Why You Don't Own Your Own Data

In 2015, RadioShack filed for bankruptcy. The electronics retailer had 117 million customer records — names, addresses, phone numbers, email addresses, purchase histories — accumulated over decades. Those records were a balance sheet asset. When the company’s assets went to auction, the customer data was listed alongside the store fixtures and trademark.

The FTC had to intervene to block the sale. Regulators argued the sale would violate RadioShack’s own privacy policy, which had promised customers their data wouldn’t be sold to third parties. The bankruptcy court ultimately placed restrictions on what buyer General Wireless could do with the data.

Here’s what’s worth sitting with: the FTC’s intervention worked, in that case, because of a contract violation — RadioShack’s own policy. Not because customers owned their data. Not because personal information is property that can’t be transferred without consent. A retailer could list 117 million people’s personal information in a bankruptcy auction, alongside the furniture. The legal principle that allowed it was simple: customers never owned that data to begin with.

This is the reality most privacy discussions skip over. “Your data” is a phrase we use constantly, in news articles, in marketing copy, in legislation. It implies a proprietary relationship. That relationship, in most legal systems, does not exist the way the phrase implies.

The short answer: In the US, EU, and UK, personal data is not legally classified as property. You cannot claim title to it the way you claim title to a house. What you have instead is three kinds of rights. Contractual rights (from terms of service). Statutory rights (from laws like GDPR, CCPA, and India’s DPDPA). And tort remedies (when misuse causes real harm). These rights are real and worth exercising. But they operate inside a system where the licenses you already granted, and the data already copied and sold, largely stay in place.

Is your personal data legally your property?

Property law in common law systems (US, UK) is built around physical things and, more recently, intellectual creations. The same is true in most civil law systems, including EU member states. You can own a car. You can own a patent. You can hold a lease. Property ownership gives you the right to exclude others, the right to transfer, and a bundle of legal protections that follow from those.

Data doesn’t fit this framework. When you tell a bank your annual income, you haven’t transferred your income figure to the bank — you’ve communicated information. The bank now has a fact. You still have the same fact. The information has been duplicated, not transferred. Property law developed around things that can only be in one place at a time. Information can be in thousands of places simultaneously.

There is no US federal statute that classifies personal data as property and gives individuals title to it. There have been academic proposals and a handful of state-level proposals, but none have passed. The EU’s General Data Protection Regulation — the most comprehensive data protection regime in the world — deliberately chose a different model. The GDPR does not grant data subjects ownership of their personal data. It imposes obligations on the organisations that process it and grants individuals a set of specific rights. Obligations and rights, not ownership.

The UK Information Commissioner’s Office describes the GDPR framework this way: “Data protection law regulates what organisations can do with personal data; it does not give individuals a right of ownership over their own data.”

This is the foundation everything else rests on.

What you actually have: contractual rights, statutory rights, and tort remedies

Saying you don’t own your data isn’t the same as saying you have no rights over it. You have three categories of rights, each with different scope and different enforcement mechanisms.

Contractual rights are what the terms of service give you. When you sign up for a service, you enter a contract. That contract typically gives the company extensive rights over your data (more on this below). But it may also include promises: how the data will be used, whether it will be sold, and how long it will be retained. RadioShack’s privacy policy was a contractual commitment. The FTC intervention worked because the proposed bankruptcy sale would have breached that contract.

The limitation: contracts only bind the parties to them. A company’s privacy policy binds that company. It doesn’t bind every downstream recipient of your data once the company sells, licenses, or shares it.

Statutory rights are what legislation gives you. These are the substantive rights most people mean by “data rights.” The right to see what data a company holds about you. The right to request deletion. The right to object to certain uses. GDPR (EU and UK), CCPA (California), and India’s DPDPA are the most significant examples. These rights exist regardless of what any individual terms of service says. A company cannot contract out of them.

The limitation: statutory rights are rights to make requests, not ownership claims. You can ask for deletion. The company may have legal grounds to refuse. You can ask for a copy of your data. The company must provide it — but providing a copy doesn’t erase the original.

Tort remedies are the legal actions available when your data is misused in ways that cause identifiable harm. Several torts allow you to sue when personal information is published or used in ways that damage you. These include breach of confidence and privacy torts in US common law. They also include misuse of private information, a tort developed in UK courts after Campbell v MGN [2004]. These remedies are retrospective. They respond to harm that has already occurred.

The limitation: tort remedies require demonstrable harm. Speculative future harm, embarrassment, or discomfort at the mere fact of data processing generally doesn’t clear the threshold for a tort claim.

