How W Social Makes Their Verified Users Personal Details Visible on the Open Web

On Friday October 9th, German journalist Gavin Karlmeier released the latest episode of his podcast “Haken dran” and shared an exclusive scoop: an anonymous source discovered that the social media company W Social is publishing to the world wide web the legal names, nationalities and approximate dates of birth of their verified users, in plain text. This information is viewable by anyone with an internet connection and can be easily downloaded as a .csv file by people with a bit of tech savvy.

When approached by Karlmeier, W Social representatives responded that this is not an unauthorized data leak, but rather, that the information “public by design” and allegedly shared with the informed consent of their users.

Interestingly, nearly all the promotional materials and public communications by W Social and W Identity up to now stated the exact opposite, giving the impression that government ID data provided to verify one’s account would be immediately deleted - and that it would be impossible to link one’s real identity (shared with W Identity) to one’s social profile (shared with W Social).

My research into this topic has surfaced troubling examples of a potential breach of trust and privacy of W Social users, as well as glaring contradictions and false promises by W Social leaders.

Before we get started unpacking all this, I must make a disclosure: my research and reporting are entirely self-funded (with the help of family with childcare on Sunday). It’s important I share this, as W Social leaders doubled-down in public communications on social media, aggressively responding to critics asking “who is funding you?” and insinuating competing PDS owners may be conspiring to attack W Social.

No, the real story is much simpler: W Social has been mired in controversies of their own making (numerous tech and communications blunders) since their launch in Davos in January. I find the discrepancy between the media hype and reality fascinating, which is why I write about them. With this particular incident, I find it’s important to raise awareness about how W Social is treating their users’ data, as many are completely unaware that their information is now “open data” on the web.

A quick recap about W Social and W Identity

W Social is a European social media company that launched in Davos earlier this year, during the World Economic Forum. I have written a series of articles about them; if I were to recommend just one, it would be this:

W Social is powered by ATproto and is thus federating with the rest of the “Atmosphere” (Bluesky, Eurosky, Blacksky, Northsky and other PDSs that run on ATproto).

W Social used open source code but quietly went closed source sometime in May of this year, à la Truth Social.

W Social's unique selling proposition is that they are hosted and managed in Europe and they require government ID verification in order to post and use all the functionalities of the network (like translation tools, content moderation, or logging into their mobile app). On their official website they state:

We believe in the need for a global, trusted social media platform owned, run, and hosted in Europe. W is built on verified human users, transparency, privacy, and free speech.

W Social’s PDS (Personal Data Server) holds about 47 thousand accounts (as of October 13, 2026) but that number doesn’t tell the full story: only about 10300 people have verified their accounts with government IDs and to this day, only about 4289 (as of October 13, 2026) have ever published a single post or reply.

In order to verify one’s account with government ID, a user has to go through a 13-step verification process using the app W Identity:

W Identity’s app reviews on the German Google Play store are disastrous with an average of 1.1 stars out of 5 and 268 reviews (to this day) that lament being unable to go through verification because the passport scan fails to work.

Many prospective W Social users end up reaching out to support via email and verifying their identity via a video call. Please keep in mind this detail because it will come back later, in a relevant way.

The CEO of W Social is Anna Zeiter, whose previous role was “Chief Privacy Officer” at eBay Inc. Zeiter is also a lawyer and professor at the University of Bern, holding classes in European Data Law. I believe Zeiter was approached and offered the role of CEO of W Social because of her background in law and privacy, as a way to reassure prospective W Social users that their data would be safe in the hands of W Social and W Identity. This is what made the recent revelations so startling.

The Haken Dran Revelations: “Public by Design”

In his podcast Karlmeier said:

I confronted W Social about the [public] list and asked: ‘Can you tell us anything about it? How are you handling it? Could this be a breach of the General Data Protection Regulation, the GDPR? Could it be a mistake? Did you change something on September 19 [sic] that caused this list to appear? Is this even what you want?’ W Social replied: ‘This is public by design.’ They say that this is how it’s meant to work: they want a public network, and because it’s based on an open protocol, the data is public too. In their statement, they also said they’re planning to release a new app where this data may also be visible—namely, the birth name and birth year.

