Why Access Control Alone Cannot Enforce Purpose Limitation in Data Pipelines

A DEV Community article argues that standard access control cannot ensure personal data is used only for its original collection purpose. It cites the 2022 FTC and DOJ penalty of $150 million against Twitter, where phone numbers and emails collected for account security were later used for ad targeting. The author explains that access checks evaluate who is reading data but not why, and that purpose metadata is typically lost after joins, transforms, and copies. Enforcement therefore relies on code review and after-the-fact audits rather than automated checks. The piece proposes a minimum design built on purpose labels that persist through pipeline operations.