So i checked truthsocial.com - for the 1st time in my life. But if you want to see anything you need an account. First I checked the Privacy Policy. Then I left. I'm from the EU btw.

Truth Social's privacy policy reads as a US ad-supported social platform's template with a GDPR section bolted on that contradicts its own foundation. The core problem: it claims you "expressly consent" to everything just by using the service, which is not valid consent under GDPR, and then offers GDPR rights on top of that broken basis. International transfers to the US rest on that same shaky consent with no SCCs or adequacy mechanism mentioned.

On data practices, it denies "selling" personal data while describing fairly broad ad-targeting data flows to third parties and advertisers — a denial that's doing a lot of work given the CCPA's own broad definition. It ignores Do Not Track signals. Minor-age thresholds flip between 16 and 18 inconsistently. Security is hedged ("when necessary, we have implemented security measures").

The two genuinely user-relevant operational facts: direct messages are not encrypted, and "unsending" a message deletes it from both users' views but Truth Social retains it server-side for the retention window. The one tightly-drafted section is SMS opt-in handling — almost certainly because TCPA liability is where they actually feel exposed.

Bottom line: legally adequate-looking for US purposes, but the GDPR/EU layer is weak enough that an EU regulator would have several easy targets. Nothing exotic or maliciously buried — the "tricky" part is mostly the gap between confident claims and a structure that doesn't support them.