My talk for Atmosphere Conference 2026. Watch the talk here.
Hi everyone, it’s great to be here with you all.
I’m Tessa, the CEO and cofounder of Germ network. I’m here with my founding engineer Anna who I hope you all have gotten to meet. We build an end-to end encrypted messenger that lets you log in with social handles instead of a phone number. Germ supports multiple identities and atproto is our first and maybe most important stop.
Germ now launches from your Bluesky, Blacksky, and other atproto profiles. Thank you to the thousands of you who have tried us out and shared your feedback in the last few weeks, and to the devs who are already implementing the Germ button for your uses. We have a lot of work to do but we’re ready to be your secure messaging app for the atmosphere and beyond.
My cofounder and CTO Mark is watching from home in LA - hi Mark, miss you. Mark and I met on Twitter. I was a social media scholar with a theory about the centrality of messaging to social and he was the ex-Apple iMessage and FaceTime privacy engineer who left to replace the phone number.
It’s hard to believe that a year ago he and I came to Seattle for ATConf as perfect strangers to everyone here, because we had just started integrating atproto into our app.
That weekend we had some exciting conversations about privacy and private data that a year later are bearing so much fruit. Even as we are focused on building end-to-end encrypted channels for your atproto handles, we’re also interested in private data–both as developers who might use it, and also as users or dare I say citizens in this ecosystem who care about the future of social networking.
But today I don’t want to talk about privacy, I want to talk about consent.
In this community we talk a lot about openness, self-determination, privacy, and choice. These are north star values that orient us around what we’re building.
But these words fundamentally each describe a position of the self. I am open or private, I have choices. But as soon as I tell you what to do, these terms collapse.
Consent is the missing principle, a principle of relationality. Relationality is hard, because it’s dynamic. It demands continual negotiation. But it’s also strong, because it produces consensus. Consent is scalable, because it extends from a two-person relationship to the relationship of a people to their government and their social rules and norms. Caring about consent translates to movement coherence and political consent. Building consensual systems is building systems that are meant to last.
It’s also, simply, the price of healthy relating.
It’s also, simply, the price of healthy relating. I believe that every single person in this room builds technology to serve human flourishing, choice, and community wellness. We’re building the future we want to live in. Today I offer that consent is and should be one of the core, guiding values that we unite around to reach our goals.
So today I want to offer consent as a resource. A concept you can return to when you’re setting goals, designing products, and engaging with users–also known as other people.
This talk won’t be graphic but I do want to give a trigger warning for interpersonal and sexual violence, so please take care of yourself.
The internet that most of the world lives in today is characterized by surveillance and control. That’s why we’re building the alternative, right?
Modern social media is a gilded cage, where people trade their information, relationships, attention, and ultimately freedom of thought for a steady drip of content that promises connection–like a carrot you can never quite reach.
Over 6 billion people are on the internet, and 4 billion of them–4 billion individual human beings–use Meta products every month. These are the people we’re trying to recruit to the Atmosphere.
We’ve lived in Meta’s social internet for 20 years, and I want to remind us of how it started.
A “facebook” was a kind of yearbook distributed by colleges at the start of the year to help undergrads make friends. See, it’s natural for us to look for each other. In the early 2000s, Harvard made these digital, and each of 12 campus residential houses had their own private online facebook for their residents. Zuckerberg hacked into each one, downloaded every single undergraduate woman’s photo, and fed them into a hot-or-not style website that he then distributed.
Luckily for him, the president of the school at the time was this guy. Zuck received zero discipline for hacking school IT systems and harassing every single undergraduate woman, and probably some minors, on campus at the same time. He was able to build and launch facebook with campus resources, got to drop out of his own free will, and a few months later this guy wired him $500,000.
In the 20 years since, he’s built many beautiful businesses that so many people around the world enjoy.
Today, the way 70-80% of Americans feel about how companies and the government handle their data, is– distrust, lack of control, and confusion. This is a picture of authoritarianism, that predates our current administration.
Social media has connected the world, but it has also traumatized the world. We want to talk to anyone, not everyone.
We want to talk to anyone, not everyone.
It’s time to build new products with the love and tenderness that make it safe and easy for people to trust us, and depend on us for the rest of their lives. Luckily, consent is a renewable resource that we produce ourselves.
