← cd ~ ~/research/the non-ownership of data
personal research · privacy · milan 2023 → florence 2026

The Non-Ownership of Data

In May 2023, for a digital-products law exam at the University of Milan, I wrote an essay called The non-ownership of data. The argument was simple: what we produce online stops being ours the moment it is recorded. Platforms collect it, keep it, process it and sell access to it. The GDPR was the first real attempt to give some of that control back. Three years later I tested it. I asked Spotify, Instagram and Google for everything they had on me, merged it into one timeline of 605,610 events over eleven years, and asked the question the essay only asked in theory: how much can someone work out about a person from their traces alone?

These traces, once aggregated, are used by third parties to pursue their own interests.

— my essay, Milan, 2023

01Explicit and Implicit Datathe map of where my phone pointed

The essay separated two kinds of data. Explicit data is what you hand over yourself: name, birthday, email. Implicit data is what gets recorded while they watch what you do: every song, like, search, map view and message timestamp. My explicit data would fit on a business card. This is the implicit part, month by month.

where my phone pointed · 2015 → 2026
5 km grid · blurred on purpose

Every square is a 5 km cell where Google Maps recorded activity. Bright ones are the last few months, dim ones are everywhere the data has ever pointed. The strip underneath is the volume of everything logged, by source, with the four phases a changepoint algorithm found without being told anything about my life. Drag it to move through time.

02What Can Be Inferredeleven conclusions, one of them wrong

In the essay, profiling was something platforms did to us. Here I did it to myself, with Python and a few evenings. Every line below comes from the data alone.

03You Are the ProductMeta's own profile of me

If you're not paying for it, you're not the customer, you are the product being sold.

— quoted in my essay, Milan, 2023

I quoted that line in 2023. The Instagram export shows what it looks like from the inside, in two parts. The first is the list: every company that holds me in an audience. The second is the feed: every ad it actually put in front of me during the last week before the export. Reading them side by side shows what I'm being sold as, and how little of the reasoning I get to see.

the list

902 companies uploaded a file of their own (emails, phone numbers, past customers) and my profile matched a line in it. To them I'm not just an audience, I'm a line in their own files. Below is every one of them, as Meta lists it. The other 2,425 built an audience out of people who visited their site, used their app or interacted with them on Instagram.

companies that have me in their audience list

    the feed

    what they sold me · one week of instagram ads
    grouped by advertiser and caption · click the bar to see who paid

    when the ads arrive · hour of day
    they got some rightPrada in four regional accounts, Dior, Chanel and Zegna had me on their lists. I've modelled for Prada and Zegna. Whether that's why I'm on their lists, the export doesn't say. "Frequent travelers", "food and restaurants" (I was a waiter for years), "friends of recently moved".
    and some wrongMeta still says my profile is based in Udine. I moved away in 2021. Being wrong doesn't make the profile harmless: I'm still sold on that profile.
    consentMy consent for "processing by advertising partners" dates back to April 2018, five weeks before the GDPR came into force. The banners of that spring were designed to be clicked through, which was one of the essay's complaints.
    the price of not being the productSince late 2023 Meta has offered EU users a paid subscription with no ads. In the export its status is not active. I still don't pay for it, so the quote still applies to me.

    Source: ads_information/ in the Instagram export. Ads and videos are measured over the only week Meta includes (11–18 September 2026). Ads are grouped by keyword rules on the advertiser's name and caption; examples are brands only, never private accounts. Advertisers in the list are a sample of recognisable brands out of the full list.

    04Other People's DataCambridge Analytica, at home

    The part of the essay I think about most is Cambridge Analytica. The quiz didn't only collect the data of whoever took it. It collected their friends' data too, and 87 million people ended up in a dataset they never agreed to. My own export has the same problem, on a small scale.

    84,220messages in my Instagram export were written by other people, across 811 conversations. None of those people asked for a copy of their words to end up in my zip file, and none of them could stop it.

    That is why no name of anyone else appears on this page, and why the analysis only uses the shape of conversations: when, how often, with how many people. Never what was said. That shape is revealing, and it can also be wrong: see the relationship line in section 02.

