Will Substack Remain a Platform for Free Speech - or a Biometric Gate?

An Open Letter to Substack Leadership

What follows is a direct, good-faith challenge to Substack’s leadership, offered publicly on the platform itself.

Open Letter to Substack

Will Substack Remain a Platform for Free Speech – or a Biometric Gate?

To Chris Best (CEO), Hamish McKenzie, and Jairaj Sethi – Co-founders of Substack

Substack has built its public reputation on a platform model that emphasises creator control, that “takes a hands-off approach to moderation and supports community-led standards”, placing creators “in charge” of what they publish, when they publish it, and how they engage with their audience.[1]

This positioning has suggested support for independent discourse and open community expression – especially for people who speak at personal or professional risk.

In the United Kingdom and Australia, governments are pressuring platforms to restrict minors’ access to certain kinds of content. But why is Substack responding by moving toward identity-linked and biometric systems, instead of questioning where this direction leads and who it will exclude?

The shift toward conditioning participation on the submission of personal data marks a departure from the environment of autonomy and privacy-respecting participation that drew many writers and readers to the platform in the first place.

---

1. Identity-linked systems lay the groundwork for exclusion

What is being introduced here is more than a technical verification process. It is the gradual movement toward a digital environment in which participation is tied to real-world identity, accumulated data, and systems that can ultimately be used to determine who may speak – and who may not.

Users may decline to comply, but refusal comes at a cost – loss of access, loss of visibility, or quiet removal from spaces where public conversation now takes place. This is building the infrastructure through which people can be switched off – not by direct censorship, but by enforced inaccessibility.

---

2. Identity verification disproportionately harms vulnerable speakers

Substack hosts writers and readers who have legitimate reasons to speak without linking their real-world identity to their views, including:

• Journalists and whistleblowers

• Academics with minority positions

• Workers subject to professional or regulatory retaliation

• Medical professionals questioning prevailing policy

For these groups, identity-linked participation does not merely ‘verify age’ – it changes the risk calculus of speaking at all.

You do not need overt censorship to silence such voices. You only need to raise the cost of speaking.

The predictable result is self-censorship: people choose not to write, not to comment, or not to engage at all, in order to protect their livelihoods, licences, reputations, or personal safety.

This harm does not only affect paid publishing – Substack’s conversational ecosystem depends on users who contribute freely to dialogue across the platform, and identity-linked participation threatens that space of exchange itself.

The chilling effect of identity-linked participation is not hypothetical – it is well established, and it is foreseeable.

---

3. Delegation does not remove responsibility

Substack may argue that identity data is collected by third-party vendors, not by Substack itself.

That does not remove responsibility.

If Substack:

• requires verification

• selects the verification provider

• makes verification a condition of access

then Substack is causally responsible for exposing users to privacy, security, and professional risk – including the consequences of any future data breach, misuse, or policy expansion.

This is no different from forcing users through a particular gate and then disclaiming responsibility for what happens at the gate.

Requiring biometric submission as a condition of speech is not a neutral compliance measure. It is a coercive act that undermines personal autonomy, exposes people to irreversible privacy risk, and sets a precedent that no platform committed to free expression should accept.

---

4. Jurisdiction-based access requirements create unequal participation

Substack users are now treated differently based solely on geography.

Users in countries such as Australia and the United Kingdom face additional hurdles – including mandatory biometric ‘selfie’ verification, escalation to government-issued ID if biometrics fail, and loss of access to core platform functions if verification is refused – whereas users in many other regions can continue to participate without these requirements.[2]

Anecdotally, some creators in Australia report that age-verification barriers have made their Substack content effectively inaccessible unless identity conditions are satisfied, illustrating how identity-linked systems can produce exclusionary effects in practice.

This produces:

• unequal access to the same platform
• unequal exposure to privacy and security risk
• unequal ability to participate freely in public debate

A platform that claims to support global free expression should not normalise such disparities without challenge.

---

5. The analogy Substack should not ignore

During COVID, governments imposed vaccination mandates while delegating their enforcement to intermediaries – particularly medical practitioners.