Defined simply, consent is agreement to what someone else proposed or is doing that involves you.
In fact, it’s a concept with a thousand-year history that bridges contract law, political theory, sexual health, human rights, and data policy.
Whether you’re talking about consent to a contract, to being governed, to sex, or to data collection, it’s all the same idea. So it’s obviously hugely important.
In the 90s, anti-rape activists on college campuses pushed the theory of consent into affirmative consent, which from there moved into law.
Affirmative consent has 5 parameters. It is:
voluntary - so of course, it’s freely given
informed - people need to understand what they’re consenting to
revertible - it’s reversible, which means it’s continually given and can be withdrawn
specific - consent is to a specific ask, not a blanket permissiveness
and it’s unburdensome - it’s easy to give, otherwise it’s not really accessible
But in the context of software, consent has remained shallow. Permission screens cloud our access to information and services, coercing us into consent.
In 2021, Human Computer Interaction Scholar Jane Im challenged us to apply the most current theories of consent to how we design social media features.
Im has this extraordinary table where she categorizes or generates social media features across the five categories of affirmative consent.
This table is an actual laundry list of the best features we’ve been begging platforms for for twenty years. It includes a lot of the stuff that we’re pioneering in the Atmosphere, like 26 algorithmic choice, account labels, and the ability to disconnect posts from their engagement. It is also extremely generative, with new ideas for automation and personalization.
The first line of this chart is DMs. It has some awesome feature ideas that we’ve talked about at Germ when we think towards group chats, automations, and productivity features. And Germ’s agentive, multi-identity technology is going to make some of this really easy–like automations based on who you’re talking to.
But consent in messaging starts earlier than that, because a DM is the minimum viable product of a digital relationship, the same way a two person connection is the smallest unit of a community.
So let’s talk about Germ. We’ve heard a lot about atproto ethos. We also have a germ ethos.
I resonated so strongly last year with Paul Frazee’s talk on Bluesky’s theory of change. Germ is similar to Bluesky in that we are also a product built on top of an open protocol. Our protocol will always be interoperable, open-source, and free, and we’ll build our business through our product or products. We also believe that the way to grow how many people we serve is to compete as a consumer startup. We’re a public benefit corporation that’s using growth capital to build our business.
But if the AT protocol is locked open, germ’s communicator protocol is locked consensual.
But if the AT protocol is locked open, germ’s communicator protocol is locked consensual.
Germ starts from the technological equivalent of a human rights posture: that you are a self-sovereign individual with inalienable rights to your personhood, which in the digital realm is expressed as data. From that foundation, you have the power to identify yourself and form relationships, expressed as sharing data. Each relationship you form is unique, is double-opt-in, and is single opt-out–just like non-abusive relationships in the real world.
Our protocol provides an authentication layer on top of the Messaging Layer Security protocol for end-to-end encrypted messaging. So the relationships that you opt-into on Germ exist in a completely private session between you and the person you’re talking to. You choose to talk to someone, also known as sharing data in real time, and you’re only sharing it with them. This is cryptography in the service of how we really form and dissolve human relationships.
End to end encrypted messaging started off centralized - both parties have to be on the same service, and you send encrypted messages addressed to and from the identities of the two parties–generally phone numbers, but more recently things like crypto wallets.
Germ decentralizes authentication with our novel protocol inspired by double ratchet. Double ratchet, the gold standard of end to end encrypted messaging, updates encryption keys with each message sent. Similarly, our protocol updates identity and transport when you message people. This gives us a powerful primitive that breaks free of fixed identities and centralized services. Our protocol frees end-to-end encrypted communication from phone numbers, so that you can communicate as multiple agentive identities. This is secure messaging beyond phone numbers.
There’s a theory of relationship here. If a message is the MVP of a digital relationship, that means we’re only connected if we’re communicating. There aren’t inactive follows on Germ – the connection starts only when I send you a message.
Identification is part of communication, not separate from it. When I talk to you, I identify myself to you, and not before.
Like Jiddu Krishnamurti said, “I cannot exist in myself. I only exist in relationship.”
“I cannot exist in myself. I only exist in relationship.” - Jiddu Krishnamurti
The coercive internet is based on a very dark view of humanity, that we can only be tricked into engaging with each other. The history of the world would beg to differ.
