The Lawnmower You Never Get Back
Why the real value of your data isn’t yours to sell
If you own a smart phone, you are a point source for a constant stream of data. Your iPhone sends metrics to Apple, or your Android phone to Google — all of which happens even if you are not actively running an app or logged into an online service. Turn on Google Assistant or the newer Google Gemini and virtually every word you utter is shipped up to Large Language Models on Google’s servers for processing. Siri does some processing on-device, but sends more complex prompts to its Cloud Compute layer.
Any online service that requires you to create a user account can collect not only the data you voluntarily submit in the registration form, but it also can passively observe and record your activity while you are logged in. If you are using the companion smartphone app created by the online service, it is much easier for the company to collect data — which is why they push you to use the app by making the website a nightmare to use on a phone.
We are all familiar with the prompts asking for permission to turn on location information and grant access to contacts, photos or other personal information stored on your phone. More often than not, what appears to be a way to opt-out of sending the information is really not an option at all if it is required that you say yes before the service will function properly (or at all). Most of the time, when you set up a new phone or sign up for an online service, you will be asked to agree to the terms-of-service statement, or will have to confirm that you have read a privacy statement, either of which are supposed to tell you what will happen to all of the data you are sending to them — that is, if you have the time and the legal savvy to read and understand these tomes.
If you spend any amount of time thinking about all this, you sit up and pay attention when you hear someone talk about getting paid for your data. On the surface it sounds like a simple concept — just install some sort of a data-meter on your phone, like the electric meter on your house, then watch your bank account grow.
Of course, it is not that simple.
Still, being a professional techie, I was curious about how, if at all, technology might play a role in building what I expected would be a complicated system. However, it became clear right at the start of my search for an answer, that it is far more complicated than I had imagined.
When people say “I own my data,” they’re often collapsing several very different things into the word “data.” If asked, most would say that by data, we are talking about information we voluntarily enter into a registration or a profile form. And some might say that data also includes your “likes” and comments, the people you follow, the pictures you post, the videos you watch, online purchases, bank transaction history, and a host of other things a platform or online service directly observes about you and your actions. All of these are identified data points that are directly attributable to you, and arguably you can say belong to you. But from the perspective of a platform like Facebook or Google, the data that you volunteer or that it observes is just raw material for the aggregation, algorithmic processing and statistical analysis it uses to infer information about you and others — information that is far more valuable to the company.
Borrowing from Information Theory, the Data, Information, Knowledge, Wisdom (DIKW) Pyramid is a useful construct for understanding data from both an economic and a governance perspective. (For these purposes, only the DIK levels are relevant.)
- Data (volunteered and observed): These are symbolic representations of states of the world; traces that may or may not be personal and that, taken alone, have relatively low interpretive content.
- Information (inferred): These are structured or aggregated data that reveal relationships or meaning (e.g., profiles), enabling inferences about habits, preferences, or intentions.
- Knowledge (inferred): This is information integrated into a context and embodied in an agent with an intention of use, enabling decisions and action.
Economically, the pyramid traces a value-generation chain — as raw Data is transformed into Information and Knowledge, both its value to a company and the extraction cost (computation and labor) increases. Conversely, with each transition, the ability to connect (attribute) a user’s information at the Data level, in whole or in part, to an item of Information or Knowledge grows weaker. These relationships (represented in the table below) come into play in determining the strengths and weaknesses of the various academic and legislative data privacy and data monetization (data dividend) proposals discussed below.
The above gives us a clearer picture of what we mean by “…my data,” but what does it mean to “own” data. In one sense, ownership is about control. If you own a lawn mower, you have control over access to it, and what is done with it. If your neighbor asks to borrow it, you can establish ground rules before you consent — what he uses it for, how long he can keep it, etc. Legally, you have ownership rights over the lawn mower. When you allow your neighbor to borrow it, you are not turning ownership rights over to him — in other words you are not selling him the mower. You are consenting to him using it under an established set of conditions. You can also require monetary compensation in exchange for your consent (you can rent the mower to your neighbor).