This is an interesting twist, as I have been closely following W Social since their controversial launch in Davos in late January 2026 and virtually all their messaging about government ID data and how it was handled was very different.

I cannot recall a single instance of anyone at W Social stating that the full names, birth years and nationalities of their verified users would be collected in a public list that would be readily accessible to anyone with an internet connection.

It would have made sense if the information would have remained within the confines of W Social, displayed to logged in users.

What makes this development so sensational is that thousands of verified W Social users, who consented to have their names, nationalities and years of birth shown inside W Social now have that information collected outside of the network, in a public list, in plain text, on the open web, and easily downloadable for anyone with modest development skills (or inclined to enlist the help of an AI assistant). So basically, anyone.

This is how the data of verified W Social users appears online, on the website pdsls.dev (I'm not sharing a direct link to the list on purpose):

This is how the data of verified W Social users appears in a .csv file:

The .csv file has columns listing an account's decentralized identifier (did), the date of verification, the type of account (personal, bot, organization or test), first names ("given"), last names ("family"), nationalities, approximate birth dates (starting with the year), amongst other fields.

Claims made in March 2026: “W Social and W Identity are completely separate and do not share user data”

In a presentation at AtmosphereConf in Vancouver in March 2026, the lead developer at W Social Jan Lindblad explained how W Social and W Identity work:

We’re building the whole system around two separate domains. One part is run by a separate company and is called W Identity. It scans your passport and stores information about who you are locally on your phone. It will know your nationality, birth date, and full name. In some countries, it will know your social security number. It will have a photo of your face, but it won’t share that information with W Social. W Social is a separate app and a separate company. It knows about your online life—your posts, friends, likes, and so on—but it won’t know who you are. The only thing that links the two is this UUID: a 32-digit random number, basically. On the W Identity side, you’ll know that someone is human, but not who they are on social media. On W Social, you’ll know that someone is a real human, but not who they are. We’re also planning to share someone’s nationality and birth year, although we’re not doing that right now.

The “two separate companies” claim has been debunked in the past, as both W Social and W Identity share the same address and the same people on their board. I knew that it was Trust Anchor Group that was subcontracted to do the identity verification on behalf of W Social, so I never put too much thought into it. But the recent revelations about how their verified users’ data is handled is casting doubt on every single statement made about the two companies.

In the screenshot of the .csv file I shared earlier, you can see the “did” information of each user that precedes their first and last names. All you have to do to find out their username on W Social is to copy and paste the did into a website like atproto.at. It is therefore misleading - in my opinion - to claim that account information and real identities are separate. All the information is combined and easily searchable.

Claims made in May 2026: “government ID data only stays on one’s device and is immediately deleted from W Social’s servers”

W Social CEO Anna Zeiter was a guest on Gavin Karlmeier’s podcast in May and back then she made some statements that contradict the current situation.

On May 15th, Anna Zeiter said (starting at 52:30):

There is a great deal of pushback, particularly because some people misunderstand the issue. They get the impression that “we need everyone’s IDs and then store them, but it isn’t clear what purposes they’re being stored for.” What we want to know is: Are the people coming to us human, and are they over 18? It’s like checking people at the entrance to a club: Are you a human, and are you over 18?

Zeiter continued:

We don’t store the data afterward. We don’t want to build a government database of identity documents. The less data a company has, the less data there is that can be lost. It’s not in my interest to store people’s ID data, because that could eventually lead to a data breach—something we obviously don’t want.

Zeiter explained how ID verification works:

This service is provided by the Trust Anchor Group through the W Identity app. The provider only tells us: “User 123 has just signed in, and User 123 is a human.” All I see is an encrypted token—an encrypted hash token—that cannot, so to speak, be reverse-engineered. So if law enforcement, the FBI, or the CIA were to come to me one day and say, “User 123 has made critical comments about Trump. Who is User 123?”, I could say, “Look at my servers. There’s nothing to be found there.” On the service provider’s side—the Trust Anchor Group—the data is deleted shortly after verification. That is the promise, at least initially: Nothing is stored.

