Who Owns Your Social Media Identity? The Battle for Control of Online Audiences

The audience you built but cannot take with you

The following scenario is hypothetical. It describes no real person or documented incident.

A wildlife illustrator has spent seven years on a large commercial social platform. She posts sketches, process videos and time-lapses of finished paintings. Over those years she has accumulated a following in the hundreds of thousands, and that audience has become the backbone of her business: commissions, print sales, workshop sign-ups and a book deal all trace back to it.

Then something changes. Perhaps the platform revises its policy on links to external shops and her posts directing people to her store begin to perform poorly. Perhaps an automated system misclassifies one of her anatomical studies and her account is restricted while an appeal sits in a queue. Perhaps the platform simply retunes its recommendation system towards a format she does not produce. Whatever the cause, the effect is the same: the number beneath her name barely moves, but the number of people who see what she posts collapses.

She still owns every drawing. Copyright in her work never left her. What she discovers is that she owned less than she thought. The followers were real people who chose to follow her, yet she has no independent way to reach them. She cannot download a list of their email addresses, cannot send them a message outside the platform, and cannot take the relationship elsewhere. Her audience existed as a set of connections inside someone else's database, and the right to address those connections was never hers to begin with.

The gap between owning content and controlling an audience is the subject of this investigation. It is a gap that runs through law, software architecture and economics, and it is the gap that a new generation of open social protocols claims, with varying degrees of credibility, to close.

What it actually means to "own" an account

The wThe audience you built but cannot take with youord "ownership" is used loosely in discussions of social media, and much confusion comes from collapsing several different relationships into one. They are better separated.

Intellectual property in content. On most major platforms, users retain copyright in what they post. The terms of service of X, for example, state plainly that users retain their rights to their content. This is the strongest form of ownership a user has, and it is genuine: the platform does not acquire title to your photographs or writing.

The platform licence. In the same terms, users grant the platform a broad licence — typically worldwide, royalty-free and sublicensable — to host, display, adapt and distribute that content. X's terms, as revised in recent years, also extend that licence to training its AI systems. Ownership and licence coexist: you own the work, and the platform has wide rights to use it.

Account access. The account itself is not property in any ordinary sense. It is a service provided under contract, and platform terms generally reserve the right to suspend or terminate accounts for breaches of rules — and sometimes at broader discretion. Losing an account does not transfer your copyright to anyone, but it can remove your ability to publish where your audience is.

Username control. Handles are usually not owned either. Platform terms commonly reserve the right to reclaim usernames, for instance for inactivity, trademark disputes or policy reasons. A brand built on a handle is built on a revocable permission.

Data export. Most major platforms allow users to download an archive of their own data. In the European Union and the United Kingdom, the General Data Protection Regulation's right to data portability gives individuals a legal right to receive personal data they have provided, in a structured, machine-readable format, where processing is based on consent or contract. That is significant, but its scope is limited: it concerns personal data, not other people's relationships with you.

Audience relationships. Here ownership is weakest. A follower list may appear in an export, but it is a list of account identifiers on that platform. It does not carry consent for contact outside the service, and data protection law constrains how one person may process another's personal data.

Distribution rights. Finally, there is the question no contract grants: the right to have your content shown. Platforms decide what appears in feeds, and nothing in standard terms obliges them to deliver posts to followers.

These categories are not interchangeable. A creator can hold full copyright, possess a complete data archive, and still have no meaningful ability to reach an audience. Which rights apply also depends on jurisdiction and platform: contract terms differ, consumer protection rules vary, and the European Union's Digital Markets Act imposes additional portability obligations — including continuous, real-time data access — only on services designated as gatekeepers.

The social graph as infrastructure

The social graph is the network of relationships among accounts: who follows whom, who is connected to whom, and — in richer versions — who interacts with whom, how often and in what ways. In computational terms it is a directed graph, with accounts as nodes and relationships as edges. In economic terms it is one of the most valuable assets a social platform holds.

It helps to distinguish layers. A follow is a declared, one-directional relationship. A connection on some services is mutual and requires consent from both sides. Interactions — replies, likes, reposts, views, time spent — form a much denser behavioural graph that platforms use to infer interest and affinity, often more informative than the declared follows themselves. Recommendations are generated from all of these, together with signals about content and context.

