A privacy-respecting social network collects only the data it needs, keeps posts private by default, lets users export and delete their data, and publishes its code for inspection. Federated, open-source platforms such as Mastodon and Matrix come closest to that standard.
Many of these platforms belong to the wider family of the open source social network, where the software can be audited and run by anyone.
What makes a social network privacy-respecting?
Privacy is not a single feature. It is a set of design choices about what a service collects, who can see it, how long it stays, and whether a user can leave with their data. European law gives a useful checklist, because the General Data Protection Regulation (GDPR) turns those choices into legal duties for anyone who runs a service for people in the EU.
Article 25 of the GDPR requires data protection by design and by default. The text says that “by default, only personal data which are necessary for each specific purpose of the processing are processed”, which is the legal form of data minimisation (GDPR Article 25). The same article adds that measures must ensure personal data “by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons”. In plain terms, a new post should not become public unless the person chooses that.
Consent has its own rule. Under Article 7, a user may withdraw consent at any time, and the regulation states that “It shall be as easy to withdraw as to give consent” (GDPR Article 7). Services that bury opt-outs several menus deep fail that test on its face.
A practical checklist for judging any platform:
- Data minimisation: the service asks for little more than a handle and a way to log in.
- Private defaults: audience controls exist and posts do not spread without the author’s choice.
- Portability: a full export and a supported way to move accounts.
- Erasure: a delete function that actually removes content.
- Open code: the software can be inspected, and users can run their own server.
- Encryption: private conversations are unreadable to server operators.
Legal rights that shape privacy on social platforms
Two GDPR rights matter most when comparing platforms: erasure and portability. Article 17 gives people the right to have personal data deleted. According to the regulation, “the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies” (GDPR Article 17). Where data was made public, the controller must also “take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of” it. That clause is awkward for federated networks, where copies of a post sit on many independent servers.
Article 20 covers portability. A person may receive their data “in a structured, commonly used and machine-readable format” and transmit it to another controller without hindrance (GDPR Article 20). The article also allows direct transfer between controllers “where technically feasible”. Open protocols make that feasibility far more realistic than closed ones.
The penalties give these rules weight. Article 83 sets fines for breaches of the basic processing principles and consent conditions at up to 20 000 000 EUR, or for an undertaking up to 4 % of total worldwide annual turnover of the preceding financial year, whichever is higher (GDPR Article 83).
These rules apply to people who operate servers, not only to corporations. Anyone hosting a community instance that serves EU residents takes on the role of controller, which is one reason small operators publish clear privacy policies and moderation rules.
How Mastodon handles audience, moving and deletion
Mastodon is the best-known federated microblogging platform, and its documentation shows how privacy controls work in practice. Posts have visibility settings. The platform’s network guide explains that “In Mastodon, private mentions are just posts that have the” mention-only visibility selected (Mastodon network features). Content that is not public is treated differently by search and discovery, including “followers-only posts,private mentions, and posts from servers that require authorization.” Bookmarks also stay quiet: “The post will be privately added to your bookmarks list without generating a notification.”
Mastodon also supports public discovery, with “a way to browse all public posts”. That is a reminder that anything posted publicly is public by design. Private mentions are not end-to-end encrypted, so server administrators can technically read them. Sensitive material belongs in an encrypted tool instead.
Leaving is where open platforms differ most from closed ones. The moving guide says that “you can migrate your account to a new server and preserve much of your account content and relationshi”ps when a server shuts down or changes policy (Moving or leaving accounts). The process is manual but documented: create a new account, export the list of people you follow, import it, then redirect the old account. Profile moves “can only be initiated when your two accounts have been aliased”, and followers who require approval “will have to re-approve you”.
Deletion travels across servers through the ActivityPub protocol. In Mastodon’s implementation, a Delete activity will “Remove an account from the database, as well as all of their statuses.” A Flag activity is “Transformed into a report to the moderation team” (Mastodon ActivityPub documentation). Deletion depends on remote servers honouring the request, so it is a strong norm rather than a technical guarantee. That is the same tension the GDPR erasure clause describes.
Matrix and end-to-end encrypted conversations
Matrix approaches privacy from the messaging side. Each user has an account on a homeserver, and servers replicate room history among themselves. In the project’s worked example, the homeservers of three people briefly hold different views of a conversation, yet Matrix “is designed to handle this inconsistency” and the servers converge (Elements of Matrix).
Encryption is the privacy layer on top. The Matrix guide states that “End-to-end encryption in Matrix is based on the Olm and Megolm cryptographic ratchets” (Matrix end-to-end encryption guide). Each device has its own Ed25519 key pair for identity and signing, plus a long-lived Curve25519 identity key. The guide stresses that “the private key should never leave the device”, while the public part is signed and published. Devices also create “a number of Curve25519 key pairs which are also used to establish Olm sessions, but can only be used once.”
The practical result is that a server operator can relay and store encrypted rooms without being able to read them. A person who wants conversations hidden even from a friendly administrator gains more from Matrix rooms with encryption turned on than from a federated microblog.
Choosing and running a private social service
The right choice depends on the threat. For public conversation with strong portability, a federated microblog works well. For private groups, an encrypted messenger is better. The wider field of social network alternatives includes both, as well as forums and photo-sharing tools.
The federated model is explained further in the guide to the decentralized social network. Several habits improve privacy on any of them:
- Read the server’s privacy policy and moderation rules before signing up, because the administrator sees more than other users do.
- Use private or followers-only settings for personal posts, and remember that private mentions are not encrypted.
- Export data from time to time, so that a server shutdown does not mean starting from scratch.
- Use encrypted rooms for anything sensitive, and verify devices.
- Consider running a personal instance only if willing to maintain security updates, since the operator becomes the data controller.
Operators who want to reduce exposure further can serve a site over Tor. Mastodon’s documentation says that “Mastodon can be served through Tor as an onion service”, giving an address “that can only be used while connected to the Tor network” (Mastodon onion services). This protects the network path but does not change what the server stores.
Federation also has limits worth knowing. Because posts are copied to other servers, a person has to trust every server that receives them. Mastodon’s documentation notes that incoming HTML is cleaned, since “Mastodon sanitizes incoming HTML in order to not break assumptions for API client developers”, which helps security but does not limit who can read public posts. Judging privacy therefore means looking at the whole chain: client, home server, remote servers, and the people who follow you.
Frequently asked questions
Is a federated network automatically private?
No. Federation spreads control across many servers, but public posts are still public and administrators can read unencrypted messages. Privacy depends on settings, the operator’s policies and whether encryption is used.
Can a deleted post be removed from every server?
Not with certainty. Delete requests travel between servers through ActivityPub, but each remote server decides whether to honour them. The GDPR erasure clause asks controllers to take reasonable steps to inform others.
Does open-source software guarantee privacy?
No, but it allows anyone to inspect how data is handled and to run their own server. Open code makes claims checkable, which closed platforms do not permit.
Can accounts be moved between servers?
On Mastodon, yes. Users create an alias, export and import follow lists, and start a profile move. Followers who require approval must approve the new account again.
