> need to be able to revoke it at any point.

They have to be able to ask how much (if) data is being used, and how.