One of the strangest features of the current debates about privacy on the internet is the way in which private advertising companies are able to get away with practices that no democratic government could. The security services and police are restricted in their surveillance of private citizens on the web by the Investigatory Powers Act 2016. Around 130,000 people signed a petition against it, largely because of the provision requiring internet providers to keep for up to a year records of all the websites that their users visited. One campaigner described it as “one of the most extreme surveillance laws ever passed in a democracy”.

Yet the material collected in this way can only be accessed under a system of legal and political oversight: the Home Office might like more powers, but the European court of justice ruled in December 2016 that independent judicial authorisation was needed for the “general and indiscriminate retention” of personal data. All that fuss over a year’s worth of websites, when it turns out that Facebook has been storing all the contact details, the instant messages, and the phone calls of millions of its users for as long as 10 years without anyone outside the firm realising what their apparently innocuous consent implied.

It would not be fair to blame Facebook alone for this. The victims of this policy were only the people who used its Messenger app on Android phones, and Android is a Google product. Apple’s rival phones don’t permit such indiscriminate harvesting of information. Although Google made this harder for phones updated since 2012, Android phones are notoriously slow to have their software upgraded, and the ability was still there even with the most modern phones until October last year. The hapless user believed only that they were allowing Facebook to look through their contacts to make it easier to reach them. In this instance, it is hard to blame Facebook entirely for taking advantage of a feature that Google had deliberately built. Both firms had a vital interest in collecting as much information as possible about their users – and everyone whom their users knew, on or off the network – and helping marketers to use it. What was then advertised or sold with the help of this once private information, whether it was goods or politicians, was of rather less interest. “Once the rockets are up, who cares where they come down?”, as Tom Lehrer sang.

However the blame is distributed, the central fact remains that these private companies have been able to embark on a programme of data collection that no government outside China has been able to undertake. They have done so without any judicial oversight of the kind that is meant to bind democratic government. They must now be reined in and brought within the law just as governments are. That is a democratic imperative. In the US, the Federal Trade Commission is looking at Facebook’s privacy practices. What will the UK government do?