At Germ we’re idealists, but we’re also realists. So many of us lately have been talking about how we need to make our products effortless and inviting. Like I used to tell my students, you can’t follow your paper around explaining what you meant. As Toni Cade Bambara said, “The role of the artist is to make revolution irresistible.” At Germ our goal is to make exercising your autonomy feel effortless and fun. Even viral.
“The role of the artist is to make revolution irresistible.” - Toni Cade Bambara
And so the core UX challenge of our app is making it easy and intuitive to talk to your friends with your handle, while placing authentic moments of friction in the right places. We tried not to reinvent the wheel where messaging works well, but innovate significantly in the contacts layer with our creation of “cards.”
Cards are how we represent cryptographic identities in Germ. You can use cards without atproto. You just build one and share a link or QR code with someone else to chat. Under the hood, that’s decentralized authentication, but most users don’t care. You can build multiple cards, and each version of every card you share is operating a separate cryptographic mailbox, all presented to you in a unified inbox.
As we integrated atproto we navigated new dimensions of how our users grant and withdraw consent. Germ’s burner cards are totally local, but your atproto card is connected to this busy outside world. You pull your profile data from atproto and can push things back out, like blocks. We already present your atproto card differently from your local cards, but I expect as our app matures, our design system will highlight where your cards and relationships come from.
All relationships on Germ are two-way, but Atproto doesn’t have friends, it has one-way followers. If Germ is invite-only messaging, when you link your atproto handle you’re opening up a wider invitation of who can talk to you. But even there we don’t assume. We used the logics of consent to reason about how to bring atproto connections into Germ. If you follow someone on atproto, you opted-in to connecting with them. So they can double-opt-in back to you by messaging you on Germ. We hear people asking for open DMs - you’re ready to consent to that. That’s a future feature.
Because consent is informed, we wanted to make sure our users always know what they’re sharing with whom. Because it’s specific, we want them to have granular control over how they can be contacted. So you decide whether you want the people you follow on atproto to be able to message you at all, or whether you want to reserve the right to send the first message, and whether a button to Germ DM you should display in appviews. Because it’s unburdensome–if you can chat with someone, you see a button on their profile and you simply click it to start chatting.
This is the fun part about consent.
This is the fun part about consent. People get mad when they can’t have any. But to the people you consent to, it’s the best party in the world.
Germ relationships are separate from atproto relationships. Once you start messaging on germ via your atproto cards, you can unfollow each other out there and you’ll still be connected in Germ.
Right now, you add Germ friends one at a time from another app. But we’re working to show you your atproto social graph inside of Germ, so you can have a more complete messaging experience.
In designing this new feature, we wanted to help people understand that your atproto connections aren’t your Germ connections until you send them a message. You can also dismiss seeing them in the app.
So Germ is not just a messenger for atproto the way Signal is a messenger for your phone contacts. Instead, our protocol is an invite-only layer with a doorway you can open to atproto as wide as you want. You’re always in charge of who gets the keys to you.
Messaging has become crowded and spammy. We’re empowering you to rebuild the network of who you actually want to talk to, with the identities you already know them as.
I’ll close with a postscript for a solarpunk future. Double ratchet is also known as the axolotl algorithm because it is cryptographically self-healing, the way the Mexico City salamander, the ajolote, from Nahualt ajolotl, is self-healing.
When el DF was Technotitlan, a sustainable city on a lake in a volcanic mountain basin, ajolotes were extremely plentiful.
Now there are more ajolotes in captivity for medical research than living wild. The legend goes that when there are no more ajolotes, the world will end. There are currently estimated to be between 50 and 1000 wild ajolotes.
There are entities we’re in relation to on this earth that can’t express their consent with language–they can only call out their distress.
Protocols scale how we relate to each other. The germ protocol scales the granting and withdrawal of consent in relationships, with humans and with robots. As we continue to rebuild the world through technology, let’s never skip the hard work of negotiating consent in all our relationships. Because even if people can leave our apps if they don’t like them, we want them to keep choosing atproto. So let’s use our interacting protocols to build a future that is truly free, because we are all exactly where we want to be.
Thank you.