Data, of course, is nothing like a lawn mower, but the analogy is helpful toward understanding data “ownership”
In his article, Beyond Data Ownership, legal scholar Ignacio Cofone argues that the prevailing data “ownership” proposals don’t actually give you an ownership right over your data. In law, an ownership right is a strong, freestanding claim which is good against the whole world, not just one company. Instead, what is being proposed is a property rule — the legal mechanism the law uses to decide how a right can change hands. In the case of data, consent is typically the mechanism by which an individual transfers to a company the right to capture and use their data, subject to rules usually spelled out in privacy statements and/or terms of service agreements.
Legislative efforts like the Own Your Own Data Act (2019), and the Your Own Data Act (2026) are typical examples of property rule-based “data ownership” bills aimed at regulating consent agreements, giving users access to view, correct, delete, or port their data, and imposing rules for retention of data. Neither of these bills was ever brought up for a vote. A common criticism of bills of this type is that while the idea of privacy as the right to control, edit, manage, and delete information about oneself has an intuitive appeal, to argue that property rights are alienable and tradeable, is close to the opposite of what most people actually want, which is privacy protection which holds even after they have clicked through a bad terms-of-service agreement, licensed their data for pennies, or otherwise given consent without fully understanding the scope of what that entails.
In Radical Markets, Posner and Weyl proposed treating data as an under-priced input to production (data-as-labor), currently held by platforms, and requiring a real market where users can sell data as compensated sellers in a collective manner in order to gain sufficient leverage. The academic theory stops short of proposing who exactly manages the data, negotiates on your behalf, or enforces terms.
The legislative effort closest to data-as-labor was when Governor Gavin Newsom announced a “data dividend” in his February 2019 State of the State address, explicitly framed around unlocking value people generate rather than data they merely own. Newsom convened an ad hoc “California Data Dividends Working Group” of outside scholars to draft an implementation plan, but nothing was ever introduced in the legislature. The DASHBOARD Act (2022), although not a full implementation of data-as-labor, would have forced large platforms to reveal in 90 day increments how much economic value they place on the data of each user, in addition to a once-a-year SEC filing of the total economic value of all user data. However, the tech policy group ITIF was quick to criticize the labor-market underpinnings of the bill, arguing that, unlike money, users do not “spend” their data when they share it with others. Therefore, it does not constitute a wage and the bill would not have had the intended effect even if it had passed. The bill died in committee.
Legal scholar Daniel Solove identifies three problems with both “data ownership” and data-as-labor frameworks which undermine a user’s ability to make informed choices when granting consent and negotiating fair compensation: asymmetric information, unequal bargaining power, and what he refers to as “aggregation effect. “ To the first, Solove argues that it is impossible to simplify terms and conditions sufficiently so that users can estimate with reasonable accuracy the various rights that have been surrendered by them. Second, he argues that the largest social media platforms and most other online service providers, operate under a take-it-or-leave-it business model, where they offer their services and dictate what will happen to your information in exchange for free access to their service; making a true negotiation over terms and a fair price impossible. Solove’s third point is that the processing of individually harmless data points via aggregation, machine learning, and LLMs (the “I” and “K” levels of the DIKW pyramid) can algorithmically reveal sensitive facts no one ever disclosed or anticipated, making privacy self-management through consent impossible to meaningfully exercise.
