Associational Data Rightsdata-rights.info

Part III

Operationalizing Associational Data Rights

The statute: how Data Rights Associations form, who governs them, what they may bargain for, and how they are funded.

3,090 words · 14 min

Redirecting data flows away from pervasive digital surveillance, manipulation, and extraction toward the wellbeing of families and communities will require forming new cooperative data rights associations (DRAs) and empowering them to secure favorable terms from Big Tech. While some argue that data cooperatives could form organically without any additional regulatory intervention, associational digital governance arrangements for consumer data and creative content are unlikely to succeed without enabling legislation that defines the requirements of acting as a DRA and gives content to the rights that DRAs are empowered to uphold.

Internet platforms, AI services, and data brokers freely collect and exploit consumer data.1 Because there are presently few legal mechanisms in place for users to exclude digital service providers from collecting or using their data, tech firms lack incentives to bargain with private associations.2 Even content providers that own intellectual property are limited in their ability to set terms and conditions governing how AI companies make use of their works in light of fair use jurisprudence.3 Without legislation that flips this presumption by granting families and communities the ability to secure fair terms from tech companies, prospective associations focused on data rights lack mechanisms to protect their members and therefore have no incentive to form.

In the last century, Congress extended the logic of associational freedom to limit the excesses of corporate power by granting labor unions collective bargaining rights and enabling farmers to form cooperatives to negotiate commercial terms with large food processors. A similar approach is needed to bolster the formation and bargaining power of DRAs to distribute control over essential digital spaces and services.

Legislation to secure associational data rights for American communities

Congress and the states should enact legislation built on this framework–the Associational Data Rights for American Communities Act (ADRACA)–in order to: 1) Recognize that all persons hold associational rights of privacy, control, and fair value in their co-created information—rights that may be exercised only through qualified DRAs and may not be waived, licensed, or released by individual agreement; 2) Provide for the formation and member-aligned governance of DRAs; 3) Empower DRAs to collectively bargain and secure favorable data governance terms from digital service providers (hereafter referred to as “data counterparties”),4 who would be required to hold sufficient DRA-granted permissions to collect, use, or productize covered data; 4) Permit DRAs to fund and sustain their operations without ceding independence from data counterparties; and 5) Facilitate shared technical standards and infrastructure to ensure seamless assignment of data rights as well as frictionless, competitive, and transparent mechanisms for joining DRAs and applying DRA-negotiated terms across services.

Co-created information means information whose utility, actual or potential, derives in whole or in part from a person’s actions or from facts about that person. Privacy means nondisclosure; control means determination of the uses to which information is put; and fair value means a reasonable share of the value generated—often an ongoing stake rather than a one-time payment, especially where the future value and potential uses of information are difficult to foresee. Because these rights are associational, contractual terms purporting to waive, license, or release them by individual agreement would be void.

Forming and governing DRAs for member and public benefit

DRAs are the operative core of ADRACA. The legislation should specify who may form or join a DRA, how DRAs are created and certified or chartered, and what mechanisms are required to ensure that these entities serve the good of their members and the American public.

Membership requirements and benefits. Like labor unions or farm cooperatives, DRAs should be specifically designed to ensure small data principals can secure fair terms from data counterparties, including tech corporations. For that reason, those allowed to form or join DRAs could be limited to small parties whose data or content is collected, used, or processed by a data counterparty, including:

  • Data subjects: Individual adults and minors (a legal guardian would exercise data rights on their child’s behalf); Households and civil society institutions such as schools, churches, nonprofits, and civic associations; Small and mid-sized enterprises (SMEs) to the extent that they generate proprietary data specific to their products, services, or back-end operations not involving other data subjects (e.g., e-commerce vendors and gig workers).

  • Content providers: Any person who owns copyrighted material or whose image, voice, or likeness is present on a publicly available digital product or service (e.g., artists, creative professionals, actors, publishers, and social media content creators).

  • Mixed data dependents: One or more data subjects or content providers, where the resulting data is the product of their specific interrelated activities through an explicit and intentional relationship on a publicly available digital product or service (e.g., YouTube creators and their subscribers).

Data subjects, content providers, and mixed data dependents (jointly referred to as “data principals”) would “join” or “associate” with DRAs, which would exercise their privacy, control, and fair value rights on their behalf. Rather than Big Tech unilaterally locking all parties into a single set of terms, data principals would have the ability to choose from a menu of terms secured by competing DRAs on existing internet platforms and digital services. Data counterparties could still offer their own default terms, though such terms could not waive or release principals’ associational rights, and terms negotiated with any DRA would have to be offered to all users and affected persons—operating as a de facto floor. Data counterparties would be prohibited from denying, degrading, or conditioning service on the basis of DRA membership or the exercise of associational data rights.

