  The data-driven economy has created tremendous value in our society.
Individuals share their data with platforms in exchange for services such as
search, social networks, and health recommendations. Platforms use the data to
provide those services and create other revenue-generating opportunities, e.g.,
selling the data to data brokers. With the ever-expanding data economy comes
the growing concern about potential data misuse. While most platforms give
individuals certain control over their data (i.e., what data is being shared),
individuals do not know how the data will be used once shared; they cannot
control the purpose.
  In this paper, we introduce a data escrow design that permits individuals to
observe all dataflows - not just what is shared but for what purpose. Rather
than data flowing to the platform, the platform delegates their computation to
the escrow, where individuals can observe and manage their data. To make the
data escrow practical, we design and implement a prototype that works alongside
the Apple ecosystem; specifically, we retrofit the Apple SDKs with a
programming interface to enable delegated computation. Our solution does not
depend on Apple's software and can be applied to other platforms, but building
for Apple lets us study the main hypothesis of our work: whether such a data
escrow solution is a feasible alternative to today's data governance. We show
that our escrow prototype implementation is efficient, and we analyze the
dataflows in real-world apps and show that the escrow's programming interface
supports implementing a wide range of dataflows.