You can imagine that having watched these videos, I was really surprised by the recent revelations that certain identifying details like full legal names, nationalities and approximate date of birth are not only stored but also published on the web for anyone to see.

ATproto developer Kuba Suder astutely pointed out that there is no option to make one's nationality and approximate age private; a requirement of W Identity verification is to always display these two pieces of information, whereas using a real name is optional.

After thinking about this over and over for several days, I am now wondering if the sentence "we don't store ID data" refers to users' passport numbers - which could very well be immediately deleted from Trust Anchor Group's servers. So maybe when Zeiter said "ID information stays on one's phone" this referred to a passport number? Because otherwise there is no way to explain how a user's DID (decentralized identifier), first name, last name, nationality and approximate birthday are all collected in one place.

Claims from October 2026: "it’s a feature (not a leak)!"

5 hours after Gavin Karlmeier’s podcast went live with the scoop that identifying data of verified W Social users was being published in the clear in the Atmosphere, the official W Social account posted a thread:

We’ve upgraded W’s verified badge to give you more context about the person behind the keyboard. Real humans. More trust. Your real name stays optional.

And:

Click the ID icon on a profile to see:
• Verified name, if the person chose to share it
• Age range
• Nationality used for verification
You chose what to share during verification. The upgraded badge now displays those details.

They continued:

3/5
Keep your real name private and still be a verified human. W Social receives your real name only if you choose to share it, and your birth year and nationality, never your exact birthdate. Your profile only shows an age range. All users agree to what is shared publicly during verification.

The timing of this announcement (without addressing directly Karlmeier’s revelations) was fascinating.

As I mentioned earlier, anyone can download W Social’s verification list as a .csv file. There are now over 10 thousand verification records for W Social but the ones revealing the full name, nationality and approximate birth date of users are recent. The first full record showed up on September 17th, 2026 at 10:59am.

So this so-called “intentional feature” had been out for over 3 weeks but it has been officially acknowledged and announced only hours after the scoop by Gavin Karlmeier on his podcast. At the risk of editorializing, I’m not sure I would call this the proper way to do corporate communications or data handling.

After hearing the revelations shared on the Haken Dran podcast, I posted the following message on the Atmosphere:

Dear friends who don't speak German: Go to YouTube ASAP, turn on subtitles → autogenerated translation and watch this video! TL;DR: #WSocial is posting legal names, nationalities and approx. birthdays of verified users as a public record on the Atmosphere. Confronted, they claim it's "by design" 🤯

The official W Social account replied to my post with this message:

“Public verification details are available to other AT Protocol communities, just like public posts and profiles. W is an open network: the context users agree to publish travels with their profile. Only your age range is public, never your birth year or exact date of birth.”

Problem is, when you look at the “Approximate Birth Date” details on the .cvs file, there is an approximate birth year. W Social says the real date is +/- 12 months, in a 24-month range. So the information they share is quite specific:

Anonymous users & public records

Assuming that what W Social representatives are saying is true and that they have the full informed consent of their users in sharing their first name, last name, approximate date of birth and nationality as a public record on the open web, well, there are still some puzzling elements to consider.

Examining the full list of public records of verified accounts, I found several instances where a person had used a pseudonym for their username and display name… but their legal first and last name were visible in the public verification list. By several I mean: over a dozen, just by doing a casual check. I'm using a made up example, so I don't further expose people who are unaware their details are out: imagine an Italian user who has "Calimero" as his username and diplay name on W Social, but in the public verification list, there are additional fields for his full name, revealing he's "Mario Rossi", born in 1975. The information displayed on W Social make me think he values privacy, but because of the list, I now know identifying details about him.

I wonder: are W Social verified users aware that their personal details (first name, last name, nationality and approx. birthday) are being shared OUTSIDE of W Social and published as a permanent record on the web, in plain text?

Sloppy note-taking? A second birthday in the name field

Remember how earlier I wrote that manual verifications are the most common method of verification because the W Identity app does not work for most users?

