In the summer of 2012, a group of scholars at the Annenberg School for Communication at the University of Pennsylvania led by Joseph Turow put out a national survey on public attitudes toward targeted political advertising. The results were stark. Nearly nine in 10 Americans said they didn’t want political ads tailored to their personal interests. Eighty-five percent agreed with the statement, “If I found out that Facebook was sending me ads for political candidates based on my profile information that I had set to private, I would be angry.”

The report got healthy coverage in mainstream outlets like The New York Times and NPR’s Fresh Air, as well as industry journals like ClickZ. But it had zero impact on political advertisers. At the time, Rich Masterson, the chairman of Campaign Grid, told me, “There are many surveys that indicate Americans do not like negative campaign advertising, exercise, or health diets. The fact that Americans do not like these things does not make them bad.”

Jim Walsh and Chris Massicotte, then the CEO and COO of DSPolitical, a Democratic firm that claims to have invented the “political cookie” (an online tool for targeting individual voters), told me that digital targeting was just like direct mail. “Just like any new technology, it comes with a level of apprehension, but once people know more about what it can do, namely spare them from being flooded with useless political ads that they would prefer not to see, more people will accept it.” (Walsh recently resigned from DSPolitical amid allegations of sexual misconduct.)

After Barack Obama won reelection in 2012, voter targeting and other uses of Big Data in campaigns was all the rage. The following spring, at a conference titled Data-Crunched Democracy that Turow organized with Daniel Kreiss of the University of North Carolina, I listened as Ethan Roeder, the head of data analytics for Obama 2012, railed against critics. “Politicians exist to manipulate you,” he said, “and that is not going to change, regardless of how information is used.” He continued: “OK, maybe we have a new form of manipulation, we have micro-manipulation, but what are the real concerns? What is the real problem that we see with the way information is being used? Because if it’s manipulation, that ship has long since sailed.” To Roeder, the bottom line was clear: “Campaigns do not care about privacy. All campaigns care about is winning.”

A few of us at the conference, led by the sociologist Zeynep Tufekci, argued that because individual voter data was being weaponized with behavioral-science insights in ways that could be finely tuned and also deployed outside of public view, the potential now existed to engineer the public toward outcomes that wealthy interests would pay dearly to control. No one listened. Until last year, you could not get a major US foundation to put a penny behind efforts to monitor and unmask these new forms of hidden persuasion.

If there’s any good news in the last week of revelations about the data firm Cambridge Analytica’s 2014 acquisition (and now-notorious 2016 use) of the profile data of 50 million Facebook members, it’s this: Millions of people are now awake to just how naked and exposed they are in the public sphere. And clearly, people care a lot more about political uses of their personal data than they do about someone trying to sell them a pair of shoes. That’s why so many people are suddenly talking about deleting their Facebook accounts.

That said, we have a big problem and it isn’t just with Facebook or Cambridge Analytica. Nearly the entire Internet is based on the following trade: You give us intimate personal data, and we give you magical services for free. This is the original sin, and almost every major website you visit (except Wikipedia) commits it. (Yes, dear online Nation reader, there are at least five trackers running on you as you read this.)

Add then the sin of omission: Instead of building public spaces online where all were equally free to participate, in the same way that one can walk into a public park or, if duly registered, cast a ballot, without fear of being tracked, our leaders did nothing and let private capital colonize all of the digital public sphere.

Imagine, if you went browsing for books in a bookstore, the store monitored which books you took off the shelves, what pages you flipped to, how much time you spent on each book, and then what you bought… and then made that information available to advertisers, let alone political campaigns. That in essence, is the deal most Americans have tacitly made with Google and Facebook.

Or, imagine if when you went to a political rally in a park, the telephone company made a deal with the campaign holding the rally and gave it everyone’s cell-phone numbers and subscriber information… and then if you complained about it, said, well, you agreed to give up your privacy when you started using the phone you bought from us. Shocking, right? But today, if you want, the Democratic data firm TargetSmart will sell you a voter database of millions of people who attended one of the 200 biggest Women’s Marches in January 2017, based on mobile-device data that it got from telcos.

In the early days of the Internet, we thought that the rise of connection technologies would give ordinary voters all kinds of ways to band together and have a voice, and shift power from insiders to outsiders and from entrenched incumbents to vibrant challengers. That has happened. But what we failed to recognize was how much power Internet users were giving away at the same time to data aggregators and brokers like Facebook, Google, and the many intermediaries also amassing their own data troves.

Privacy, as Edward Snowden has eloquently argued, is the “fountainhead of all other rights.” It is “the right to a self [and] what gives you the ability to share with the world who you are on your own terms.” If we don’t insist on a digital public sphere that treats the information of individuals as private by default, we will just be rats in a maze built and owned by a few digital wizards and their investors. If we want a way out of this mess, it starts by recognizing that we have to remake the Internet back into a public square owned by us.

In May, when the General Data Protection Regulation starts to take effect in Europe, we will all see a subtle shift in how big platforms deal with our data. That’s because these companies all operate in Europe, and the regulation also covers citizens of European countries living in places like the United States. There’s a lesson here. Software code is not law. It bends to fit local laws. So if we want to stop companies like Facebook from amassing huge profiles on us and selling them to advertisers, the solution is not to delete your account. It is to demand real action from government.