Personal data is found at the core of the digital economy, and from a consumer perspective it is increasingly difficult to assess when it's collected, how it is utilised or traded and by what third parties it is handled over time. As Rhoen (2016) argues, a broader application of consumer protection regulation to user agreements may increase accountability for operators who collect and manage personal data, and in extension lead to increased codetermination for consumers. This is one way of stating that privacy issues and the management of user data is, in short, a consumer issue leading to at least three normative challenges of particular relevance: 1) how to handle (the lack of) transparency in a datafied and personalised market; 2) what the regulatory model based on (“blind, non-informed”) consent is, and; 3) the privacy paradox, that is, the gap between what consumers say when asked in surveys and how they actually behave when using privacy intrusive services.