Whoop.com

WHOOP released Humans at noon ET on Thursday, Nov. 12, bringing a follower-based social network into its app, and CEO Will Ahmed called it "the most verifiably human network ever launched." But the announcement describes no check that the person wearing a band is the person running the account, so "verified heartbeat" means only that WHOOP hardware recorded a pulse behind a paid membership. For the more than 3 million members now deciding whether to put Recovery and heart rate variability (HRV) scores in a feed, that distinction sets how much trust the badge deserves.

WHOOP Humans Adds Followers, Moments Photos and Seven Privacy Controls to App

Humans lets members follow friends and family and view the numbers those people choose to share, including Recovery, Strain, Sleep, HRV and resting heart rate, plus selected activities and achievements. A photo layer called Moments carries photos and captions in a story-like format, and followers can react and comment. Humans sits in the Community tab beside Teams, the existing group feature, and WHOOP says 57% of members belong to at least one Team.

The feature is opt-in and free on every membership tier, and WHOOP expects nearly 4 million members by year-end. Membership itself runs $199 to $359 a year.

PPC Land counts seven privacy controls in the release: choosing which metrics to share, managing followers, keeping activities marked sensitive out of sharing by default, choosing which workout types and achievements appear, keeping photos and Moments private, changing preferences at any time, and Stealth Mode. Stealth Mode temporarily hides shared health and performance data without changing saved sharing preferences. Reports differ on follower approval: Notebookcheck says members approve follower requests, TechCrunch reports members decide who follows them, and PPC Land says the release describes only removing followers afterward.

Heartbeat Verification Rests on Device Data, Not Identity Checks

According to PPC Land's reading of the release, the "verified heartbeat" refers to WHOOP hardware recording a pulse. The release describes no identity check at sign-up, no method to confirm that the wearer is the account holder, no independent audit of accounts, and no screening of comments or Moments photos for automation or AI generation. WHOOP says members can report a comment or photo and that it reviews reports, but the coverage reviewed gives no review timeline.

The practical barrier is cost. Running bot accounts at scale would require buying hardware and memberships in volume, PPC Land notes. Computer scientists have a name for the underlying threat. A Sybil attack uses many pseudonymous identities to gain outsized influence, and a system's vulnerability depends partly on how cheaply identities can be generated. Raising the price of each identity is a recognized defense, but proof of personhood is a separate goal: one verified human per identity. In those terms, WHOOP's design is a cost barrier, not proof of personhood. PPC Land's account of the release does not address how WHOOP would handle one person holding several memberships.

There is a defensible reason to skip identity documents. Strong identity checks conflict with privacy and anonymity, and they can wrongly exclude people, which is the tradeoff proof-of-personhood designs keep running into. PPC Land's account of the release mentions no collection of government ID. The open question is whether a badge built on that choice should carry the word "verified."

How Do Wrist Sensors Record Heartbeats, and Can Researchers Fake Them?

A wrist band reads a pulse with photoplethysmography, or PPG: LEDs shine light into skin and a photodetector tracks changes in light absorption as blood volume rises and falls. Motion is a limiting factor for accuracy during exercise, and waveform shape varies between people and with sensor placement.

Researchers have shown that this kind of sensor can be fooled. A 2025 paper in IEEE Transactions on Information Forensics and Security, by Junhao Wang, Li Lu and four co-authors, describes FakePPG, a low-cost device that uses a liquid crystal modulator to mimic the pulsing light signal of skin. Against PPG-based identity systems, the authors report impersonating about 91.2% of subjects within 10 trials, a figure that reflects repeated attempts, since success on a single attempt was about 60%. They also spoofed atrial fibrillation readings at up to 96.7%.

The limits matter. The paper tested lab sensors, smartwatches from Apple and Huawei, a Samsung phone, a pulse oximeter and heart-health apps, and WHOOP does not appear in it. PPC Land's account of the release does not say Humans uses pulse waveforms as an identity biometric, which is the setting the 91.2% figure describes. The attack worked best within roughly 1 to 5 cm (0.4 to 2 in) of the sensor, and wrist-off detection caused most smartwatch failures. The authors propose artifact detection that caught spoofing with 99.3% accuracy on unfiltered signals, falling to 81.9% on filtered ones, though the paper presents it as a proposal rather than a deployed safeguard. Earlier work by Lin Li and colleagues found that pulse signals extracted from facial video fooled a PPG-based authentication system 35% of the time, and an active defense cut that to 5%.

