Concerns over privacy harms, algorithmic bias and discrimination, and misinformation and disinformation are on the rise, and lawmakers and regulators around the world are responding with widespread legislative action. But although the information economy is all about data, there is limited data about its workings, and it is not at all clear whether digital markets regulation, and specifically privacy laws, achieve their goals. This dissertation considers and questions the impact of two main pillars of the current regulatory approach to privacy law: consent and data control rights. The first part of this dissertation studies consent in digital markets. Consent has become central to the governance of consumer markets in general and digital markets in particular. But consumer consent is arguably empty, and it enables and legitimizes digital surveillance and other consumer exploitations. This Dissertation argues that traditional law-and-economics views on consent hide a crucial aspect: consent shifts considerable burdens—to collect and process information, to make informed decisions, and eventually to be liable for adverse results—to individuals and away from firms. This burden-shifting technique is deployed under the guise of empowering individuals to control their lives. Ironically, the use of consent (either by market mechanisms or by regulatory regimes) often has the opposite effect of disempowering and burdening individuals, leaving them with little control or recourse. Consequently, what consent mechanisms often achieve is delegating unchecked regulatory powers to firms. This Dissertation introduces the consent burden, a novel framework for analyzing consumer and digital markets, providing a comprehensive account of both the ex-ante and the ex-post burdens that consent mechanisms impose on individuals. The consent burden framework accounts for informational and decisional burdens, as well as for questions of liability and rights assertion through the courts. After laying the conceptual foundations, this Dissertation finds that the consent burden can be used as a metric for analyzing the rights/power allocation in the market. When the consent burden is high, firms are likely too powerful, and the regulator has likely intervened too little or ineffectively (even if it seems otherwise). This Dissertation then draws an analogy between the consent burden imposed on individuals and the regulatory burden imposed on firms. It calls regulators to account for the consent burden when designing regulation, similarly to how they routinely account for the regulatory burden, and it proposes a diagnostic process to evaluate the consent burden of a proposed regulatory regime. Accounting for the consent burden will increase the effectiveness of regulation and benefit consumers.The second part of this Dissertation studies data control rights. Data control rights are at the center of recent laws that make up the new digital regulation in the United States and the European Union, and they represent the main response to concerns about surveillance capitalism. The formal objective of these rights is to provide control over people’s personal information, and they include the right to access one’s personal information, the right to delete it, and the right to opt-out of its sale to third parties. But do data control rights work in practice? This Dissertation empirically investigates whether consumers use their data control rights. It leverages a unique opportunity to answer this crucial and thus far open question, presented by the California Consumer Privacy Act (“CCPA”). This Dissertation presents an original dataset: It collects and analyzes, for the first time, usage metrics reported by firms under a CCPA Regulations requirement. The second part of this Dissertation first explores the origins of data control rights and the goals that have shaped them. To study the effectiveness of a law, it is necessary to compare its intended goals and idealized theoretical outcomes with a measurement of the real-world outcomes that the law has generated. Then, the data analysis reveals that only a tiny fraction of consumers exercise data control rights. It further provides visibility into different usage trends amongst the various rights and the gap between the results and the idealized theoretical expectations. Lastly, in light of the empirical results, this Dissertation argues that normatively it is crucial to measure the real-life effects of the laws that govern the information economy, and proposes ways to enhance current regulatory approaches based on the California experience.Both parts of this Dissertation identify failures of the current approach to digital regulation and develop ways to evaluate and measure the real-world impact of digital regulation. Towards a new regulatory framework, this Dissertation calls for regulatory innovation in creating paths to evaluate and measure the success of digital governance laws and where they fall short and proposes possible first steps for doing that.