This layering explains why a follower list is not a portable audience. Even if a creator could export the identifiers of everyone who follows them, those identifiers mean something only inside the system that issued them. The edges point to accounts on one platform; outside it they point nowhere. And the behavioural graph — which determines whether those followers actually see a post — is not exported at all, because it belongs to the platform's ranking infrastructure, not to the user.

Network effects turn this into dependence. A social platform becomes more useful to each participant as more of their contacts join, and the cost of leaving rises with every relationship established inside it. For an individual, the cost is social: friends and communities are elsewhere. For a creator or publisher, it is economic: the audience that pays the bills is on the platform and nowhere else. Moving alone achieves little, because the value lies in the graph, and the graph does not move with you.

It is therefore worth separating two things that are easily conflated. The relationship — a person's decision to follow another — is a social fact that exists between people. The distribution channel through which one party's posts reach the other is a technical service operated by the platform. Users hold some claim to the first. They have almost no claim to the second.

How platforms control distribution

In the early years of social media, many services showed posts from followed accounts in reverse chronological order. Most large platforms now rely heavily on algorithmic feeds: ranked selections that mix posts from followed accounts with recommended content from accounts a user does not follow. Several platforms still offer a chronological or "following" view as an option, but the default experience on the largest services is ranked.

The practical consequence is that audience size and reach are different metrics. A follower count measures how many accounts have opted into a relationship. Reach measures how many people actually saw a given post. On a ranked feed, the second depends on signals the creator does not control and often cannot see: predicted engagement, the format of the post, the recency of the account's activity, the behaviour of other users, and policy decisions about what kinds of content to promote or limit. Platforms describe their ranking systems in general terms, and some publish transparency documentation, but the systems differ between services and change frequently; claims about precise ranking rules should be treated with caution unless they come from the platform or from rigorous independent study.

Moderation and visibility controls add a second layer. Beyond removing content or suspending accounts, many platforms apply intermediate measures — reduced distribution, exclusion from recommendations, labels or interstitials — that can lower reach without the account owner necessarily being notified in detail. In the European Union, the Digital Services Act now requires very large online platforms to explain such restrictions to affected users and to provide routes for appeal, which has increased transparency without removing platforms' discretion.

APIs are the third lever. Third-party tools that once let creators schedule posts, analyse audiences or cross-publish rely on platform interfaces whose terms can change unilaterally. X's decision in 2023 to end free access to its API and introduce paid tiers is a well-known example: it disrupted many tools and researchers that had depended on that access.

Finally, data portability is narrower than it looks. A downloaded archive typically contains a user's own posts, media and account data, and perhaps lists of accounts followed and following. It rarely contains anything that can be used to reconstitute the audience elsewhere. Portability of data and portability of the social graph are different capabilities, and most centralised platforms offer only the first.

Two protocols, two theories of identity

Decentralised social networks attempt to separate the social graph from any single company. The two most prominent open protocols — ActivityPub and the AT Protocol — approach the problem in fundamentally different ways, and the differences matter more than the shared label.

ActivityPub: federation by server

ActivityPub is a W3C Recommendation, published in 2018. It defines how servers exchange activities — posts, follows, likes, replies — using a common vocabulary (Activity Streams 2.0). A network of interoperating servers, collectively known as the fediverse, includes Mastodon, Pixelfed, PeerTube, Misskey and its forks, WordPress sites with the relevant plugin, and partially Threads.

Identity in ActivityPub is tied to a server. An account is identified by a URL on the server that hosts it, and is usually displayed as a handle such as @name@example.social. Content lives on that server. Followers on other servers subscribe to the account's outbox, and the hosting server delivers new activities to them. Moderation is distributed: each server sets its own rules, moderates its own users, and decides which other servers to federate with or block. This makes server administrators powerful local governors.

Because identity is anchored to the server, changing servers means changing identity. The protocol ecosystem addresses this with a "Move" activity, which software such as Mastodon implements: the old account announces that it has moved, and followers' servers that support the activity automatically switch their follow to the new account. This is real, working social graph portability — but, as the next section explains, it is partial.

