Privacy is a pillar of European law and of the new GDPR. Social and technological developments question its protection and raise the need for more comprehensive legal analysis. Informational and decisional privacy, in particular, prove to be fundamental rights to tackle the pervasiveness of surveillance practices and persuasive technologies. Yet, their protection is uncertain. The paper is a theoretical and interdisciplinary contribution structured as follows. In the first part, it is reviewed the literature on profiling and online personalization in order to provide an overview of the socio-technical landscape, with a special focus on media content and news personalization. In the second part, the consequences of the GDPR on media personalization is analyzed. In the third part, the interplay between data protection, consumer and media law is discussed. In particular, the right to receive information and the value of serendipity are introduced to eventually discuss the idea of a ‘right not to be deceived’ as a precondition to properly protect privacy and other human rights as well as to preserve trust between users and platforms.