Thought Leadership
The new European platform W aims to combat bots through identity verification. Security researchers warn of privacy risks.
The new European social platform W is being developed as an alternative to the social network X, with the goal of reducing automated bot activity and targeted disinformation. The registration process requires identity verification as a prerequisite for posting content and comments. Reading content and following accounts will remain available without verification for all users. However, anyone who wants to actively participate must provide identity documents or passport numbers as well as biometric data in the form of selfies via a separate companion app called W Identity. The platform also offers an option to anonymize the user’s identity in public-facing contexts.
According to CEO Ingmar Rentzhog, all biometric information and documents are deleted from central servers immediately after the verification process is completed. Due to the decentralized architecture of the W Identity app, the data remains stored locally on the user’s device. The actual social media platform, according to the operator, does not have access to this data unless the user explicitly grants permission.
Concerns Over Immutable Identity Data at the Platform W
Security researchers nevertheless express significant concerns about the handling of sensitive and immutable identity data. Since biometric features and passport numbers cannot be changed like passwords in the event of a breach, they represent a permanent target for criminal activities such as identity theft or credit fraud.
As a concrete example, experts point to the application Tea, where despite contractual assurances of deletion, thousands of ID photos were later discovered in a publicly accessible database following a data breach. IT security researcher Arnoldas Radišauskas commented:
“We have seen this model fail again and again. Tea promised to delete IDs after verification, but years of passports and selfies ended up in an open database.”
IT security researcher Arnoldas Radišauskas
(ll)