AT Protocol: identity separate from hosting

The AT Protocol, developed by Bluesky, takes a different approach. Each account has a decentralised identifier (DID) — most commonly a did:plc, registered in a public directory, or alternatively a did:web tied to a domain the user controls. The DID document says which server currently hosts the account's data and which keys can sign updates. The human-readable handle is a domain name that resolves to the DID, which lets users verify their identity with a domain they own.

An account's data lives in a signed repository held on a Personal Data Server (PDS). Crucially, the repository contains the user's own records — posts, likes and follows of other accounts — and because those records are cryptographically signed and addressed by the DID rather than by the server, they can in principle be moved to a different PDS without changing the identity. Other services in the network, such as relays that aggregate data and AppViews that build timelines, learn about the move when the DID document is updated.

The AT Protocol also separates functions that ActivityPub tends to bundle together. Hosting (the PDS), aggregation (relays), application logic (AppViews), feed generation (custom feeds) and moderation (labelling services that users can subscribe to) are distinct components that different operators can run. In practice, Bluesky's own infrastructure dominates most of these layers today, so the architecture's separation of powers is more advanced in design than in market structure.

Protocol is not application

It is essential to distinguish what a protocol allows from what a particular application implements. ActivityPub does not specify how account migration must work; Mastodon's implementation does. The AT Protocol makes repository migration possible; whether a given PDS accepts incoming migrations, and whether migration tools are easy to use, depends on operators and software. Statements about "the fediverse" or "Bluesky" often attribute to the protocol what is really a property of one implementation.

Can followers really move with you?

Portability is not a single capability but a bundle, and different systems deliver different parts of it.

On Mastodon, according to its documentation, a user can export a list of accounts they follow, create an alias between old and new accounts, and then initiate a move. The old server notifies followers' servers, and those that support the Move activity automatically switch the follow to the new account; on large accounts this may happen gradually. That is the social graph moving — but only the incoming half automatically. Accounts the user follows must be re-imported from a CSV file, and accounts that require follow approval must approve again. Posts do not move: Mastodon's documentation says it does not support importing posts or media, so the old posts remain on the old server, with the profile redirecting to the new one. A cooldown period of 30 days applies before another move. Some other fediverse software can import post archives, but typically by recreating posts as new objects, which breaks the threads and conversations attached to the originals. Followers on servers that do not implement the Move activity may not be carried over at all.

On the AT Protocol, identity continuity is stronger by design. Because the account is identified by its DID, and the repository — including the user's own follows and posts — is portable, a migration to another PDS keeps the same identity, the same records and, in principle, the same relationships: other accounts' follows point to the DID, not to a server, so they remain valid after a move. The protocol documentation describes a four-step process and also an "adversarial" path for when the old host is uncooperative, which depends on the user controlling a recovery or rotation key. But the same documentation warns that migration is potentially destructive if done incorrectly, recommends against migrating a main account without understanding how identity operations work, and notes that some private state — such as direct messages handled by centralised services — may not move. Bluesky's own hosting also restricts incoming migrations to accounts that originated there.

Bridges add a third route. Bridgy Fed, an independent project, translates between ActivityPub and the AT Protocol so that accounts on one network can be followed from the other. It is opt-in for each user and constrained by the differences between the systems — for example, limits on post length and formatting. Bridging extends reach across protocols; it does not make an identity native to both.

Threads shows the limits of interoperability from a large commercial platform. Meta enabled opt-in fediverse sharing, then the ability to follow and see fediverse accounts in a separate feed. Reporting in 2026 suggested that further development had been deprioritised. Either way, the integration lets Threads users be followed from the fediverse; it does not let them move their Threads audience to another server.

The honest conclusion is that portability is partial. Open protocols can preserve some combination of identity, relationships and content. None of them preserves the community context in which those relationships were formed — the conversations, the local norms, the sense of being among particular people — because that context lives in other people's behaviour, not in data.

The economics of platform dependence

An audience has economic value only to the extent that it can be reached, retained and converted. Follower counts are a proxy for that value, and an imperfect one.

