Three steps to fix social media

In this blog post, I describe three steps that lawmakers and regulators must take to stop the exploitation of our data by the major social media companies and force these companies to change their business models. The steps build on the data export feature that some of these services have implemented, allowing us to see much of the data that these services collect about us.

The first step is to require the social media services to provide a complete, accurate, and up-to-date specification of all the data these companies collect on us. This specification can be considered as the ‘data contract’ for the service. The data exports they provide to us should comply with the model in this data contract. The data contract should be provided as an appendix to the privacy policy and the terms & conditions for the services of a company. Furthermore, the data contract should describe the model in which data about a single person is stored from the perspective of that person. More specifically, the model should:

• Show who on the platform can create, browse, discover, read, update, delete, purge or append each data element.
• Include a detailed semantic description of each data element.
• Provide a syntax for the permitted values for each data element.
• Describe what level of security is applied to the storage of each data element.
• Use standardized data constructs (i.e., for an address or a purchase) wherever feasible.
• Be a technical specification that can be parsed by software.
• Document the model in a unified and standardized format (i.e., JSON Schema extended with additional capabilities).
• List the 3rd parties this data element is shared with either programmatically or as a bulk data transfer and what restrictions are placed on these parties for the usage of this data.

With this data contract, third parties can develop tools to explore the data exports and transfer the data between different services.

The second step requires social media services to enable people to store their data outside the data centers of the social media service, in what I’ll call ‘data pods.’ In this model, the social media services and their apps have to query our data pods to get the data they need to deliver their services and keep the data in our data pod up to date. The data pod will use the data contract provided by the service to determine whether it should grant access to the requests by the service and, if permitted, respond to the request with that data. People could decide to operate their own data pod for storing their data, but a more likely option would be for non-profit data trusts to store this data on behalf of people.

After this is fully implemented, lawmakers can implement the final and most dramatic step: Block the social media services from storing any data about us in their own data centers. With this final step implemented, each of us suddenly has full control over who can access our data. We can see all our data at any given time. We can see who requests our data. We can block those requests if we want to. We don’t have to ask a service to forget about us, as we can make the service do just that by revoking their access to our data pod.

Granted, there would be some limited exceptions for storing data in the data centers of the service. One exception would be to cache some of the data to enable search and discovery in the service. This cached data would expire after a fixed time, say 1 day, after which the service again has to request the data from our data pod. To comply with laws and regulations around retention for certain data, services may be required to store some data, such as purchase transactions. Exceptions like these would also be described in the data contract of the service.

To host the data, the adventurous among us could host the data pod on a public cloud, in a server in our home networks, or even as a distributed application. However, most people would likely select a newly established non-profit data trust to host a data pod on their behalf. We likely could choose to either pay the trust a small monthly fee for that service or allow the trust to monetize some of our data to pay for the hosting.

With these three sequential steps, we have a strategy to address the dominance of our online life by this small group of Internet giants and severely limit their opportunities to violate our privacy. These steps would fundamentally change how social media services operate and require major architectural changes in their technical infrastructure. We have to consider that the time between the steps could very well be 3 to 5 years. However, the results would be well worth the effort. Not only would our privacy be much better protected, but gaining complete control over our own data opens all kinds of new possibilities. Below are three examples:

Increased competition: with better privacy protection, we will be more likely to give new social media services a try. We can grant a new service access to some of our existing data so that it can immediately use that data to provide us tailored services that are meaningful and interesting to us. The increased competition forces the existing companies to innovate and adapt their service to better match our needs.

Run our own algorithms: now that we have direct access to our data, we can run our own algorithms to generate our feeds for us. I can imagine that a marketplace of algorithms would become available for us to choose from, allowing us to select an algorithm that not only provides us with our favorite content but also filters out extreme and false information.

New services: Companies can innovate and develop new service offerings faster and at a lower cost as they do not have to invest in data storage. The service could scale out more easily as the distributed data pods provide a vast pool of processing power.

These examples show only some of the possibilities that become available in this new model. We can only imagine the burst of innovation that would happen if we break the stronghold that the behemoths have over us and the societies we live in.