In the age of Cambridge Analytica what are reasonable data norms?