What “perpetual, irrevocable, royalty-free, sublicensable” actually means

The terms of service you agreed to almost certainly grant the company a license to use your data. That includes your social media account, your email provider, and your loyalty card. The standard formulation, used by platforms from Instagram to LinkedIn, runs something like this:

“You grant us a non-exclusive, transferable, sublicensable, royalty-free, worldwide license to use any content you post…”

Parse each word.

Non-exclusive: you can still use your own data; you’re not transferring it exclusively. This sounds friendly. It’s irrelevant to your interests — the company isn’t asking for exclusivity because they don’t need it.

Transferable: the company can assign the license to someone else. If they’re acquired, merge with another company, or — relevant here — go bankrupt, the license travels with the business.

Sublicensable: the company can grant the same rights to third parties. They don’t need your permission to share your data with advertisers, analytics firms, or data brokers. This is why a platform’s privacy policy can say “we may share your data with trusted partners” and mean it. The sublicense provision gives them the contractual right to do exactly that.

Royalty-free: they don’t pay you. You are not compensated for the commercial value your data generates.

Worldwide: no geographic restriction on where the data goes.

The RadioShack situation illustrates the transferable clause in practice. When the company went into bankruptcy, the license customers had granted — through their contractual relationship with RadioShack — was an asset. It could be transferred. The FTC intervened on policy grounds, not because there was a clean legal bar to the transfer.

This same dynamic plays out in every platform acquisition and bankruptcy. When MySpace was sold — multiple times, ultimately to Time Inc. in 2016 for $35 million — user data was part of what transferred. When businesses that collected data under one name are acquired by larger entities, the data portfolio follows. The privacy policy you read in 2015 was written by a company that no longer exists in the same form.

The EU General Data Protection Regulation came into force in May 2018. It’s the most comprehensive personal data regulation enacted in a major jurisdiction, and it has produced billions of euros in fines. But it’s worth being precise about what it actually does.

GDPR doesn’t give you ownership of your personal data. It structures a legal relationship between you (the “data subject”) and organisations that process your data (“data controllers” and “data processors”). Controllers have obligations. You have rights you can exercise against them. The regulation defines what lawful processing looks like. The bases are consent, contract, legitimate interest, legal obligation, vital interests, or public task. It restricts processing to those.

This framework is genuinely powerful. It means a company can’t simply collect everything and do whatever it wants. It means you have enforceable rights. It has produced major enforcement actions. In 2023, Ireland’s Data Protection Commission fined Meta €1.2 billion. The reason: transferring EU user data to the US without adequate safeguards. Google was fined €150 million in France in 2022 across two entities. These aren’t symbolic numbers.

But the framework is explicitly one of regulated relationships, not property rights. The GDPR uses the language of “lawful basis,” “proportionality,” and “data subject rights.” It never uses “ownership,” “title,” or “property.” This distinction matters. It shapes what you can actually do with your rights.

The right to erasure is real, but the exceptions are substantial

Article 17 of the GDPR is the so-called right to be forgotten. You can request that a data controller erase your personal data. They must comply unless one of the Article 17(3) exceptions applies.

The exceptions:

Legal obligation: The controller is required by law to retain the data. Tax authorities require financial records to be retained for specified periods. Employment law requires payroll records. Healthcare regulations require patient data. These legal retention mandates override your erasure request.
Legitimate interest overriding yours: If the controller is processing your data under the legitimate interest lawful basis and their interest overrides yours, they can refuse. In practice, this exception is most relevant for things like fraud prevention and network security.
Legal claims: If the data is necessary for the establishment, exercise, or defence of legal claims — either yours or theirs — deletion can be refused. A company defending litigation involving your account is not required to delete the evidence.
Public interest / scientific research: Health data, statistical research, and archiving in the public interest can override erasure requests.
Freedom of expression: A newspaper is not required to delete a factually accurate article about you from its archive because you request it under Article 17.

For most commercial contexts, these exceptions are less likely to apply. Think of your account data at a retailer, your browsing profile at an advertiser, or your contact information at a data broker. Erasure requests to commercial companies, sent with a clear statement of withdrawal of consent, succeed reasonably often. But “succeed” means the controller confirms deletion from their active processing systems. It doesn’t mean your data disappears.

When you delete data, is it really gone everywhere?

When a company tells you it has deleted your personal data, the statement is accurate within limits that matter.

Backups. Enterprise databases operate with backup cycles. When data is deleted from a production system, it persists in backup copies until those backups are overwritten or explicitly purged. Standard backup retention schedules range from 30 days to several years. A company that deletes your data “promptly” may still have it in backup infrastructure for months. GDPR Article 17 requires erasure “without undue delay.” But there is no specified period for backup purging. Regulators have generally accepted that backup deletion follows normal IT cycles.

