The moment when a sequence of small incidents and changes triggers a larger, more significant change is usually called a tipping point. In the triangular relationship between social media platforms, their users, and advertisers, it feels like we are experiencing that tipping point.

The story that has us all gripped is about specific individuals and organizations: Christopher Wylie, the data whizz kid whistle-blower; Carole Cadwalladr, the tenacious Guardian/Observer journalist; Alexander Nix, the immoral British businessman; Cambridge Analytica; Facebook; and a breach of data, a breach of trust, or—most likely—both.

The bigger story, however, is about a potentially transformative shift in the relationship between businesses and customers, or users.  A London School of Economics blog post calls it the “high-water mark for impunity:” the realization that the “social contract” between platform and user is broken. We mistook the free use of Facebook, Google, YouTube and Twitter for a free lunch. Now we are learning that there is no free lunch. Forbes told us in 2012 that “if you’re not paying for it, then you become the product.”

This has always been the primary use case for the big platforms and the clever apps that run on them: you get this amazing stuff for free, and in return all we ask is some personal data, so we get paid by advertisers who use that data to calibrate their microtargeting efforts. Everybody wins, right?

On the surface, the digital duopoly of Google and Facebook are certainly winners. Between them, they all but own the digital media market (as per this insightful piece by the highly knowledgeable, pugnacious Mark Ritson). Alphabet (Google’s parent company) is the second most valuable company on the planet, with a market capitalization of around $800 billion (at time of publication). Before its recent travails, Facebook’s market capitalization hovered around $500 billion. That puts Alphabet on par with the GDP of Turkey, and Facebook’s value is higher than the GDP of Poland or Belgium. 

If indeed this turns out to be a watershed moment, then these very successful businesses will have to adjust their business models and relinquish some of the tight control they have been keeping over their user data collection and usage. Timing is interesting, with the European General Data Protection Regulation (GDPR) a mere 60 or so days away. My SNCR advisory board colleague Jeff Pundyk has recently published an excellent piece about this.

The European Union can, should and will play a key role in driving the push for oversight and regulation to redress the balance between corporate interests and the rights of citizens. To make it work, it will need to operate in close alignment with stakeholders on the other side of the Atlantic. Until now, the Silicon Valley giants have dismissed any kind of oversight, point to the stunning success of their business models. Now it is for regulators and watchdogs not only to make them realize that civil society has been paying too high a price, but also to become a partner in changing the system before irreparable damage is done to the fabric of democratic societies.

Mark Zuckerberg likes to talk about trust, as he did in his statement on Wednesday. This is a huge opportunity for tech companies to earn or win back the trust of their users and customers. The continuation of a “cake and eat it” policy is unlikely to succeed. Too much is out in the open now, and too many people realize this might still only be the tip of the iceberg. Getting this right cannot just depend on the bravery of whistle-blowers.