For creators and publishers, the dependence takes several forms. Acquisition is often subsidised by the platform: algorithmic recommendation can deliver audiences far faster than any independent channel, which is why many businesses grow on platforms in the first place. Reach then becomes a recurring cost, paid either through advertising or through continuous adaptation to whatever formats the ranking system currently favours. Monetisation — revenue sharing, creator funds, subscriptions or tipping inside the platform — ties income to programmes whose rules the platform can revise. And switching costs rise over time, because the longer an audience exists only on one service, the more expensive it is to rebuild elsewhere.

The result is concentration risk. A business whose customers, discovery and income all flow through a single platform is exposed to policy changes it cannot negotiate. This exposure is not hypothetical in kind: changes to API access, link handling, monetisation eligibility and ranking have repeatedly affected publishers and creators across platforms over the past decade, even if the scale of the effect varies widely and is seldom measured transparently.

The classic response is to cultivate direct channels — email newsletters, membership communities, personal websites, RSS feeds — in which the creator holds the contact relationship and the means of distribution. These channels have their own dependencies (email deliverability, payment processors, hosting providers), but they shift control over who receives a message back to the sender. Platforms then become places to be discovered rather than places to be held. Open social protocols could, in principle, offer a middle ground: a social network where the audience relationship is attached to an identity the creator controls, while discovery still benefits from a shared network. In practice, the open networks are smaller than the largest commercial platforms, monetisation infrastructure is limited and often external, and the economic case for creators remains to be demonstrated rather than assumed.

Decentralisation has its own problems

Decentralisation does not eliminate the problems of platform power. It redistributes them, sometimes to people less equipped to bear them.

Moderation becomes a patchwork. In the fediverse, each server's moderators make their own decisions, and federation-level blocking is a blunt instrument: defederating from a server cuts off everyone on it, including users who did nothing wrong. Volunteer moderators on small servers face workloads that large platforms address with paid teams and automated systems. On the AT Protocol, composable moderation through subscribable labelling services gives users more choice, but also asks them to understand and configure it, and the default experience still depends heavily on the main operator.

Harassment and abuse can exploit gaps between jurisdictions of moderation. An abusive account banned on one server may reappear on another, and coordinated harassment across servers is harder to address than within a single company's systems.

Fragmentation affects usability. Users must choose a server, understand handles that include a domain, and navigate differences in features between applications. Interoperability is technical before it is social: two systems that can exchange messages may still render them differently, support different features, or carry different expectations about privacy and visibility — as the debate over whether bridges between Mastodon and Bluesky should be opt-in or opt-out demonstrated.

Hosting and maintenance cost money and expertise. Small servers depend on donations and on administrators' continued willingness to run them; when a server shuts down, its users may lose their accounts unless they migrate in time. Self-hosting gives control at the price of security, uptime and moderation responsibilities.

Identity verification is harder without a central authority. Domain-based handles help, but impersonation remains possible, and key-based identity systems introduce their own risk: a user who loses control of their keys may lose control of their identity, and the directory that resolves identifiers is itself a piece of infrastructure that someone must operate.

Privacy is more complex than it appears. Public posts on federated networks are copied to many servers operated by different parties under different policies, and deletions propagate imperfectly. Open data streams, such as the AT Protocol's public firehose, make public activity easy to collect at scale.

Governance disputes do not disappear. Decisions about protocol evolution, default infrastructure and relationships with large commercial entrants — including whether to federate with Meta's Threads — have divided communities. A protocol can be open while the most important instances of it remain controlled by a few organisations.

A framework for measuring control over an online identity

If "ownership" is too blunt a concept, a more useful question is how much control a person has along several distinct dimensions. Five matter most.

1. Identity continuity

Meaningful control would mean that a person's identifier survives a change of host or provider, and that others can verify it is the same person. Limitations arise when identity is a username issued by a single platform, or a handle tied to a server whose operator can close it. Domain-based identifiers and portable cryptographic identities improve continuity but introduce dependencies on domain registration, key custody and identity directories. What users can verify: whether their identifier is a domain they control, whether they hold any recovery key, and what happens to their handle if their host disappears. 2. Content ownership

Meaningful control would mean retaining copyright, being able to export one's work in a usable format, and being able to republish it elsewhere without losing its context. Limitations include broad licences granted to platforms, including for AI training, export formats that cannot be re-imported, and the loss of replies and threads when content is moved. What users can verify: the licence terms in the service's terms of use, the existence and completeness of a data export, and whether any destination can import that export.