Derived data. This is the more structurally significant problem. Companies don’t just store the raw data you gave them. They generate inferences from it. Your income bracket comes from your spending, your health indicators from your searches. Your political views come from your engagement, your creditworthiness from behavioral signals. When you delete your data, these inferences are not necessarily covered by the deletion request. They may be accurate, may be wrong, and are yours in any meaningful human sense. But the derived profile is the controller’s own analysis, not your personal data in the same direct sense.

Under GDPR, inferences are personal data if they relate to you and can identify you. But in practice, the line between your data and the analysis derived from it gets blurry. Companies have argued, sometimes successfully, that derived datasets fall outside the scope of specific deletion requests.

Third-party sharing. GDPR Article 17(2) requires a controller who has made your data public to inform others who are processing it that you’ve requested erasure. But “public” has a specific meaning here — it refers to data the controller has published, not data they’ve shared in commercial transactions. Data sold to a data broker is not “public” in this sense. The controller who sold it should have deleted it on their end. Whether the broker they sold it to deletes it depends on whether that broker responds to your separate request.

The practical result: an erasure request to Platform A removes your data from Platform A’s active systems. It does not retrieve data already sold to advertisers, data brokers, or analytics firms before the request was made. Those transfers happened under the license you granted in the terms of service.

Data portability: technically a right, practically limited

GDPR Article 20 gives you the right to receive your personal data in a structured, commonly used, machine-readable format. The intent was to reduce lock-in and let people move between services. For instance, take your data from one cloud storage provider to another, or move your contact list between email services.

The right applies when processing is based on your consent or on a contract, and when processing is carried out by automated means. For most consumer data held by commercial platforms, this covers a lot.

In practice, data portability as implemented ranges from adequate to useless. Google Takeout is genuinely functional — you can export your Gmail, Calendar, Photos, and Contacts in usable formats. Facebook/Meta’s data download is comprehensive but produces enormous archives in formats not easily processed by anything other than the original platform. LinkedIn’s download is incomplete. Most smaller services and data brokers implement portability badly or not at all.

The Article 20 right does not include having the data transferred directly to a competitor in real time. That requires interoperability, which GDPR does not mandate. (The EU’s Data Act, which focuses more on non-personal data, moves in this direction for specific sectors.) What you have is a right to a download. Whether you can do anything useful with it depends on the format.

The “data as labor” argument has gone nowhere legislatively

A strand of academic and activist thinking argues that your data has economic value, so you should be compensated for producing it. It generates revenue for platforms, trains AI models, and drives advertising pricing. Senator Mark Warner introduced a bill in 2019, the Designing Accounting Safeguards to Help Broaden Oversight and Regulations on Data Act (the DASHBOARD Act). It included provisions for platforms to disclose the value of user data. It didn’t pass.

The theoretical case for “data as labor” is made most fully by Imogen Heap and Jaron Lanier. Economists like Glen Weyl and Eric Posner make it too, the latter two in their book Radical Markets. The argument is that data is something you contribute, which generates economic value, and for which you should be paid. Treating it as labor would create better incentives all around. Platforms would have to actually value user data rather than treating it as a free input.

The legislative reality is that this framework hasn’t been enacted anywhere at scale. No major jurisdiction has passed a law requiring platforms to pay users for their data. The EU’s focus is on obligation and rights, not compensation. The US federal framework doesn’t exist in the first place. The data as labor movement remains a policy discussion, not a legal right.

The practical implication is simple: you currently produce economic value through your data, and you are compensated zero for it. The terms of service make this explicit — “royalty-free” is right there in the license grant.

The breach exposure problem

One consequence of companies accumulating large amounts of your data is structural: the more a company holds, the more you’re exposed when they’re compromised.

The average time between a data breach and its discovery was 204 days globally in IBM’s 2023 Cost of a Data Breach Report. In the healthcare sector, which retains extensive personal data for legally mandated periods, breach exposure times have been longer. The data a company holds because you exercised your data rights and kept your account open is also the data exposed if their security fails.

You can shrink that exposure. Submit deletion requests for accounts you no longer use. Opt out of data sharing where allowed. And remove yourself from data broker databases, such as Spokeo or Whitepages, which resell your details to anyone who pays. This is not just a privacy argument. It is a security argument. A profile that does not exist cannot be stolen.

What you can actually do today

The following is a jurisdiction-by-jurisdiction summary of the rights you hold and how to exercise them.

United States

Federal level: No comprehensive federal privacy law exists for most private-sector data. The main federal frameworks are sector-specific: HIPAA covers health data, FERPA covers education records, COPPA covers children’s data online, the FCRA covers consumer reporting data (credit, background checks). For most general consumer data, there is no federal right to access or deletion.