Many of these same criticisms are voiced by the Electronic Frontier Foundation, a digital-rights non-profit, founded in 1990. In the paper Why Getting Paid for Your Data Is a Bad Deal, they call the data dividend idea a pay-for-privacy scheme that “hurts consumers, benefits companies, and frames privacy as a commodity rather than a right.” They argue that companies have the most information about what your data is worth to them and have every incentive to lowball that value; and even when a government panel sets the price, companies remain the primary source of information about how they’ll monetize the data. They point to Facebook’s 2019 numbers — some $69 billion in revenue but only about $7 in quarterly revenue per user globally — to argue that any realistic dividend would amount to a few dollars a year, in exchange for giving up all practical control over your data; and that these dividends would be most attractive to lower-income people, for whom even a small payment matters a lot, effectively pricing poor people into surrendering their privacy while wealthier people opt out. Lastly, they echo Solove’s “aggregation effect” — that the real value is in the inferred data, which means individual users are poorly positioned to negotiate a fair price for themselves in the first place.
Get Jim North’s stories in your inbox
Join Medium for free to get updates from this writer.
Inferred data presents a more fundamental problem to establishing “ownership” rights. As Panopticon Privacy Law partner Joan M. Warbetz explains, companies will argue that “inferred data is the knowledge a company generates from its processing activities and, therefore, is [their] intellectual property.” However inferred data is the product of computer processing, and under current US IP law, copyright or patent IP protection can only be granted to output produced or authored by a human being. So US companies often argue that the inferred data they generate is a trade secret, meaning that it “derives independent economic value from not being generally known to the public or others who might use it for economic advantage.” Property frameworks that also want to respect IP and trade-secret law run into a contradiction: the very thing that makes inference valuable (the proprietary model) is what platforms will claim as their property.
Even if an individual ownership claim can be legally established, inference relocates the generative act to the platform’s model at the Information and Knowledge layers of the DIKW pyramid, where Attribution is weakest — operating on aggregate patterns that may only loosely involve the subject at all. Neither ownership nor labor compensation has a coherent answer to the question: who has a claim over a fact that was computed about you, from information provided by other people, and without your involvement in creating it? Rather than attempting to assign ownership or wages after the fact, the frameworks that address this question, like the GDPR profiling provisions, tend to abandon the property/labor logic, and regulate the act of inferring itself.
Technology has little to offer in the way of solutions to the problem of online service providers having free access to our data. There have been attempts at giving users direct control over their data which have gone dormant. One illustrative example is the OpenPDS project out of MIT in 2014. Yves-Alendre de Montjoye and others developed a field-tested prototype of an encrypted, locally-stored personal data store (PDS), allowing users to collect, store and give fine-grained access to their data metrics (location, phone call logs, web searches, etc.) to third parties. Browser plug-ins and on-device smartphone background services would capture a copy of this data and direct it to the user’s PDS. Instead of online providers directly accessing data, access would be via the PDS proxy service, requiring the online provider to be granted permission to access the PDS data by the user. A companion project called SafeAnswers implemented an additional proxy service layer between the PDS and the online provider. Instead of having access to all of the data in a PDS, the provider would issue narrow requests for specific data to SafeAnswers, which would process the request and return only the requested information.
OpenPDS was an interesting idea, but there are two reasons it is not a solution for the problem at hand. First, because it is implemented as a background service, it is technologically incapable of unilaterally preventing data from being passed to online service providers. It would require that providers voluntarily modify their systems to use the PDS/SafeAnswers proxy services, and to honor the access restrictions they impose — something they have no incentive to do. The only way to prevent providers from bypassing the PDS is for restrictions to be built into devices at the operating system level, which is under the control of Apple or Google for virtually all of the devices on the market — something neither Google nor Apple have incentive to do. The second reason is that ultimately, either directly or via a PDS, the online service will receive the data it claims it requires in order to function, and from then on it is in the hands of the platform and is beyond the reach of any on-device or in-browser hardware or software restrictions.
On a more positive note, the work of J.M. Alvarez-Pallete and colleagues at the Universidad Pontificia Comillas in Madrid, hold promise as a path forward for both privacy and perhaps compensation as well. In their paper Personal Data as a Human Right: A New Social Contract Based on Data Sovereignty, Human Dignity and Data Personalism, they argue that “digital life now requires an explicit dignity-centric Digital Social Contract (DSC) — one that treats personal data as dignity-relevant manifestations of the person and that governs the full data-information-knowledge value chain.” The new model of data governance set out by the DSC is grounded in a fundamental respect for personal data, inasmuch as they are “emanations” from the person, “carriers” of rights, and “linked” to human dignity. Rather than simply being inputs or commodities, data are to be treated with the respect afforded to them as personal data.
