Practices to create value from personal data in internet-enabled services (IES) remain socially contested. Indeed, the commercial exploitation of personal data violates social expectations and conflicts with individuals’ privacy needs. To explore this tension, we draw on media coverage on IES between 1990-2015. In doing so we examine what, why and to what extent particular business practices have struggled to gain legitimacy. Our findings provide evidence for 1) the power of social control mechanisms in enforcing business practices to match with social expectations, and, paradoxically 2) a fundamental change in these very social expectations in the form of a shift in the dominant institutional logics surrounding IES. By elaborating on the underlying processes of collective assessments of legitimacy in the field of IES, we draw attention to the role of a collective privacy calculus, which might be more salient in shaping flows of personal data than previously expected