Can You Hide Who You Follow on Bluesky? No — And Every Follow Is Timestamped
There is no setting that hides your Bluesky following list, and the list is more exposed than the app makes it look. Bluesky shows you who an account follows, roughly newest-first, and nothing more. The record underneath each of those follows carries the exact millisecond it was created — and if the follow came from a starter pack's "Follow All" button, it carries a pointer to that pack too. None of that is in the app. All of it comes back from one unauthenticated request.
The pages ranking for this question get the headline right — no, you can't hide it, try blocking or muting instead — and then stop one layer too early. Even the Newskies' guide to safety and privacy on Bluesky, much the most careful of them, gets as far as "who you are following is Fully Public" and leaves it there. The interesting part isn't that the list is public. It's what "public" turns out to mean once you read the records instead of the app.
So I read them: 106,900 follow records from 100 real Bluesky accounts, pulled unauthenticated on September 4, 2026 — and all 106,900 carried a timestamp.
Can You Hide Who You Follow on Bluesky?
No — and the nearest thing Bluesky offers tells you so itself. Under Settings → Privacy and Security there's a toggle labelled "Ask apps and sites not to show my account to logged-out users." Its own explanatory text, straight out of the app's source, is unusually candid:
Bluesky will not show your account to logged-out users and will ask other apps to do the same. Other apps may not honor this request. It doesn't make your account private.
Two words doing a lot of work there: ask, and apps. It's a request to software, and the software it's asking is the layer that renders profiles — not the layer that stores your follows.
Here's where the actual asks stand:
| What people ask for | Where it is | Status |
|---|---|---|
| Private followers/following lists | social-app #6083 | Open since Nov 2, 2024 |
| Private/locked accounts (the app) | social-app #1155 | Open since Aug 13, 2023, 95 reactions |
| Private accounts (the protocol) | atproto discussion #1409 | Open since Jul 30, 2023, 97 upvotes, no answer |
Nothing in that table has shipped.
Can You Make a Bluesky Account Private?
Not today — but this is the one part of the story that moved recently, and most write-ups haven't caught up. The app roadmap TechCrunch covered in January is about the Discover feed, follow recommendations and real-time features — no privacy controls in sight. The protocol roadmap is a different document, and the AT Protocol roadmap published March 24, 2026 added a track for exactly this: permissioned data, meaning "non-public data with explicit access control." It says the work "will probably be a major focus for the Bluesky protocol team through the summer," and in the same breath that it expects "significant implementation and experimentation work before details are finalized."
Read that as designed-in-public, not shipping-soon. There is no switch to flip, no date, and nothing that retroactively covers the records already written. Everything below is about the network as it exists.
What Does a Bluesky Follow Actually Record?
A follow is a small public file in your account's repository, and it has a clock in it. Ask any PDS for one and this is what comes back — no login, no API key, no app password:
curl -s 'https://bsky.social/xrpc/com.atproto.repo.listRecords?repo=bsky.app&collection=app.bsky.graph.follow&limit=3'
{
"uri": "at://did:plc:z72i7hdynmk6r22z27h6tvur/app.bsky.graph.follow/3muhzr5gxv22v",
"value": {
"$type": "app.bsky.graph.follow",
"subject": "did:plc:rcbtnmlk2la67bm4po65oe23",
"createdAt": "2026-09-01T18:17:23.980Z"
}
}
(You have to ask that account's PDS. bsky.social is Bluesky's entryway and answers for accounts it hosts; a self-hosted account is served by whatever host its DID document names.)
The timestamp isn't optional metadata that some clients happen to add. The lexicon lists "required": ["subject", "createdAt"] — a follow record is defined as a subject plus a moment. There's a third, optional field too, via, and when you tap Follow All on a starter pack the app fills it in with a strong reference to that pack — its AT-URI and its CID — so the record can also say where the follow came from.
Now compare that against what the app hands you. I checked every row below against bsky.app's own 14 follows on September 4, 2026:
| Surface | Who you follow | The order | The date and time | Where the follow came from |
|---|---|---|---|---|
| Following tab in the Bluesky app | Yes | Roughly newest-first | No | No |
app.bsky.graph.getFollows (public API, no login) |
Yes | Same as the tab | No | No |
com.atproto.repo.listRecords on the PDS (no login) |
Yes | Strict reverse-chronological | Yes, to the millisecond | Yes, via via |
That middle row is why people assume follow dates are private: getFollows does return a field called createdAt. It isn't the follow date — it's the followed account's signup date, riding along on the profile object. The proof isn't Bluesky's own API agreeing with itself; it's the independent DID registry. Take the createdAt that getFollows reports for an account and compare it with the genesis operation in that account's plc.directory audit log: for pfrazee.com (2022-11-17T00:35:16.391Z), chiitan.love and toni.bsky.team the two matched to the millisecond, and the fourth I checked was within 41 seconds. The endpoint behind the Following tab has no idea when you followed anyone.