While DRA-negotiated terms would be available to all affected data principals, DRAs could set additional criteria for data principals to become full members, granting them the ability to participate in DRA governance decisions and enjoy certain benefits. DRA membership criteria might include common economic interests (e.g., artists, creators, gig workers, or e-commerce vendors), religious or political affiliations, familial status, geographic proximity, agreement to pay a fee, etc. In addition to granting the data principal a say in DRA governance, other exclusive membership benefits might include economic remuneration or attribution for data or content under terms negotiated between the DRA and data counterparties.

At the same time, data principals would have the right to join whichever DRAs best reflect their privacy, control and fair value interests without fear of discrimination by DRAs or data counterparties. Principals could also hold DRAs accountable for failing to represent member interests through legal action or by exiting and joining another competing DRA. Data counterparties would also be required to inform principals of their right to join DRAs.

Formation and governance. Like community banks or credit unions, data principals or other entities wishing to form DRAs would require a certification or charter from a regulator to operate.5 Federal ADRACA legislation could delegate authority to the Federal Communications Commission (FCC) or Federal Trade Commission (FTC) to certify and oversee DRAs, while state ADRACAs might delegate that responsibility to a state consumer protection authority or create a standalone DRA commission. To be certified, a DRA would need to demonstrate to the regulator that it will:

  • Serve the public interest as determined by factors similar to those currently applied by the FCC in allocating broadcast licenses.6

  • Serve the privacy, control, and fair value interests of one or more specific classes of data principals with respect to one or more data counterparties.

  • Possess the technical competence and capacity–whether directly, in coordination with other DRAs, or via contracted third parties–to propose and secure favorable terms from data counterparties and hold them accountable through independent verification and legal mechanisms.

  • Ensure a members-only ownership and governance structure that aligns DRA activities with the interests of the public and its members (data principals) and protects against any conflicts of interest and foreign or non-member control.

  • Abide by common standards for verifying the eligibility of individuals and groups to act as data principals; formulating and proposing data terms; adjudicating conflicts with other DRAs; bargaining with data counterparties; joining permission-granting coalitions with other DRAs; invoking neutral arbitration if necessary to secure fair terms; and utilizing appropriate legal mechanisms to enforce data policies.

  • Remain financially solvent, whether from membership fees, donations, or other revenue sources.

In addition to the natural competition of DRAs vying for members by offering fair data terms and benefits, regulators would also retain authority to revoke a DRA’s license to operate should it breach its fiduciary duty to members, engage in unfair or deceptive practices, or otherwise violate the terms of its certification or charter. For example, DRAs could be required to undergo regular audits and demonstrate member satisfaction, sustain growing and engaged membership, and register a low number of complaints submitted to regulators by membership. To ease compliance burdens and ensure flexibility, once a regulator certifies a DRA, ongoing audits and oversight could be undertaken by third parties authorized by the regulator.

Empowering DRAs to bargain and secure favorable data governance terms

Once a DRA is certified or chartered, ADRACA would empower it to secure fair terms from data counterparties, such as Big Tech platforms, through a permissions requirement backed by special bargaining and due process rights.

A data counterparty would be required to hold sufficient DRA-granted permissions both (i) at the point of collection and (ii) at each point of use or productization of covered data, with the burden resting on the counterparty at both points to determine the affected rightsholders and to identify which qualified DRAs represent them. At the point of collection, rightsholders would be those with lawful custody of the nonpublic information being collected or conveyed. At the point of use or productization, rightsholders would include all persons whose associational rights are impaired by the use, regardless of how the information was obtained or inferred—unless the counterparty establishes that it was obtained exclusively from public sources, meaning sources available to the public free of intellectual-property or other proprietary claims. Factual inferences drawn from content on proprietary platforms governed by terms of service would not qualify as publicly sourced, and covered information commingled with publicly sourced information would remain covered.

Permissions would be sufficient when negotiated and granted by (i) a qualified DRA, or coalition of DRAs, representing at least half of the affected rightsholders; (ii) any two of the three largest qualified DRAs representing affected rightsholders; or (iii) any three of the five largest such DRAs—with affected rightsholders identified separately at the points of collection and use. Collection or productization without sufficient permissions would give rise to civil liability, through causes of action held by DRAs, sufficient to punish and deter noncompliance.

