Social Media Widgets and Privacy

With the rise of Mastodon and Bluesky, replacing Twitter/X, developers are sharing online some neat social widgets to show likes, boosts, or comments on their sites and blogs. But there's a common issue most of these widgets overlook: privacy. Specifically, how they handle user avatars. And yes, it matters more than you might think.

Seeing several people (some of them high-profile developers) sharing these type of components with this clear vulnerability drove me to write a thread/rant on social media. Then, I decided to clean and correct the text a little, add some images and technical background, and publish it on my blog.

The result is this post –this link is to a private preview that will go live next week–, in which I break down why directly embedding avatars from social networks can expose your visitors’ IPs, referrer info, and more... even potentially identifying them! I also offer solutions to protect both you and your users (spoiler: proxying is your friend).

It’s a bit of a rant, a bit of a PSA, and hopefully a useful guide for anyone building web components using third-party data in 2025. As the concepts extrapolate to other APIs.