As we digest the Cambridge Analytica scandal engulfing Facebook, the prevailing narrative is that the data genie can’t be put back in the bottle. Our data is out there. The internet won’t work without us giving it up. There is nothing to be done but hope regulators compel companies to be on their best behavior.

But that simply isn’t true. While there may be a policy solution, there could also be various technical ones. In particular, Facebook could design its systems so it didn’t manage all our data by default. Instead, user data could be stored inaccessible to Facebook until users gave the service explicit permission to tap into it. Users could still see ads, keeping Facebook’s business model intact.