Matt Hancock, the ambitious minister with responsibility for digital, has won himself a few pixels of attention by saying that Facebook could be hit with a $1bn fine if it breaks the rules in future. That sounds like a big number to a British politician, but to a tech leviathan it is not even small change. Mark Zuckerberg will be more perturbed that $75bn has been wiped off the company’s market value since last Sunday. That was when the Observer published the latest instalment of Carole Cadwalladr’s outstanding investigation into Cambridge Analytica, which triggered the most reputationally damaging week for Facebook in its history.

Yet even the punishment inflicted on the share price still leaves the market capitalisation of Mr Zuckerberg’s company north of $460bn. That buys you all of Coke and Pepsi with enough money to spare to have McDonald’s as well. Facebook is so richly priced because data has become the world’s most valuable resource. The “new oil”, one popular description, doesn’t do it justice. There are a lot of things in life that don’t require liquid hydrocarbon; fewer and fewer areas of human activity are not enmeshed in the data industry. This is also one of the world’s most concentrated resources with vast amounts of power in the maw of a small number of huge companies with a limitless appetite for continued expansion. Amazon is now into food distribution. Amazon and Apple have recently announced ambitions to get into healthcare as well.

The political class has reacted to the stratospheric rise of the tech behemoths with the gawping stupefaction of a five-year-old strapped into the nose cone of a space rocket. Politicians have gnashed their teeth about the tech giants’ reluctance to pay tax, but flailed about trying to find a remedy. Politicians have wailed about extremist, harmful and illegal content on the internet, but hesitated to legislate and lamely implored the platforms to implement their own technical solution. The tech barons have largely been left to set their own rules. They have been allowed a degree of self-policing which society would never tolerate for car makers or drugs manufacturers. For the most part, I think this paralysis has been explained by sheer dazzlement – and, in some cases, infatuation – with the scale and reach of these companies. This has been combined with ignorance, among voters as well as their leaders, about how they actually work. Your average politician thought “getting digital” meant opening a Twitter account, not understanding the business models of those who exploit the surveillance economy.

The furore surging around Facebook could be an inflection point. Retailers who are big spenders on online advertising are threatening to pull it and some of them might be serious. Surveys suggest that public trust in social media is plunging. Panting breathlessly as they try to catch up with technological change and evolving public opinion, the politicians are finally engaging with how these monopolistic companies mine and exploit our data to make their vast profits. In the United States, Republicans and Democrats alike are demanding that the platform bosses be brought to the Senate for interrogation. Let us hope that they will not be fobbed off with more of the vapid bromides about “doing better” that Mr Zuckerberg took four days to come up with when he finally emerged to say a few sorries. The European Union will shortly activate the General Data Protection Regulation. This will give users more power to opt out of being tracked online and to prevent their data being shared with third parties. That’s a start, but will likely prove inadequate. New rules will be only as effective as their enforcement.

Invigilation is a particular weakness in Britain. Our parliament last passed substantial legislation on data protection 15 years ago. That is like trying to govern the airline industry with rules made for hot-air ballooning. Britain’s data protection regulator is the information commissioner. Her powers are so feeble that it took nearly a week to get her team through the front door of Cambridge Analytica. Let us just say that this is rather longer than it takes to press delete. The information commissioner and the electoral commission, both bodies set up for an entirely different technological landscape, are under-powered and under-resourced. There are rising and cross-party demands for a toughening up of the data protection bill now going through the Commons. One modest step would be to add criminal penalties for companies which fail to comply with disclosure orders.

The knottiest problem with governing this space is what the internet is doing to democratic politics. It will be impossible to ever say definitively whether data manipulation tipped the results of the Brexit referendum and the American presidential election. What is easier to agree is that the internet has created a political ecosystem in which the extreme, the incendiary and the polarising tend to prevail over the considered, the rational and the consensus-seeking. The Massachusetts Institute of Technology recently published a study finding that falsehoods spread about six times faster than the truth on the internet and have a more lasting impact too. @realDonaldTrump is the first internet president.

Christopher Wylie, the Cambridge Analytica whistleblower, told Cadwalladr how it harvested Facebook data on voters in order to “exploit what we knew about them and target their inner demons”. There are two issues here. The easier one concerns the use of data without consent. That simply shouldn’t be happening and the penalties ought to be severe. The harder issue concerns using data to micro-target voters and whether that ought to be permissible even if there is consent. Some say this is no more than the application of new methods to political communications. Hasn’t it always been the case that campaigns seek to identify who might support them and then press their buttons? At the 2015 British election, the Tories went after wobbly Lib Dem supporters by bombarding them with messages about the alleged perils of a hung parliament. At the 2017 election, Labour focused on younger voters with its offer to scrap tuition fees. Is the use of data mining to exploit the fears and hopes of individual voters with bespoke messaging just one step further along the spectrum? Or is this something qualitatively different?

There is a persuasive case that this is a profound change to the political ecosystem with considerable potential to subvert the open debate which is critical to democracy. In the analogue political era, we could all read the promises a party put in its manifesto, we could all see the claims a party made on its roadside billboards, and we could all watch the attacks launched on an opponent in a TV broadcast. That made it possible to call out mendacities and expose contradictions and to hold those responsible to account. This didn’t prevent distortion and misinformation, but it was easier to spot and more risky to perpetrate. There is not the capacity to apply that invigilation if millions of individualised messages are being micro-targeted at voters on social media. Even less so when the propaganda is anonymised. Channel 4’s undercover filming of Cambridge Analytica executives exposed one of them boasting about how they could operate under the radar of the traditional rules of political accountability. “We just put information into the bloodstream of the internet and then watch it grow, give it a little push every now and again … And so this stuff infiltrates the online community and expands but with no branding – so it’s unattributable, untrackable.”

What do we do about that? Politicians won’t agree to a blanket prohibition on campaigns collecting information about voters. The legislation going through parliament gives political parties special privileges to hold and process personal data. One thing that can be done is to demand that political propaganda declares its origins. The US Congress is discussing an Honest Ads Act. This would make it compulsory for online political advertisers to declare who paid for their output and how much they were spending. It wouldn’t stop lies being told, but it would force the liars to identify themselves. There is growing support for introducing something similar in Britain. Damian Collins, the Conservative chairman of theparliamentary select committee covering digital, tells me he’d back it.

There are two responses to the vast power of big data and the abuses now being revealed. One is to bow before it on the grounds that these companies are too huge and the pace of change is too rapid for anything much to be done. That has been the fatalistic posture of too many politicians and citizens. The other responseis to stop cringeing and start making some robust rules. You don’t require an algorithm to make this choice for you.

•Andrew Rawnsley is an Observer columnist