California (CCPA / CPRA): If you’re a California resident, the California Consumer Privacy Act and its 2023 amendments (CPRA) give you:

Right to know what personal data businesses collect and how they use it
Right to delete personal data (with exceptions)
Right to opt out of the sale or sharing of personal data
Right to correct inaccurate data
Right to limit the use of sensitive personal information
Right to non-discrimination for exercising these rights

To exercise: Most covered businesses have a “Do Not Sell or Share My Personal Information” link in their site footer, required by CCPA. For deletion, contact their privacy team directly. For data broker removal specifically, the California DELETE Act (effective 2026) requires the California Privacy Protection Agency to create a one-stop portal for data broker opt-outs.

Other states: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and several others have passed state-level privacy laws since 2021. Rights vary by state but generally include access, deletion, and opt-out of targeted advertising.

Regulator: The California Privacy Protection Agency (CPPA) handles CCPA/CPRA complaints. For HIPAA violations, the Office for Civil Rights at HHS. For FCRA violations, the Consumer Financial Protection Bureau (CFPB) and the FTC.

Rights available:

Access (Article 15): What data, what purpose, who it’s shared with. Response within 30 days.
Rectification (Article 16): Correct inaccurate data. No charge.
Erasure (Article 17): Request deletion. Subject to exceptions detailed above.
Restriction of processing (Article 18): Pause processing while disputing accuracy.
Data portability (Article 20): Receive your data in machine-readable format.
Right to object (Article 21): Object to processing based on legitimate interest; absolute right to object to direct marketing.
Rights related to automated decision-making (Article 22): Object to decisions made purely by automated means, including profiling.

How to exercise: Identify the company’s Data Protection Officer (required for large processors — contact details must be in the privacy policy). Send a written request by email stating the specific article you’re invoking. They must respond within 30 days. For non-response or improper refusal, file a complaint with your national Data Protection Authority.

Key regulators:

CNIL (France): cnil.fr
BfDI (Germany): bfdi.bund.de
DPC (Ireland): dataprotection.ie — handles complaints against Meta, Google, Apple, Microsoft, TikTok, and most US tech companies headquartered in Dublin
ICO (UK): ico.org.uk (post-Brexit UK GDPR)
Garante (Italy): garanteprivacy.it

Cost: Free for the first request. Companies can charge a reasonable fee for subsequent manifestly unfounded or excessive requests.

After Brexit, the UK retained the GDPR framework as UK GDPR, enforced by the Information Commissioner’s Office. As of mid-2026, the core rights remain substantively similar to EU GDPR. The UK changed the framework through the Data (Use and Access) Act 2025 (Royal Assent June 2025, most data-protection provisions in force by mid-2026). It adds flexibility on legitimate interests, reshapes the rules on solely automated decisions, and eases some administrative requirements. The core individual rights remain in place.

How to exercise: Same as EU GDPR. The ICO has a complaints portal at ico.org.uk. The ICO can fine companies up to £17.5 million or 4% of global annual turnover.

Notable enforcement: The ICO fined British Airways £20 million in 2020 for a 2018 breach affecting 400,000 customers. The fine was reduced from an initial notice of £183 million. Enforcement is active.

India (DPDPA)

The Digital Personal Data Protection Act 2023 came into force in stages. Its rules were notified in November 2025. The rights framework includes:

Right to access information about data processing
Right to correction and erasure of personal data
Right to grievance redressal
Right to nominate a person to exercise rights in case of death or incapacity

How to exercise: Submit a request to the company’s Data Protection Officer or designated grievance officer (required for significant data fiduciaries). Companies must acknowledge and respond within the timelines set by the rules.

Important limits: The DPDPA contains broader exemptions for government data processing than GDPR. Its enforcement is still ramping up. The Data Protection Board of India, the designated enforcement body, has been formally established, but its full penalty powers and most compliance duties phase in through 2027. For now, the primary route is the grievance officer process, with escalation to the Board as its powers come into force.

Key difference from GDPR: The DPDPA does not include an equivalent to GDPR’s right to object to processing or a right to data portability in the same terms. The erasure right exists but is narrower than GDPR Article 17.

The underlying asymmetry — companies holding broad contractual licenses and statutory limitations on your ability to constrain them — is structural. The rights described above are real and worth exercising. An erasure request removes your data from an active marketing database. A SAR reveals what a data broker actually holds on you. An Article 21 objection stops direct marketing. These have immediate, practical effects.

But they operate within a system that leaves a lot in place. The data that already exists. The inferences already drawn. The licenses already granted in terms of service you agreed to. The phrase “your data” describes something you can influence. It doesn’t describe something you own.

Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.