While the Brexit referendum campaign has been extensively researched, media, regulatory bodies, and academics have often talked at cross-purposes. A strong focus on Cambridge Analytica’s role in the 2016 referendum, despite official investigations concluding the company had only limited involvement in the campaign, has distracted attention from more mundane but highly controversial data practices, including selling voters’ data to third parties or re-using campaign data without consent from data subjects. This empirical case study of data-driven referendum campaigning around Brexit raises two broader theoretical questions: First, moving beyond the current focus on transparency and accountability, can public participation in the ownership and management of campaign data address some of the problematic data practices outlined? Second, most academic literature on data-driven campaigning, in general, and referendum campaigns, in particular, has often overlooked the key question of what happens with campaigning data once campaigns are over. What legal safeguards or mechanisms of accountability and participation are there to guarantee consent when it comes to further re-use of people’s data gathered during campaigns? Ultimately, the article raises the question of who should have a say in how “people’s data” is used in referendum campaigns and afterwards and makes a case for democratising such decisions.