How Worldwide Movements For Data Sovereignty Reshape Digital Self-Determination

Shoshana Zuboff's The Age of Surveillance Capitalism (2019) provides the most comprehensive mapping of the system that data sovereignty movements challenge. Her core argument:

1. Behavioral surplus: Tech companies collect far more data than they need to improve their products. The excess -- your behavioral patterns, your emotional responses, your social connections, your location history -- is "behavioral surplus," extracted and sold to advertisers and others who want to predict and influence your behavior.

2. Prediction products: This behavioral surplus is processed into prediction products -- models of what you're likely to do next, what you're likely to buy, how you're likely to vote, what you're likely to feel. These products are sold on what Zuboff calls "behavioral futures markets."

3. Instrumentarianism: The system's ultimate logic is not just to predict behavior but to shape it. Nudges, prompts, recommendations, and environmental modifications are deployed to make your behavior more predictable and thus more valuable.

The scale of extraction is staggering. As of 2025, the global data broker industry is worth an estimated $250 billion. Facebook (Meta) generates approximately $120 billion annually in revenue, almost entirely from advertising powered by behavioral data. Google generates over $200 billion, similarly. Amazon's advertising business, powered by purchase behavior data, generates over $40 billion.

These companies are not selling technology. They are selling predictions about humans. And the raw material for those predictions is harvested from humans, mostly without meaningful consent.

---

The legal framework of digital consent is largely fictional. Studies consistently show:

- The average person would need approximately 76 working days per year to read all the privacy policies they encounter (McDonald & Cranor, 2008). - Over 90% of users click "accept" without reading terms of service. - Terms of service are written at a reading level that exceeds the average adult's literacy. - Many consent mechanisms use dark patterns (pre-checked boxes, confusing navigation, "consent or leave" ultimatums) that undermine genuine choice. - Consent is typically binary (accept everything or use nothing), offering no granular control.

The result: virtually no one has genuinely consented to the data collection practices of the major tech platforms. The consent framework is a legal fiction that provides liability protection for companies, not autonomy for individuals.

GDPR and similar regulations have improved this modestly -- requiring explicit opt-in for certain categories of data, granting rights to access and delete data, and mandating data protection officers. But the fundamental business model -- extract behavioral data, build prediction products, sell influence over behavior -- remains legal and dominant.

---

Data sovereignty operates at three levels, each with distinct stakeholders and mechanisms:

1. Individual Data Sovereignty

The right of individual persons to control data about themselves.

Key rights (established or proposed in various jurisdictions): - Access: The right to know what data is collected about you. - Portability: The right to take your data with you when you leave a platform. - Erasure: The right to demand deletion of your data ("right to be forgotten"). - Restriction: The right to limit how your data is processed. - Objection: The right to opt out of certain uses (profiling, automated decision-making). - Explanation: The right to understand how automated decisions affecting you are made.

2. Community and Indigenous Data Sovereignty

The right of communities -- particularly indigenous peoples -- to govern data about their communities, lands, and cultural practices.

The CARE Principles for Indigenous Data Governance: - Collective benefit: Data ecosystems should be designed for the benefit of indigenous peoples and their communities. - Authority to control: Indigenous peoples' rights to govern their data should be recognized and respected. - Responsibility: Those working with indigenous data have a responsibility to support indigenous data governance. - Ethics: Indigenous peoples' rights and wellbeing should be the primary concern.

Why this matters: When genetic data is collected from indigenous communities for medical research, when cultural practices are documented and databased, when satellite data maps traditional lands -- all of this creates data about communities that has value and can be used for or against those communities' interests. Without collective data sovereignty, indigenous knowledge, genetic heritage, and territorial information can be extracted and exploited.

The Maori Data Sovereignty Network (Te Mana Raraunga) in New Zealand has been a leader in this space, establishing principles for Maori governance of Maori data across government and research institutions.

3. National Data Sovereignty

The right of nations to regulate data generated within their borders and to prevent uncontrolled extraction by foreign entities.

This level is the most politically charged. China's data localization requirements, Russia's data residency laws, and India's evolving data governance framework all assert national sovereignty over data. The motivations are mixed -- some are genuine protections of citizens' data, others are mechanisms for state surveillance. The challenge is distinguishing legitimate data sovereignty from authoritarian data control.

The EU's GDPR is arguably the most balanced model: it asserts regulatory sovereignty over data of EU residents regardless of where the processor is located, while maintaining democratic governance, independent oversight, and individual rights.

---

Emerging governance models propose alternatives to both individual control (which is limited by power asymmetry) and state control (which risks authoritarianism):

Data trusts: Legal structures where data is held by a fiduciary on behalf of a defined group of beneficiaries. The trustee manages the data according to the beneficiaries' interests, negotiating access, licensing, and benefit-sharing on their behalf. This model addresses the power asymmetry between individuals and tech corporations by creating collective bargaining structures.

Data commons: Governance models where data is treated as a shared resource, managed collectively by the community that generates it. Open-source data projects, community health data cooperatives, and municipal data platforms all instantiate versions of this model.

Data cooperatives: Barcelona's DECODE project experimented with data cooperatives, allowing residents to pool data under collective governance and decide collectively how it is used. The model applies cooperative principles (democratic governance, shared benefit) to digital data.

---

The data sovereignty question is, ultimately, a question about the structure of power in the digital age.

If data remains concentrated in the hands of a few corporations and governments, the power asymmetry between those entities and ordinary people will continue to grow. Behavioral prediction and modification will become more precise, more pervasive, and more difficult to resist. The autonomy that Law 1 presupposes -- the ability to make genuinely free choices about how to live, who to connect with, and what to believe -- will be progressively undermined.

If data sovereignty is established -- at individual, community, and democratic levels -- the digital infrastructure becomes a tool for human flourishing rather than a mechanism for behavioral extraction. The difference between these futures is the difference between a civilization that uses technology and one that is used by it.

---

1. Data Audit: Request your data from one major platform you use (Google, Facebook, Amazon -- all have data request tools). Review what they have. Were you surprised?

2. Consent Analysis: The next time you encounter a cookie consent banner or terms of service, actually read it. Time how long it takes. Assess whether a reasonable person could make an informed decision based on what's presented.

3. Community Data Mapping: What data about your community exists? Who holds it? (City government, tech companies, health systems, real estate firms.) Who benefits from it? Who controls it?

4. Governance Design: Design a data trust for your neighborhood. What data would it hold? Who would the trustees be? What rules would govern access? What would you not allow?

---

- Zuboff, S. (2019). The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. PublicAffairs. - Carroll, S. R. et al. (2020). "The CARE Principles for Indigenous Data Governance." Data Science Journal, 19(1), 43. - Couldry, N. & Mejias, U. A. (2019). The Costs of Connection: How Data Is Colonizing Human Life and Appropriating It for Capitalism. Stanford University Press. - Delacroix, S. & Lawrence, N. D. (2019). "Bottom-Up Data Trusts." International Data Privacy Law, 9(4), 236-252. - Te Mana Raraunga. (2018). Principles of Maori Data Sovereignty. taiuru.maori.nz.