What makes personal data processing by social networking services permissible?

Social networking services provide services in return for rights to commercialize users' personal data. We argue that what makes this transaction permissible is not users' autonomous consent but the provision of sufficiently valuable opportunities to exchange data for services. We argue that the value of these opportunities should be assessed for both (a) a range of users with different decision-making abilities and (b) third parties. We conclude that regulation should shift from aiming to ensure autonomous consent towards ensuring that users face options that they will use to advance individual and common interests.