These rights would be conditional rather than absolute—rights to have privacy, control, and fair value interests vindicated, to the extent reasonable, through associations. The extent of valid interests in particular information would be informed by: (i) whether the information is obtainable from few or many sources; (ii) how large a role it plays in the downstream product; (iii) how severely the use impacts the interests of the persons and communities concerned; and (iv) how necessary it is to the generation of significant value. These factors would calibrate remedies and expectations upon data counterparties; they would not narrow coverage.

In support of this permissions regime, DRAs would also hold special bargaining and due process rights, including:

  • The right to restrict data counterparties from monetizing, transferring, selling, or making member data or content available to the public or to third parties, or from using member data or content in its products, including AI models, without DRA-negotiated permissions in place.

  • The right to be informed of all services and products that implicate data principals through a standardized, easily accessible registry or disclosure mechanism, and to obtain detailed information about data and content collection, use, transfer, sale, or monetization from current or prospective data counterparties.

  • The right to bargain with data counterparties for terms that advance the privacy, control, and fair value interests of members.

  • The right to impartial adjudication to secure fair terms from a data counterparty if the entity acts in bad faith or rejects reasonable terms that would advance a significant privacy, control, or fair value interest of data principals and the American public.7

  • The right to form temporary or permanent joint partnerships with other DRAs or entities so long as such combinations do not constitute monopolistic or anticompetitive conduct, and overall, advance the privacy, control, and economic interests of data principals.8

  • The right for DRAs to obtain injunctive relief and damages from other DRAs whose grants of permission or other actions enable unreasonable impairments of their members’ associational data rights, as resolved by a court or arbitrator—incentivizing DRAs to act through coalitions and to negotiate terms likely to be acceptable to all interested persons and DRAs, not only their own members.

  • The right to require data counterparties to submit to independent verification mechanisms and to disclose information necessary to ensure adherence to binding terms.

  • The right to good faith in bargaining from data counterparties, including non-circumvention of bargaining processes and non-discrimination against DRAs or their members.9

  • The right to effective and timely legal remedies if a data counterparty is in breach of binding terms.

DRA funding

While DRAs would require some source of funding to commence and sustain their activities, ADRACA would largely remain agnostic on how DRAs resource themselves so long as funding does not compromise their independence from data counterparties. There are several possibilities for DRAs to acquire sustainable funding. DRAs might, for example, charge nominal service fees to members, much like a financial advisor, or exact fees from data counterparties in exchange for facilitating data terms on behalf of members. Such fees could be fixed by law to prevent data counterparties from paying kickbacks to secure sweetheart deals from DRAs.

Insofar as DRAs negotiate data interoperability requirements with tech corporations to allow competing third-party tools, they could retain a small percentage of the revenue generated from members who take advantage of those tools. In addition, DRAs could retain a percentage of legal damages from data counterparties who violate negotiated terms. They might also collect the equivalent of “data protection bounties” offered by data principals who want special terms to protect their communal data interests.

Like agricultural cooperatives or credit unions, DRAs could treat their members as owners, providing a baseline of capital to fund operations.10 DRAs could also retain a percentage of economic compensation paid to members by data counterparties, similar to how a bank or credit union retains a percentage of returns on capital invested on behalf of its members. Because principals’ fair value interests will often be best served by an ongoing stake in the value generated rather than a one-time payment—especially where the future value and uses of data are difficult to foresee—such compensation could give DRAs a durable revenue base. At the same time, DRAs focused solely on public goods, like kids’ safety or human agency, could be organized as nonprofit charities, mirroring how civil society addresses social challenges in embodied human contexts.

Facilitating associational data rights infrastructure

For data principals, DRAs, and data counterparties to efficiently interface with each other, common infrastructure and rules of the road are needed. Data principals, or their authorized agents, need the ability to efficiently identify and join DRAs whose negotiated terms cover the data counterparties they interact with. A data principal on X, for example, may wish to join a DRA whose terms allow members to use third-party middleware to rank content on their feed.11 But that same data principal might prefer a different DRA to ensure that ChatGPT is not using sensitive data to serve up targeted ads or that Alexa is not recording and sending data about household conversations to Amazon or commercial vendors.