3. Social graph portability

Meaningful control would mean that relationships — in both directions — survive a move without requiring every contact to act. Limitations include incomplete support for migration across implementations, approval-based follows, servers that are blocked or offline, and the absence of any graph portability on most centralised platforms. What users can verify: whether the service supports account migration, which parts of the graph move automatically, and which must be rebuilt manually.

4. Audience reach

Meaningful control would mean a reasonable expectation that people who chose to follow an account will see what it publishes, or at least the ability to choose a feed that shows it to them. Limitations include algorithmic ranking that the account owner cannot influence, opaque visibility restrictions and, on federated networks, dependence on which servers federate. What users can verify: whether a chronological feed exists and is the default, what analytics the platform provides about reach, and whether restrictions are notified and appealable.

5. Exit options

Meaningful control would mean the ability to leave without losing everything — taking identity, content and relationships elsewhere, or at least directing people to where one has gone. Limitations include account deletion that frees a handle for others, migrations that are irreversible or rate-limited, and the network effects that make destinations less valuable than the origin. What users can verify: the documented migration and deletion procedures, whether the old profile can redirect, and whether direct channels to the audience exist outside the platform.

Scoring a platform against these dimensions does not produce a single verdict. It shows where dependence lies — and therefore where a creator or publisher may need to compensate, through direct channels, a self-controlled domain or redundant presence across networks.

What the next generation of social networks must solve

Several problems remain open, and it is worth being precise about which have partial solutions today and which are still largely theoretical.

Identity independent of a single platform is partly solved. Domain-based handles and decentralised identifiers already work at scale on the AT Protocol, and ActivityPub implementations increasingly support verification links and redirects. What remains unsolved is making key custody and recovery usable for people who will never manage cryptographic keys, without recentralising control in whoever holds those keys on their behalf.

Moderation across interoperable systems is far from solved. Protocols can transmit reports and labels, but they cannot transmit shared judgement or legal responsibility. As interoperability grows, so does the question of who is accountable when harmful content travels from a service with lax rules into one with strict ones.

Moving communities without losing relationships is only partly possible. Moving an individual's followers is now routine on some networks. Moving a group — its shared conversations, norms and moderation history — is not, and may never be fully possible, because communities are not data structures.

Sustainable creator businesses across networks remain mostly a possibility. Payment, subscription and discovery systems on open networks are immature, and most creators who earn a living still do so through centralised platforms or direct channels.

Coexistence of open protocols and commercial platforms is being tested in practice. Threads' partial adoption of ActivityPub, the opt-in debate around bridges, and regulatory pressure for interoperability in the European Union all suggest that the boundary between open and closed networks will be negotiated rather than settled by technology alone.

Followers are not the same as freedom

Return to the illustrator with hundreds of thousands of followers and a sudden collapse in reach. Every legal right she was promised remained intact. She owned her work. She could download her data. What she lacked was something no terms of service had ever offered: a continuing ability to reach the people who had chosen to follow her, and a credible way to take that relationship elsewhere.

The evidence reviewed here suggests that ownership of a social media identity has at least five components — continuity of identity, rights in content, a portable graph of relationships, practical reach, and a real option to exit — and that centralised platforms generally secure only the second. Open protocols can strengthen the others. The AT Protocol separates identity from hosting more thoroughly than any major platform; ActivityPub, as implemented by Mastodon, can carry followers from one server to another. Neither carries a whole community, neither guarantees reach, and both shift responsibilities for moderation, hosting and security onto smaller operators and onto users themselves.

The precise conclusion is therefore not that decentralisation gives people ownership of their audiences. It is that ownership of an audience was never a single right to begin with. It is a set of capabilities, distributed across law, code and markets, and the practical question for anyone who depends on an online audience is which of those capabilities they actually hold today — and which they would discover they lack only on the day they need them.