How should a legal system treat advances of new technologies and practices that may end up reshaping human identities and social interactions? In this chapter, I consider practices of firms drawing on automated decision-making technologies to construct profiles of individuals based on their personal data and using these to develop new products and services, frame individual preferences, and foster consumption in new media and entertainment markets. Still at an early stage, the practices are becoming a basic business model of the digital economy despite all the argued social costs of removing distinctions between private and public life, appropriating valuable data resources away from individuals who generate the resources, and treating human identity as subject to effective control of the machine and its masters. Should the weight of an intellectual property system geared to the protection of intellectual assets, in this context valuable data, be extended to such activities, subject to specified limits and exceptions? Or should the practices be left to operate outside the rubric of legal regulation, at least for a while, adopting a ‘sand-box’ approach, effectively leaving it to firms to regulate themselves in exploiting the available data resources and in the process accumulating intellectual assets? Or is there a way in between, offering scope for effective legal regulation of social costs associated with misuses of personal data as and when these costs emerge, but otherwise allowing practices to operate without legal constraint?