rest on incorrect assumptions. Either way, our users deserve clear answers. We have therefore reviewed each of the points together with our independent external Data Protection Officer and summarized the facts in the following fact sheet.
1. Public exposure of verification data
Does W Social publish users’ personal data, such as names, email addresses or dates of birth, without their choice?
W Social was built on the principle of privacy by design, and our verification process works exactly as intended. When a user verifies their account, we write a verification record to our moderation account on the AT Protocol. Like all profile data on the AT Protocol, this record is public – this is how users can see that an account belongs to a verified human. The record contains the verification status, the country that issued the user’s passport, a synthetic date of birth used to derive an age range and – only for users who have chosen to share their legal name – that name. It never contains passport images, passport numbers, selfies, real dates of birth or any other passport information.
No verification record, and no data repository on W Social’s Personal Data Server, contains users’ email addresses – unless a user has chosen to use an email address as their handle or display name.
2. Legal basis for public information
Do users understand what information becomes public when they verify, and why does W Social publish more than a simple “verified” status?
There are many ways to build a social network, and many of them work without any verified information about who is behind an account. W Social was built to do something different. Our core idea is trust: knowing that there is a real, verified person on the other side of the conversation, and having a general sense of who they are – their nationality, their approximate age range and, if they choose, their name. That is why verification and its visible results are a core part of our service.
This begins with a choice during verification. Users decide whether to verify with or without their name, and the screen explains exactly what each option means.1
Verify your identity: “Share your name, nationality and year of birth with W Social. Your full name, nationality and age group are public.”
Verify without name: “Share only your nationality and year of birth with W Social. Your nationality and age group are public.”
Context: October 9, 2026 5:26 PM GMT
Although they make absolutely no mention of having made any new changes in their four-page document, their own screenshot posted days prior shows that the consent dialog had significantly different wording.
While I certainly welcome the change, I find this omission extremely misleading, and I think it’s necessary for context in order to avoid making any false accusations against W Social’s critics.
Verify you’re human
Your data is safe in W Identity – only your chosen data is shared with W Social.
Verify your identity
Provide your name, nationality, and year of birth to W Social. Your real name will be visible publicly.
[ID icon] Verified human
[Checkmark icon] Verified name
Verify without name
Provide only your nationality and year of birth to W Social. Both will display publicly as nationality and age group.
[ID icon] Verified human
Screenshot of new consent dialog
The screenshot is embedded in the second page of the document. I’m sorry the image is very low-resolution, but this is what happens when they post it in this format.
Verify you’re human
Your data stays safe in W Identity. Only what you choose is shared with W Social.
Verify your identity
Share your name, nationality and year of birth with W Social. Your full name, nationality and age group are public.
[ID icon] Verified human
[Checkmark icon] Verified name
Verify without name
Share only your nationality and year of birth with W Social. Your nationality and age group are public.
[ID icon] Verified human
We respect your privacy. Read our Terms and Privacy Policy to learn how the decentralised W Identity app processes and stores your data.0
Consent dialog: Before and after
Here are the same screenshots side by side for comparison:
Verify you’re human
BEFORE: Your data is safe in W Identity – only your chosen data is shared with W Social.
AFTER: Your data stays safe in W Identity. Only what you choose is shared with W Social.
Verify your identity
BEFORE: Provide your name, nationality, and year of birth to W Social. Your real name will be visible publicly.
AFTER: Share your name, nationality and year of birth with W Social. Your full name, nationality and age group are public.
[ID icon] Verified human
[Checkmark icon] Verified name
Verify without name
BEFORE: Provide only your nationality and year of birth to W Social. Both will display publicly as nationality and age group.
AFTER: Share only your nationality and year of birth with W Social. Your nationality and age group are public.
[ID icon] Verified human
We respect your privacy. Read our Terms and Privacy Policy to learn how the decentralised W Identity app processes and stores your data.0
Once a user has made this choice, W Social processes the data to provide its service on the basis of performance of a contract (Article 6(1)(b) of the General Data Protection Regulation), as set out in section 3.2 of our Privacy Notice.
We recognize that this model is not for everyone – W Social is a deliberate choice. For everyone who makes that choice, we want the model to be as clear as possible.
3. Contradictory explanations
Why do the Social Privacy Notice, Terms of Use and Frequently Asked Questions describe the data flows differently?
W Social is currently in public beta. Our Privacy Notice, Terms of Use and Frequently Asked Questions will be revised and aligned before our full launch. The data flows themselves, and our commitment to privacy by design, have remained the same since day one:
- 1.
Users verify in the W Identity app, which is operated by W Identity AB, a separate company. They scan their passport and take a selfie. W Identity checks that the user is a real, unique person and at least 18 years old.
- 2.
Passport images, passport numbers, selfies and full dates of birth are used by W Identity exclusively for this check. They are deleted within one minute, or within 14 days if a manual review by W Identity’s processor, Trust Anchor Group, is required. This data never reaches W Social.
- 3.
What remains is the user’s verified profile in W Identity: the country that issued their passport, their year of birth and – only if they choose “Verify your identity” – their legal name. Users can view this profile in the W Identity app at any time.