I have found evidence in the .csv download of “sloppy” note taking, with at least 5 accounts that have a full birthday next to the person’s last name - a different birthday compared to the one in the “approx. birth date” field, which could very well be the real birthday of the person concerned… where the manual verifier potentially forgot to delete the data.

I also found 8 records with digits next to a person’s last name; I suspect they may be fragments from the real birthday of the user concerned (the day of the month they were born, as some go up to 24)… a detail that the person doing the manual verification forgot to delete.

Public reactions

Public reactions to these revelations have been widespread condemnation of the nonchalant way that W Social is treating this matter.

The official account of Fedica, a social media management company, replied to one of the W Social comments with this post:

We've been doing social media analytics for well over a decade, no other social media platform provided public age data per account like this Facebook has user_birthday but users must authorize the app to read their own data, not of any account! Have we not learned anything from Cambridge Analytica

And Fedica’s founder doubled-down with a post stating: “I am sorry, but what
@wsocial.eu is doing here is very irresponsible.”

Could a different technical implementation preserve the privacy of W Social’s users?

As soon as I learned about this implementation that exposes the private data of verified users to the world wide web, I began wondering: was there another, better way to do things?

Several developers commented that if the information had been posted on W Social’s own AppView, available only for those inside their networks, this “leak that’s not a leak” would have been mitigated. But others replied that there could still have been ways to download and disseminate the data.

I reached out to an experienced ATproto developer asking for a comment about this matter; they wished to remain anonymous and shared these thoughts:

For me, the main issue is that having this kind of feature where you can make your full name, age, and nationality public is inherently dangerous, regardless of how exactly it's implemented technically. Even on Bluesky, a lot of users aren't initially aware how much of their data (including e.g. their likes and blocks) is public and can be browsed on other sites. From what I have seen, a lot of W Social users aren't aware that they're a part of the same network as Bluesky and are surprised to see Bluesky users reading their posts and replying to them. This implies that W isn't doing a good job of explaining to their users how the system works and who can see their data, so I have a strong suspicion that the users would also be surprised to hear that anyone outside of W can also see their full name and nationality.

Thorny GDPR questions

Does W Social have the informed consent of their users when it comes to sharing their full legal names, nationalities and approximate date of birth on the world wide web?

Is the current technical implementation by W Social and W Identity a GDPR violation? German writer and podcaster Sascha Pallenberg has explored these questions in a recently released article:

When I shared Sascha's article on Mastodon, a follower sent me a private message and told me that they (I'm using the "they" pronoun to safeguard their privacy) had tried to reach out to W Social's DPO (data protection officer) multiple times in order to receive clarifications about how user data would have been handled. They had to send several queries because their original message was never replied to. Finally, 2 months and 4 messages later, the DPO of W Social replied:

Hello [redacted],
On recipients: we share data with processors under data processing agreements, covering hosting, email, identity verification, and support. Trust Anchor Group AB is the processor supporting our verification infrastructure and handle manual reviews where automatic checks can't complete.
On international transfers: we don't currently have any transfers of personal data outside the EEA — processing and storage stay within the EEA. Should that change, we'd only transfer data under an appropriate safeguard (an EU Commission adequacy decision or the Standard Contractual Clauses, plus supplementary measures where needed), in line with GDPR Chapter V.

It's worth emphasizing this sentence: "we don't currently have any transfers of personal data outside the EEA — processing and storage stay within the EEA." EEA stands for European Economic Area. And the statement fails to address that open data means that records are published in the clear on the open web, available for all to see, in any country around the world.

The message was sent in late August and W Social began to publish ID information on their repository in mid-September. Could this be the cause of the misalignment? Was the W Social DPO unaware that identifying information would have been published on the world wide web in the near future?

So many unanswered questions. I'm eager to see what the official response by W Social will be. For now they have simply posted a vague message on the Atmosphere stating:

W is currently facing a wave of criticism that mixes false accusations, disinformation, distorted facts with legitimate questions. We will publish a detailed memo in due course to address the claims and set out the facts.

Thanks for being here,

Elena