Doctors were placed in the position of administering vaccines under coercive policy conditions which violated voluntary informed consent, while being told they were ‘just following guidelines’ or ‘just implementing policy’. Responsibility for the ethical consequences of those mandates was displaced away from governments and onto individual practitioners, even as genuine voluntary informed consent became impossible.

History will not judge that abdication of responsibility kindly.

Platforms that enforce coercive participation systems and then disclaim responsibility – whether by pointing to government regulation, outsourcing verification to third-party vendors, or claiming legal necessity – are repeating the same ethical error.

---

6. A moment for Substack to choose its direction

For many years, writers and readers have used Substack without compulsory identity checks, biometric verification, or third-party data gatekeeping. The platform has thrived on that openness. It has offered a rare space where people could speak, write, and engage across differences without being forced into identity exposure as the price of participation.

What is now being introduced is not a technical adjustment, but a change in character – shaped by regulatory pressure toward greater traceability, surveillance, and control of online speech. It risks pulling Substack away from the very conditions that allowed its communities to flourish.

The concern expressed in this letter is not about finding a more acceptable way to implement such systems, but about whether Substack is willing to pause, reflect, and consider resisting their normalisation.

In that spirit, it would strengthen trust and integrity if Substack were willing to:

• Acknowledge publicly that compulsory identity and age verification are not ethically neutral, and that they challenge long-standing norms of anonymous and pseudonymous participation that have historically protected vulnerable speakers

• Recognise that normalising identity-linked participation as the default condition of speech carries foreseeable risks for professionals, whistleblowers, dissenting voices, and others whose ability to contribute depends on a degree of separation between their ideas and their legal identity

• Affirm that participation in public discourse should not require the surrender of personal data, biometric identifiers, or government-issued ID – and that people who decline to provide such information should not be excluded from the core spaces of dialogue

• Accept that responsibility accompanies influence, including the privacy and security risks created when data is consolidated through third-party verification systems, and the downstream consequences if that data is breached, misused, or compelled into disclosure

• Be transparent about how responsibility is understood when harm occurs, rather than allowing it to disperse invisibly across governments, vendors, and policy frameworks while individuals bear the consequences

Platforms that compel data surrender as a condition of speech cannot plausibly claim neutrality when that data is breached, misused, or weaponised. The principle that responsibility follows power remains as true in the digital commons as in any other domain.

This is an appeal for Substack to defend the ethical foundations that helped make the platform possible in the first place.

---

7. The choice now facing Substack

Substack now faces a genuine choice about the kind of platform it wishes to be.

It can remain a principled space that resists becoming an enforcement arm of state control
– or –
it can become a compliant intermediary that normalises surveillance while turning the language of free speech into a façade

These two directions are not compatible. A platform cannot credibly be both.

The trust of writers and readers depends not on branding, but on the structures Substack chooses to build – and on the harms it is willing to prevent.

This letter is written in the hope that Substack will choose the former path.

Elizabeth Hart
Independent researcher on medical ethics and vaccination policy (Australia)
@elizabethhart – Vaccination is political

---

Acknowledgement: This letter was developed through sustained discussion with a reasoning partner (ChatGPT). The responsibility for the analysis and the views expressed remains entirely my own.

---

Notes / Evidence

[1] Substack, About Substack: “Substack takes a hands-off approach to moderation and supports community-led standards… You decide what to publish, when to publish, and how to engage.”
https://substack.com/about

[2] Substack Help Centre, “Why is Substack asking to verify my age?” (updated December 2025): confirms mandatory biometric selfie verification via Persona, escalation to government-issued ID if biometrics fail, restriction of chats, DMs, comments, notes, and other core features for users who do not verify, and retention of an estimated age following verification.
https://support.substack.com/hc/en-us/articles/42995315367572-Why-is-Substack-asking-to-verify-my-age

---

Also see:

From Medical Conscription to Digital Conscription

Using the internet – are we being groomed to give up our privacy?

The moral wedge: How fear for children is being used to expand state control

Authoritarianism Through the Public: How Fear Transforms Democracy Into Control

The Illusion of Digital Consent: How Technology Reframed Coercion as Choice