The three grounds for such governance are: Dignity-by-Design, which requires the incorporation of dignity, proportionality and human oversight into any system or process for personal data from the outset; redistributive instruments (such as data dividends, data cooperatives and fiduciary models) designed to redistribute value generated from personal data to the communities and individuals from which data are derived; and, Pigouvian informational accounting, which seeks to “internalize” the externalities of mass data extraction and processing by ensuring that there are identified and measurable costs incurred by informational harms, just as there are for environmental pollutants through environmental taxation.
Directing focus for new Data Governance policy is above my paygrade and out of my domain of expertise, but if I were tasked with the job, the DSC proposal is where I would start.
After over two weeks of reading close to a dozen legislative and academic papers, it has become abundantly clear that if getting paid for your data was easy to implement, somebody would have figured it out a long time ago. Platforms and services on the modern internet require at least some of your data in order to function as we have come to expect. These platforms are forced by law to ask you to agree to a terms of service agreement, or at least make available a privacy statement. But saying no usually means you have to move on and just not use the service. And in reality, there is no technological gatekeeper that can stop them from capturing whatever data they want, if they so choose. Once they have possession, current law gives the individual who supplied the raw material no way to reclaim control, and no means to receive commensurate compensation.
When it comes to your data, the large online platforms are like the neighbor who borrows your lawnmower, refuses to give it back — claiming that he now owns it because he sharpened the blades, changed the oil and added gasoline — and then starts his own lawn service using your mower plus all of the other mowers he has “borrowed” from his other neighbors.
References
- Alvarez-Pallete, JM., et al. Personal Data as a Human Right: A New Social Contract Based on Data Sovereignty, Human Dignity and Data Personalism. arXiv:2602.23918v1, February 27,2026
- Cofone, I. Beyond Data Ownership. Cardozo Law Review, Vol. 43:2
- General Data Protection Regulation (GDPR), Regulation (EU) 2016/679. (2016). EUR-Lex.
- Hardjono, T. et al. Data Cooperatives: Towards a Foundation for Decentralized Personal Data Management arXiv:1905.08819v1, May 15, 2019
- Jonker JD. Is Data Labor? Two Conceptions of Work and the User-Platform Relationship. Business Ethics Quarterly. 2025;35(2):153–186, December 12, 2024
- Kerry, CE. et al. Why Data Ownership is the Wrong Approach to Protecting Privacy. Brookings, June 26, 2019
- de Montjoye, Y.-A., Shmueli, E., Wang, S. S., & Pentland, A. S. openPDS: Protecting the privacy of metadata through SafeAnswers. PLOS ONE, 9(7), Article e98790, 2014.
- Morris Jr., John B. Why data ownership is the wrong approach to protecting privacy. The Living Law Library.
- Posner & Wyle. Radical Markets. Princeton University Press, May 15, 2018
- Solove, D. Privacy Self-Management and the Consent Dilemma Harvard Law Review, Vol:126:7
- Tsukayama, H. Why Getting Paid for Your Data Is a Bad Deal. Electronic Frontier Foundation, October 26, 2020
- Viljoen, S. A Relational Theory of Data Governance. Yale Law Journal, Forthcoming, November 11, 2020
- Warner-Hawley Bill Gets “Paying” With Data Wrong, Says Leading Tech Policy Think Tank, Information Technology & Innovation Foundation, June 24, 2019
- Wrabetz, Joan M. What Is Inferred Data and Why Is It Important? ABA Business Law Today, September, 2022
Originally published on Substack with a CC BY-NC-ND license on September 26, 2026. Please link to jim55.substack.com if you re-use this material.