WHOOP Health Data Stays Company-Readable While Class Action Alleges Third-Party Sharing

The Electronic Frontier Foundation (EFF) reviewed ten wearable makers in July and found that WHOOP does not offer end-to-end encryption, the design in which a company cannot read stored data. WHOOP publicly promises to notify users of law enforcement requests, but it does not publish a transparency report, EFF said. EFF's finding concerns WHOOP health data generally, and the coverage reviewed does not say whether Humans content is stored differently.

A separate legal fight predates Humans. Lomeli v. Whoop, filed Aug. 13, 2025, in federal court in California, is a proposed class action alleging that WHOOP's app sent vitals, health details and video titles to Segment, a third-party tracker, without consent. The complaint says that conflicts with WHOOP's privacy pledges, and the allegations are unproven. Coverage reviewed reports no ruling and no WHOOP response.

WHOOP's counter-position is that it does not sell or monetize members' personal health data. Ahmed told TechCrunch that WHOOP does not license data to third parties, adding, "Our product is not you; it's the membership." PPC Land adds that the pledge covers personal health data and that the release does not say how WHOOP uses follow relationships, comments and Moments photos, which are new data types. Other gaps include default visibility for new users, who decides what counts as sensitive, how the feed is ordered, whether advertisers will appear and whether there are geographic limits. Federal health privacy law offers little backstop, because wearable makers are generally not covered by the Health Insurance Portability and Accountability Act (HIPAA).

Ahmed's FDA Fight Shows WHOOP Treats Biometric Estimates as Wellness Data

Ahmed has a record of defending that wellness framing in public. The FDA sent WHOOP a warning letter on July 14, 2025 saying its Blood Pressure Insights feature needed clearance as a medical device. Ahmed said WHOOP was not backing down, wrote that the feature was not a medical device, and compared blood pressure estimates with heart rate and respiratory trends. The FDA later closed the matter after WHOOP changed the product and its labeling, a step Ahmed announced in late June. Heart rate and related wellness numbers are what members can now post to followers.

Metric Choices, Stealth Mode and Private Moments Limit What Followers See

Members who join can limit exposure with the controls WHOOP lists. Sharing the smallest useful set of metrics, turning on Stealth Mode when a score would be unwelcome news, keeping Moments private and reviewing the follower list all work without leaving the app. EFF points users who want stronger protections, such as end-to-end encryption and transparency reports, to the feature request pages that WHOOP and several rivals maintain.

Parents face an open question. WHOOP's minimum age is 13, higher in some countries, and when asked whether a parent could follow a teenager's data, Ahmed did not answer directly and pointed to the privacy controls.

The bottom line for members is narrow. A verified heartbeat tells followers that a paid WHOOP band recorded a pulse, not who was wearing it or who is posting. Pulse sensors have been spoofed in lab conditions, though WHOOP was not tested, and the company's health data remains readable by WHOOP under the industry-standard design EFF describes. The cost barrier is real, and the privacy controls are real, so a reasonable reading of the badge is a filter against cheap bots rather than a guarantee, and a cautious use of Humans is to share only numbers that would be fine for any follower to see.

Frequently Asked Questions

Is WHOOP Humans an add-on purchase?

No. Humans is included with every membership tier at no extra cost, and it is opt-in.

What does Stealth Mode do in WHOOP Humans?

Stealth Mode temporarily hides the health and performance data a member shares, without changing saved sharing preferences, according to PPC Land's account. Notebookcheck describes it as a toggle that pauses sharing across a network.

Does WHOOP sell data from Humans?

WHOOP says it does not sell or monetize a member's personal health data. That statement covers personal health data, and the release does not say how WHOOP uses follower relationships, comments or Moments photos.

Could someone fake a heartbeat to join WHOOP Humans?

PPC Land's account of the release describes no anti-spoofing measure, and the FakePPG paper did not test a WHOOP band. Lab researchers have spoofed pulse sensors in other devices, but their attack needed close contact with the sensor and struggled against wrist-off detection.