People derive meaning and value from membership in multiple different communities. DRAs can and should roughly correspond to groups and interests that already characterize a person’s life: their church, their union, their profession, their political interests, their region, and their social group. Memberships can and should overlap. With the proper sociotechnical architecture, DRAs that represent different people would function as extensions of the communities to which they already belong. Where a person is a member of two or more overlapping DRAs with conflicting terms, the data principal could specify which DRA-negotiated terms he wishes to defer to in most or all cases. DRAs could also identify where their terms conflict with each other resolve those conflicts through permission-granting coalitions or the inter-DRA claims described above.

At the same time, DRAs need visibility into what information data counterparties are collecting and how they are using it.12 DRAs also need an efficient, standardized, and transparent process to propose terms that cover specific counterparties, enter into binding neutral arbitration when necessary to reach agreement on fair terms with counterparties, prevent terms offered by other DRAs from infringing on their members’ rights, and solicit data principals or their agents to join and support proposed terms.

To bridge these coordination gaps, ADRACA could task the DRA regulator (e.g., the FCC or FTC) with providing for a standardized, efficient, and transparent mechanism for DRAs to propose terms, as well as a process for adjudicating inter-DRA objections to terms that may negatively impact the interests of other members. ADRACA should specify a process for data counterparties to disclose specific information about their collection and use of principals’ data, including the information necessary to discharge their burden of determining affected rightsholders and identifying the DRAs that represent them. That might include requirements for certain data counterparties, like social media platforms, to provide reasonable on-platform features that enable data principals or their agents to notify other principals in their network (e.g., creators, followers, subscribers, friends, connections) that they have joined a specific DRA.

Finally, much of the long-term success of associational data rights will depend upon an ecosystem of trustworthy tools, likely including agentic AI tools, that act on behalf of principals, DRAs, and counterparties to facilitate seamless delegation of data rights. Agentic tools could help principals minimize the friction of choosing DRAs that optimally protect their privacy, control, and fair value interests across the full range of data counterparties they interface with. Legislation should provide for a light-touch, transparent certification standard for data principal agents, ensuring that they are loyal to principals’ privacy, control, and fair value interests.

ADRACA could also task the National Institute of Standards and Technology (NIST) and the Center for AI Standards and Innovation (CAISI) with developing technical standards to allow principal-aligned agents to directly interface with data counterparties and the DRAs that cover them.

Footnotes

  1. See extended discussion of surveillance capitalism in Part I. ↩

  2. See previous discussion of why individual data rights have failed to protect individual or communal privacy, control, or economic interests. ↩

  3. Angela Yang, Federal Judge Rules Copyrighted Books Are Fair Use for AI Training, NBC News (June 25, 2025), https://www.nbcnews.com/tech/tech-news/federal-judge-rules-copyrighted-books-are-fair-use-ai-training-rcna214766. ↩

  4. In general, a data counterparty would include any person or organization that (1) collects, uses, or retains information from or about data principals, or sells or makes such information available to the public or third parties, for purposes including monetization; digital personalization, scoring, or profiling; content generation, ranking, or targeting; or AI system training or inference; and (2) serves DRA members, presents content originating from DRA members, or processes data about DRA members. ↩

  5. Cong. Rsch. Serv., R47014, An Analysis of Bank Charters and Selected Policy Issues (Jan. 21, 2022) (by Andrew P. Scott). ↩

  6. Fed. Commc'ns Comm'n, The Public and Broadcasting (last visited June 30, 2026), https://www.fcc.gov/media/radio/public-and-broadcasting. ↩

  7. A similar mechanism to enable news publishers to collectively bargain with large tech companies was proposed in the Journalism Competition and Preservation Act of 2021, S. 673, 117th Cong. (2021). ↩

  8. Like farming cooperatives under Capper-Volstead, ADRACA would grant DRAs limited exemptions from antitrust laws. ↩

  9. The duty to bargain in good faith would closely mirror that in 5 U.S.C. § 7117 (2018). ↩

  10. Nat'l Credit Union Admin., How Is a Credit Union Different than a Bank?, MyCreditUnion.gov (last updated Jan. 30, 2025), https://mycreditunion.gov/about/what-credit-union/how-credit-union-different-bank. ↩

  11. Luke Hogg & Renée DiResta, Shaping the Future of Social Media with Middleware, Found. for Am. Innovation (Dec. 17, 2024), https://www.thefai.org/posts/shaping-the-future-of-social-media-with-middleware. ↩

  12. See discussion of the need for greater transparency around data collection and use in Malikova (2026). ↩