Data is rapidly changing how companies operate, offering them new business opportunities as they generate increasingly sophisticated insights from the analysis of an ever-increasing pool of information. Businesses have clearly moved beyond a focus on data collection to data use, but users have an inadequate model of notice and consent at the point of data collection to limit inappropriate use. An interoperable metadata-based architecture that allows permissions and policies to be bound to data, and is flexible enough to allow for changing trust norms, can help balance the tension between users and business, satisfy regulators' desire for increased transparency, and still enable data to flow in ways that provide value to all participants in the ecosystem.