- 4.
When a user creates a W Social account, the W Identity app asks them to approve the sharing of their data. Only after this approval does W Social receive the country that issued the passport, the year of birth and, if the user has chosen to share it, their name.
- 5.
W Social converts the year of birth into a synthetic date of birth, so W Social never knows, holds or publishes a real date of birth. The user’s nationality, age range and – if they have chosen to share it – their name are then published on the AT Protocol as their public verification badge.
4. Data breach reporting
Was there a data breach that W Social should have reported to the data protection authority?
There has been no personal data breach within the meaning of the GDPR. In particular, there has been no breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorised disclosure of or access to, personal data transmitted, stored or otherwise processed, as defined in Article 4(12) GDPR.
No personal data have been leaked, accessed without authorisation or inadvertently published. The verification records contain only the information that users chose to make publicly available when creating an account on our platform. We have assessed the matter in consultation with our Data Protection Officer and have documented that assessment.
5. Synthetic birth dates
Why does a verification record show a date that looks like a birth date?
The date in the record is not anyone's date of birth – by design. W Social receives only the year of birth, and we deliberately make it less precise: we take 1 January of that year and shift it by a random offset of up to 24 months. This is an established privacy-enhancing technique (PET) known as data perturbation. It provides an approximate age range, while W Social never knows, holds or publishes a real date of birth.
6. Possible minors
Can people under the age of 18 get an account on W Social?
W Social is for adults only. This is our own choice, not a legal requirement: we deliberately set a higher bar because we want W Social to be a space for adult public conversation and we want to protect minors. That is why W Identity checks every user's age against their passport during verification.
No verification system is perfect. In isolated cases, a person under the age of 18 passed verification. As soon as we identified these cases, we took action and removed the accounts and the associated data. W Identity continuously improves its verification process so that W Social remains a space for adults only.
Because the synthetic date of birth is shifted by a random offset of up to 24 months, a verification record may suggest that a user is younger than they actually are – in some cases, younger than 18.
7. Separation between W Social and W Identity
Are W Social and W Identity really independent of each other?
W Social AB and W Identity AB are separate legal entities and independent controllers. The separation is not only formal – it is built into the architecture, which is what privacy by design means to us.
W Social receives from W Identity only the information required for its service, and only with the user’s approval: a W Identity identifier, the country that issued the identity document and the year of birth – plus the user’s name, if they choose to publish their legal name on W Social. W Social never receives the passport image, the selfie, the phone number, the full date of birth or the full passport data used during verification.
It is true that the two companies share leadership and an address. This is common for a young group of companies at our stage, and it does not change how data flows between them.
8. Verification exceptions and automated content
Are all accounts on W Social verified, and do some accounts post automatically?
Anyone – individuals, organizations and institutions alike – can create an account and explore W Social without verifying. However, to post, comment or interact, all these accounts must be verified. Verified individual accounts display a visible verification badge. As part of our current beta phase, we are developing a dedicated verification badge for organizational and institutional accounts.2
Some accounts may post automatically. However, automated publishing and bots are not the same thing. Many established media organizations and institutions publish their content across several platforms at once, and it is common for them to use publishing tools that share new articles automatically. Some accounts on W Social may well work this way – this is standard practice in professional publishing on every social network.
Some private individuals may also run their accounts automatically or share content generated with artificial intelligence. This is lawful and does not violate our Terms of Use.
A bot farm is something else entirely. It conceals who is behind it, simulates real people and coordinates large numbers of fake accounts to generate artificial engagement and shape public opinion. That is exactly what endangers public debate and democracy – and exactly why W Social requires verification in the first place. A newspaper posting its own articles under its own name is the opposite: a known sender, publicly identifiable, with editorial responsibility for what it publishes – and, as set out above, verified. On a young network in beta, it is natural that professional publishers account for a large share of posts while the community grows.
9. European positioning and open source
Is W open source, and how independent and European is it really?
W Social is built on the AT Protocol, an open protocol for interoperable social media. It allows compatible applications and services to communicate across a shared network and gives users the freedom to choose where and how they take part.
Like other services built on the AT Protocol, W Social is made up of different components. Some are based on open-source software, some are developed specifically for W Social, and some are licensed from third-party technology providers. W Social is not currently a fully open-source application, and technology developed specifically for W Social will not automatically be published as open source.
In the early development of W Social, the repositories we forked were publicly accessible. We later made them private while we reviewed security, privacy, licensing, intellectual property, documentation and commercial considerations. We will republish the forked repositories – including our improvements, integrations, bug fixes and technical documentation – once they have been properly reviewed and are ready for responsible release. We comply fully with all applicable open-source licences.
W Social is European-owned, hosted on European infrastructure, and its decisions are made in Europe. Under our shareholders’ agreement, only European shareholders hold voting rights. Our Advisory Board brings international expertise in media, technology, privacy and compliance, which we consider a strength for a platform with a global user base. We engage openly with European Union institutions on compliance, age verification and digital identity. We remain committed to open standards, interoperability and genuine user choice, and to contributing responsibly to the AT Protocol ecosystem – not least by bringing new users to it.