What the app leaks is a rough sense of sequence, and only a rough one. On bsky.app the two lists came back in identical order, position for position — but that's one account, so I checked 87 more, 7,196 follow positions in all. The record side is dependable: 83 of 87 repositories returned their follows in strict reverse-chronological order. The tab is not: only 23 of those 87 matched the record order across the first 100 positions. And the ordering itself is in play — getFollows now accepts a sort parameter with latest and top as documented values, and the app already passes it behind a feature flag, so sort=top returns a materially different list today. Treat the tab as approximately newest-first. The repository is the one that's exact, and it's the one with the clock.
How Public Is a Following List, Really?
Readable in bulk, timestamped to the millisecond, and fast. I ran two passes over accounts posting into Bluesky's Discover feed on September 4, 2026, both logged out, both reading each account's own PDS rather than the app. The first pass read 100 accounts for shape, the second 87 for record-level detail, and a third compared 87 accounts' Following tabs against their raw records. (All three were drawn from the same feed minutes apart, so they overlap — I'm not adding them together.)
| What I measured | Result | Pass |
|---|---|---|
| Repositories that answered a logged-out read | 100 of 100 | 1st |
| Accounts returning at least one follow record | 98 of 100 | 1st |
| Follow records read | 106,900 | 1st |
Records carrying a createdAt |
106,900 (100%) | 1st |
| Records dated before any Bluesky repo existed, or in the future | 0 | 1st |
| Read speed, unauthenticated, from a laptop on home broadband | 226 follow records per second | 1st |
| Median follow timeline reconstructable per account | 605 days | 1st |
| Longest timeline in the sample | 1,218 days | 1st |
| Median busiest single follow-day | 56 follows | 1st |
| Largest single-day burst | 2,812 follows | 1st |
| Follow records read | 71,381 | 2nd |
Follows attributed to a starter pack via via |
1,539 of 71,381 (2.2%) | 2nd |
| Median gap between the client's timestamp and the server-minted record key | 0.161 seconds | 2nd |
The 605-day number is the one I'd sit with. The median account in that sample hands a stranger a follow-by-follow chronology stretching back more than a year and a half — not a set of names, a sequence with dates on it. The longest ran 1,218 days, which is very nearly the whole life of the network.
And you don't have to take the timestamp on trust, which was the objection I expected to hit. createdAt is written by whatever client made the follow, so in principle it's forgeable. The record's key isn't: it's a TID, minted when the write lands, and it decodes back to a time. All 71,381 keys in the second pass decoded, and the two clocks agreed — a median gap of 0.161 seconds, 1.2 seconds at the 90th percentile, a worst case of 27 minutes, and not one record out of 71,381 off by so much as an hour. The timeline isn't just published. It's corroborated.
Two honest limits on that table. The sample frame is authors of posts in the Discover feed, so it's biased toward accounts that actively use Bluesky rather than being a random slice of the network. And I capped each read at 3,000 records; 22 of the 100 accounts hit that ceiling, so I've withheld the median follows-per-account entirely (a censored distribution isn't a measurement), and the busiest-day figures are lower bounds — for those 22, they're computed from the most recent 3,000 follows only.
Does Blocking Someone Hide That You Follow Them?
Blocking doesn't touch the record, and unfollowing only works going forward. AT Protocol's own explanation of why blocks are public doesn't hedge about the storage model:
…each account's data repository — which contains information like follows and blocks — must be public.
So blocking someone writes a second public record about them rather than erasing the first one. That isn't a theoretical worry — it's sitting in the data. Of the 87 accounts in my second pass, 66 had block records (9,917 blocks between them), and 146 of their still-live follow records point at someone the same account blocks. Twenty-seven of those accounts had at least one. The block went on top; the follow stayed exactly where it was.
The inbound direction is stranger still, and it's the part that surprises people most: you cannot hide your followers because you don't own that list. When someone follows you, the record is written into their repository with your DID as the subject. Nothing lands in your account at all. That's also why there's no remove-follower button, as how to remove followers on Bluesky gets into, and why nothing on Bluesky will tell you which lists you're on. The record is in someone else's hands.
Unfollowing genuinely does delete the record from your repository. It just doesn't reach back in time. Every record creation and deletion is broadcast on the network's public stream as it happens, and Bluesky's own network services privacy notice is upfront that it shares public data with "third-party actors that operate on the AT Protocol" and is "not responsible for the processing of personal information" by them. Anyone who was listening kept what they saw.
If this pattern feels familiar, it's the same one as the Likes tab — the app shows the tab to nobody but you, and every like you've ever tapped is still a public record. Bluesky's privacy surfaces are conventions in the app. The repository underneath has none at all.
How Do I Hide My Bluesky Following List?
