Control and ownership are not the same. Some people propose a capitalist-market solution to data harvesting and surveillance, which is that people should ‘own’ their data and be paid a tiny amount for surrendering it to a company. This is a complete red herring and won’t solve any practical problems. Another approach, adopted by the new European Data Protection Directive, is to require people to give ‘consent’ for their data to be collected. That’ll help against certain things—namely, data collection by systems that you never knew you were using, or never agreed to use. But it’s so easy for them to get formal consent that it’s a worthless barrier. Any site that has a Facebook ‘like’ button, or a Google Analytics tracker, just needs to include in its Terms and Conditions—which nobody reads—a statement saying: ‘I consent to my visit being recorded by various other sites that have an agreement with this one.’ I call this ‘manufacturing consent’. Consent regulations may be useful against Facebook, because it’s been tracking visitors to thousands, if not millions, of websites for many years, and hasn’t even bothered to get this sort of consent—so Facebook is in trouble if it uses any of this data. But in future this will probably just be a formal restriction, and not a matter of substance. We should not allow any collection of data that goes beyond the minimum that is inescapably necessary for the site to do its main job—and then we should develop technology to reduce that minimum-necessary amount.