    05When I'm Awakedaily rhythm and sleep

    activity · weekday × hour
    heatmap
    quietest 6 hours of the day, per year
    local time (Italy/France)brighter = more events

    Nobody logs their sleep on Instagram, and they don't need to. The 6-hour window with the least activity is a good proxy for sleep, and mine moved three hours later over the decade.

    06Did I Choose This?me or the feed

    The essay's biggest worry wasn't privacy. It was soft power: feeds decide what we see, what we see shapes what we think, and what we think feeds the algorithm again. My data shows my taste changing a lot. Italian rap goes from almost nothing to a third of my listening, and YouTube drifts toward streamers, podcasts and "money" content. So I checked who actually picked each video and each song: me, or the feed.

    96%
    who picked it · youtube

    A video counts as searched if I searched YouTube or Google for matching words in the 30 minutes before, and as subscribed if it comes from one of the 53 channels I follow today. Everything else came from the home feed, Shorts, autoplay or a link someone sent me. Ads are the entries Google itself marks as "from Google Ads". Only 2024 onwards: before that the history is too sparse.

    who picked it · spotify

    From Spotify's reason_start field: picked means I tapped the song, queue means it started because the previous one ended or I skipped forward. The queue can be my own playlist or Spotify's radio; the export doesn't say which, so "queue" is not all algorithm.

    spotify · per year

    Italian share is based on my own labels for the top 350 artists, who cover 95% of all plays. The rest counts as non-Italian, so the share is a lower bound.

    youtube · what the watch history is about

    Labelled by channel and keyword rules. The grey part is the long tail no rule matched. Google only kept my full watch history from 2023 on.

    07Even Data Lieserrors a naive reading would make

    A profile doesn't have to be true to be used. These are the places where the data would have fooled me if I hadn't lived it.

    my attention span didn't collapseSpotify's skip rate jumps from 0% to 58% between 2021 and 2023. My listening didn't change, the field did: before 2022 the export doesn't record skips at all. A naive analysis would have written a story about TikTok.
    I lived in ParisSpotify's connection country puts me in Italy for almost all of 2025, while Maps puts me in Paris. The reason is roaming: an Italian SIM gets an Italian IP.
    looking is not beingA map view means I looked at a place, not that I was there. Cities only count when they dominate a month.
    gaps look like silence2015–2016 is almost empty because my first phone and old accounts logged little, not because I was offline. Missing data is missing, not zero.

    08The Right I Wrote Aboutthe GDPR in practice

    This project exists because of two rights the GDPR introduced, the ones I listed in 2023. It also shows where they fall short.

    art. 15 · accessAnyone can ask any company what it holds on them. Three requests, three exports, gigabytes of data, no lawyer.
    art. 20 · portability"Machine-readable", says the law. I got JSON, CSV, HTML and an mbox, and Instagram's JSON turns più into più. Readable, with some work.
    what the export doesn't sayI got back the inputs: what I did. Only Meta included any outputs, the labels and audiences, and only a sliver. What they're used for stays on their side.
    fines as a cost of doing businessMeta's €1.2 billion fine in 2023, over EU data sent to the US, is a small share of its revenue. The fines are real. Their effect is less clear.
    # how this page was built 1 parse spotify/*.json · instagram/** · takeout/** → timeline.csv, 605k rows 2 features one row per month, behaviour only: volume, night and weekend share, novelty, dominant city 3 phases changepoint detection → breaks at 2017-04 · 2019-04 · 2022-11 4 export gigabytes → 97 KB of aggregates, the file this page loads (+ 172 KB of map outlines) ✕ no message text ✕ no search queries ✕ no names of other people ✕ no location finer than 5 km, except one address, on purpose

    09Considerationswhat's left

    It isn't only about writing better laws or building safer technology. Above all it's about building a society that is more aware and more responsible.

    — my essay, Milan, 2023

    In 2023 I ended the essay optimistic, but without an answer. Three years later I still don't have one. What I have is this page: the same argument, made with my own data instead of other people's scandals. If you want to see yours, ask for it: Google Takeout, Spotify (ask for the extended streaming history), and Instagram under Accounts Center → Your information and permissions. It takes from a few hours to 30 days.