Civil society, regulators, and legislators must stop thinking in terms of mountains of data, where power comes from the ability to accumulate it, and is diminished by letting others have copies of it or reducing its collection. The smart money is on the power firms can gain through controlling code and computation, even when data never leaves a device in an identifiable way. 

The harms of hoarding data are real, but also old news. Now, the focus needs to move to legal limits to the practices and outcomes from personalisation, profiling, and controlling attention, not just limits to the data shared in the process.