The legal approach to regulating data-driven personalisation has relied heavily on extending and reusing legal categories and concepts – in particular, the idea of privacy of personal information and the legitimating role of consent in permitting the use of personal information – that were originally devised to deal with a very different problem. This chapter argues that this approach is fundamentally flawed for two reasons. Firstly, data-driven personalisation – unlike the traditional core of privacy – is deeply enmeshed in contractual relationships, and both the gathering and the use of data are mediated by contractual terms. As this chapter shows, the result is that ‘privacy’ and ‘consent’ do not provide an adequate evaluative framework to model or mitigate the deleterious impact of data-driven personalisation on individuals. Secondly, consent derives its normative force from the presumption that it is necessarily autonomy-enhancing. As this chapter shows, however, data-driven personalisation has a strong derelationalising effect which erodes rather than enhances the data subject’s autonomy, calling into question the assumptions underpinning privacy-based approaches. The chapter concludes by arguing that dealing with these problems requires adopting a new, more substantive approach, which works to explicitly restrict the processes, structures, and purposes through which and for which personalisation is used.