If Data Is the New Oil, Who Exactly Is the Well?
In 2006, a mathematician named Clive Humby said five words that reshaped how the entire business world thinks about technology.
“Data is the new oil.”
The Economist put it on their cover in 2017. Since then, it’s been in every boardroom, every strategy deck, every keynote from every executive who wanted to sound like they understood the century they were living in.
I’ve heard it hundreds of times in twenty-five years across government, banking, cloud infrastructure, and AI delivery.
And I’ve spent a long time thinking about what nobody follows up with.
If data is the new oil, who is the well?
The analogy that felt right
The reason it landed so well is that the power structure genuinely looks similar.
Oil reshaped the 20th century. Nations rose and fell on it. A handful of companies controlling the reserves held leverage over governments, economies, and populations. The infrastructure required to refine and distribute it locked out competition for decades.
When people looked at what Google, Facebook, and Amazon were building, it felt like the same shape. Massive invisible reserves. Expensive infrastructure. A small number of companies with more data than most nation states, and the power that comes with it.
The analogy made sense as a power comparison.
Where it collapses is in what data actually is.
The critical difference
Oil comes from the ground. It has no relationship with the people living above it.
Your data comes from you.
Every search, every purchase, every tap, every scroll, every route your phone tracked on a Tuesday morning tells a story about your life. Your data is autobiographical. It records your attention, your fears, your health, your relationships, your patterns, and your location at 3am.
Oil companies pay for the right to extract. They negotiate with governments. They pay lease fees. Royalty frameworks exist because in most legal systems, you cannot extract value from someone’s property without a financial agreement.
Your behavioural data has been extracted at extraordinary scale for roughly two decades, and the commercial arrangement you entered into was: you got to use a free app.
That is not a resource transaction. It is a relationship. And it is one of the most asymmetric relationships in the history of commerce.
What the business model actually is
Most people still misunderstand this, so let me be direct.
You are not Google’s customer. You are not Facebook’s customer. You are the product being sold to their customers.
Their actual customers are advertisers, political campaigns, insurers, financial institutions, and any other business willing to pay for precisely targeted predictions about future human behaviour.
Not your data. Predictions based on your data. That is the refinery. And it is extraordinarily sophisticated.
Shoshana Zuboff, a Harvard professor, studied this for a decade and named it surveillance capitalism. The logic is: observe behaviour at scale, find patterns the humans themselves cannot see, then sell the ability to influence what those humans do next.
These systems do not just record what you have done. In most cases they can predict what you will do before you have decided yourself. Facebook has filed patents for systems that infer emotional state from typing speed and scrolling behaviour.
Cambridge Analytica in 2018 was the moment the mask slipped. Eighty-seven million profiles, psychological targeting, multiple election campaigns. That was not a hack or a scandal of bad actors. That was the business model operating in a direction people had not anticipated.
The wealth generated from this system is real and concentrated. The communities generating the most data, often lower-income, younger, and in the Global South, tend to receive the least value from what they produce.
That pattern should sound familiar to anyone who has followed the history of resource extraction.
The fiction of consent
The standard defence is: people agreed to this. They ticked the box.
Here is the practical reality of that agreement.
Academics at Carnegie Mellon calculated that if the average American actually read every privacy policy they encountered in a year, it would take seventy-six working days. Nearly a full quarter of a year. For legal documents written by lawyers, for platforms built by engineers, none of it designed to be understood by ordinary people making ordinary decisions.
GDPR was a genuine step forward. It established that your data belongs to you, created enforceable rights, and produced meaningful fines. The principle matters.
But GDPR is a floor in Europe. It is not a global standard. And even where it applies, the burden of understanding what you are agreeing to still sits with the individual, not the organisation extracting value.
The cookie banner is the perfect symbol of how this works in practice. The “accept all” button is larger than “manage preferences.” Opting out takes eight clicks. Opting in takes one. This is not an accident. This is user experience design working exactly as intended, just not in the user’s interest.
We have built a default setting of extraction. And we have placed the cost of opting out on the people least equipped to navigate it.
A better frame
If the oil analogy is wrong, what is the right one?
I think data is closer to labour than to oil.
You generate it through activity. Your attention is work. Your choices are inputs. Your patterns are produced by a life being lived. And in most economies, when your labour creates commercial value, there are frameworks (imperfect, contested, often inadequate) that govern how that value is shared.
We do not yet have that framework for data. But it is starting to emerge.
Several US states are legislating data dividend models: the principle that if your data generates commercial value, you are entitled to a share of it. The EU AI Act, which came into force in 2024, creates liability for harm caused by AI systems trained on behavioural data. It is the first major attempt to treat the data economy as a relationship with obligations running in both directions.
These are early. Implementation is messy. Progress is slow relative to the speed of the industry it is trying to govern. But the direction is right.
What you can actually do now
Waiting for regulation to catch up is not a strategy. Here are four things that cost nothing and are available to most people reading this.
Understand the transaction before you enter it. Every free service has a business model. Knowing you are the product changes how you engage with the product. It will not always change your behaviour, but it should change your expectations.
Exercise the rights you already have. If you are in the UK or EU, you can submit a Subject Access Request to any organisation operating here and ask what data they hold on you. It is free. It is legally enforceable. Most people have never done it.
Raise the standard inside your organisation. If you work in a business that handles customer data, the question of whether you are treating data governance as an ethical obligation (not just a compliance exercise) is worth asking out loud. In my experience, most teams have never had that conversation explicitly.
Treat data literacy as a priority, not a nice-to-have. The people most exposed to the risks of data extraction are typically those who understand it least. If you are reading this, you are probably not among the most vulnerable. But you almost certainly know people who are.
The question worth sitting with
Clive Humby’s analogy was always meant to be a provocation. What he actually said, in full, is that data is like oil: valuable, but useless without refinement.
The refinement is where the value is.
The question nobody asked for twenty years is: who should own the refinery?
We know what it looks like when that answer defaults to whoever moves fastest and has the most capital. We are living with the results.
The data economy is still early enough that the answer is not fixed. Regulatory frameworks are still being written. Business models are still being challenged. The architecture of who benefits and who bears the cost is still being built.
The people who shape that architecture will be the ones who understand what is actually at stake.
Not just the technology. The relationship.
You are not a resource.
You are a stakeholder in something that is still being negotiated.
Act accordingly.