Unfollow, or move those follows to a second account. Everything else is either cosmetic or beside the point. Five options, honestly ranked:
- Unfollow. The only action that removes the record. Effective from the moment you do it, and retroactive for nobody.
- Use a second account for the follows you don't want attributed to you. Bluesky supports multiple accounts natively, and the separation is real rather than cosmetic: separate repositories, separate graphs.
- Turn on logged-out visibility. Costs nothing, helps a little: it keeps your profile out of Google and out of logged-out views in apps that honor it. It does not touch
listRecords. Bluesky's own toggle text says it "doesn't make your account private." - Mute rather than block, where mute will do. A mute is a procedure call, not a record —
app.bsky.graph.muteActor's own lexicon says "Mutes are private in Bluesky" — so it's the one graph action here that writes nothing public. Note the trap, though: a mute list is not private. The list and onelistitemrecord per member live in your repository with timestamps, exactly like follows, which is why every Bluesky list is public. Only subscribing to someone else's list is private. (Mute vs block has the full comparison.) - Block. Does not help with this at all. Blocking writes another public record and leaves the follow in place.
What doesn't work, no matter how often it's suggested: making the account "private" (there's no such mode), deleting and re-following to reset timestamps (the new record has a new timestamp and the old one was already broadcast), or self-hosting your own PDS. A self-hoster could decline to answer listRecords, but federation runs on the com.atproto.sync.* endpoints — the whole repository, streamed to relays as it changes. Handing your records to the network is what federation is.
Can People Tell If You Mass-Follow on Bluesky?
Here's the practical consequence almost nobody draws from this: your follow pacing is publicly auditable. Anyone can pull your follow records, bucket the timestamps by day, and see exactly what your following behaviour looks like — the 300-follow Tuesday afternoon included. The evidence of a follow spree doesn't live in some internal moderation log; it's in a file you published.
The numbers above give you the shape of normal: a median busiest day of 56 follows, against a largest single-day burst of 2,812. Anyone can tell those two apart, with no cooperation from Bluesky required and nothing to install.
That's the assumption Agent Sky is built on — and I sell it, so weigh the pitch accordingly. $9 a month, free to start. It follows accounts that are genuinely active in your niche rather than everyone a keyword touches, and it spreads those follows out: our users run a median of about 3.6 follows per day, measured across 58,334 real follows made between December 2024 and June 2026 (method and spread here). It also confirms a live follow-back before it unfollows anyone, so the record trail never shows a mass follow chased by a mass purge — which is the shape unfollowing people who don't follow back leaves behind when it's done carelessly, and it's exactly as readable as everything else here.
The limits, plainly: pacing doesn't make your following list private. Nothing does. It just means that when someone reads the file — and on Bluesky, someone can always read the file — it looks like a person using a social network.
Quick FAQ
Can you hide who you follow on Bluesky? No. There is no setting anywhere in the app that hides your following list, and the closest thing Bluesky ships says so in its own words: the logged-out visibility toggle reads "Ask apps and sites not to show my account to logged-out users" and then adds "Other apps may not honor this request. It doesn't make your account private." The request has been open on GitHub since November 2, 2024 (social-app issue #6083, "private followers/following"), and the protocol-level version has been open since July 30, 2023 with 97 upvotes and no answer.
Can people see when you followed someone on Bluesky?
Yes, to the millisecond — just not in any Bluesky app. Every follow is a record in your repository and the schema makes createdAt a required field, so "2026-09-01T18:17:23.980Z" sits next to the account you followed. When I read 106,900 follow records off 100 real accounts on September 4, 2026, all 106,900 carried a timestamp, and the median account's records reconstructed a 605-day follow-by-follow chronology. The app never shows any of it: app.bsky.graph.getFollows, the endpoint behind the Following tab, returns no follow date at all (the createdAt you see there is the followed account's signup date). One unauthenticated call to com.atproto.repo.listRecords returns the timestamps.
Does blocking someone hide that you follow them? No. Blocking writes a block record and cuts off the relationship in the app, but it does not delete the follow record you already wrote, and the block record is public too — AT Protocol's own explanation is that "each account's data repository — which contains information like follows and blocks — must be public." Unfollowing is the only thing that removes a follow record, and even then the deletion only applies going forward: anyone who was reading the network's public stream at the time already has a copy.
How do I make my Bluesky account private? You can't today, and it isn't a missing checkbox — the protocol only supports public content, so it needs access-control work rather than a setting. That work is real and under way: the AT Protocol roadmap published March 24, 2026 added a permissioned-data track for "non-public data with explicit access control" and said it would "probably be a major focus for the Bluesky protocol team through the summer," while warning of "significant implementation and experimentation work before details are finalized." There is no date, nothing to switch on, and none of it would retroactively cover records already written. Until then the options are partial: turn on logged-out visibility, unfollow accounts you'd rather not be publicly linked to, or keep sensitive following on a separate account.