Can Apps Work Without Taking Possession of Your Data? Researchers Think So
Every day, people make the same quiet trade: they share location data for weather updates, upload photos to stay connected, log health information to track their bodies, and hand over searches, messages, and preferences in exchange for convenience.
But once that data leaves a phone or laptop, who controls what happens next?
That question sits at the center of new research from recently graduated PhD student, Zhiru Zhu, and Assistant Professor Raul Castro Fernandez from the University of Chicago’s Department of Computer Science, which proposes a different model for how digital services could work. Instead of sending personal data to companies and trusting them to use it only as promised, the research argues for sending the computation to the data. In this design, a trusted intermediary — a “data escrow” — would run approved computations on a person’s device or within a tightly controlled environment, returning only the result a service actually needs.
The idea is technical, but its implications are social as much as computational. At stake is whether people can benefit from data-driven services without giving up broad control over their digital lives.
“The digital economy runs on a basic bargain: we give platforms our data, and they provide useful services,” Castro Fernandez said. “The problem is that once data leaves our devices, we largely lose control over what happens to it.”
From Data Access to Data Purpose
Most people are used to privacy prompts that ask a simple question: may this app access your location, contacts, or photos?
The research argues that this is the wrong level of control. In practice, people do not just care whether an app can access data. They care why. Someone may be comfortable sharing location with a weather app to get a forecast, but not if that same information is later used for advertising, profiling, or resale.
“That changes the privacy question from simply ‘Can this app access my location?’ to ‘Can this app use my location for this specific purpose?’” Castro Fernandez said. “It gives us a much richer notion of control.”
That shift points to a broader change in how privacy could work: not just limiting access to data, but making the purpose of its use more explicit and more enforceable.
Turning the Model Inside Out
Today’s apps generally follow a simple pattern: they collect data from a device and send it to company servers, where the real work happens. The new research proposes reversing that pattern.
In the model Castro Fernandez and his collaborators describe, an app developer defines two things: what data is needed, and what computation should be run on it. Those instructions are handed to an escrow system through a programming interface the team built. The developer still gets the functionality they want, but does not automatically receive the raw data itself.
“Today, we typically send data to the computation: an app takes your data and sends it to a platform that processes it,” Castro Fernandez explained. “We invert that model and send the computation to the data.”
A weather app offers a simple example. Under the current model, the app might send a user’s exact location to a company server to retrieve a forecast. Under the escrow model, the app could instead ask the escrow to access the location, derive a rough region on the device, and send only that region outward. The service still works, but the exact coordinates never have to leave the user’s trust zone. The basic principle is: use the data you need, without automatically taking possession of it.
Building on Existing Systems
One reason the work is notable is that it does not assume an entirely new digital ecosystem. Instead, it looks for leverage inside systems people already use.
The researchers built their prototype within Apple’s ecosystem, where access to sensitive data already flows through Apple-controlled software tools and app review processes. That structure, they argue, creates a plausible enforcement point: if a platform owner required apps to use an escrow layer for sensitive data access, it could become difficult for developers to route around it.
“Apple gave us a particularly clean path to test the idea because sensitive data access already goes through Apple-controlled SDKs, and Apple has both an app-review process and operating-system mechanisms that could make the escrow a true bottleneck,” explained Castro Fernandez. “In other words, the architecture can be bolted onto infrastructure that already exists rather than requiring an entirely new ecosystem.”
That practicality matters. Many proposals for better data governance struggle not because the values are unclear, but because the mechanism is missing. Rights may exist on paper; enforcement is another matter.
What the Experiments Showed
To see whether the model could work in practice, the team studied 10 popular open-source iOS apps across categories such as search, messaging, publishing, and public health. They examined whether real application dataflows could be expressed through the escrow model.
In many cases, they could. Features involving location, contact discovery, photo access, stored-audio transcription, and public health workflows could all be adapted to the model, making clearer what data was being used, what computation was being performed, and what information actually left the device.
The team also measured performance, comparing escrow-based apps with conventional implementations. The result was encouraging: the added overhead was small.
“The most encouraging result was how much could be done without fundamentally changing application functionality,” Castro Fernandez said. “Across the real applications we studied, most dataflows could be expressed in the escrow model, and the performance cost was very small.”
There was also a technical lesson in that result. By applying established database techniques, the system was able to preserve efficiency while adding stronger controls.
“Better data governance does not necessarily have to come with a large performance tax.”
The Next Challenge: Making Control Usable
If the architecture became real, the next question would be obvious: how would people actually use it?
The research is careful here. It does not argue for flooding users with more permission prompts. In fact, it explicitly acknowledges the risk of consent fatigue. If every dataflow required a new decision, many people would simply click through.
“I do not think the answer is to give people hundreds of new pop-ups,” Castro Fernandez cautioned.
Instead, the longer-term vision is a shift from one-off permissions to higher-level rules: what kinds of uses a person accepts, for which kinds of data, and from which kinds of organizations. The escrow would then enforce those preferences automatically, reserving direct interaction for unusual or consequential cases.
That is an important distinction. The escrow provides the enforcement mechanism. Designing humane, comprehensible controls remains a challenge for human-computer interaction researchers and policymakers.
Why It Matters
The system is not a complete answer to every kind of data use. It works best when a computation involves one person’s data and can be delegated. Harder cases include systems that combine data from many people, such as real-time traffic, or proprietary algorithms that platforms do not want to reveal. Even there, though, the escrow could still make transfers more transparent.
Its broader significance may lie in how it fits into debates around privacy and regulation. Laws such as the GDPR articulate rights. Governance models such as Data Trusts propose new institutions for stewarding data. But both run into the same practical question: how are decisions about data use actually enforced?
“I see these as complementary layers,” Castro Fernandez said. “Regulation such as GDPR articulates rights and obligations, while models such as Data Trusts propose new institutions for governing data. But both ultimately need technical mechanisms capable of enforcing decisions about how data may be used.”
For individuals, this could mean benefiting from data-driven services without giving up blanket control over personal information. For developers, it could mean computing on data without automatically taking custody of it. And for policymakers, it could mean having technical infrastructure that makes rules more than aspirational.
More than anything, the work asks whether the basic bargain of the digital economy has to remain so one-sided.
Or, as Castro Fernandez put it, whether people can still benefit from data-driven services “without surrendering control over how their data is used.”
