Privacy laws have traditionally been rooted in an individualistic perspective of privacy based on the mechanism of individual consent. When considering the practices of the web giants, whose business model is based on the exploitation of personal data, this perspective seems inadequate: it takes insufficient account of the asymmetries of power and information involved and wrongly assumes that privacy is an individual matter. It therefore fails to adequately protect individuals and thus facilitates the occurence of harmful effects. We first recall the limits of the individualistic conception of privacy protection – the notice and choice or notice and consent model – in relation to the online platforms practices. We then critically consider two solutions based on a collective conception of privacy: data trusts and their apprehension by Quebec civil law, followed by canadian common law fiduciary duties, and more particularly the fiduciary duty of loyalty. While these approaches seem promising, they both have significant limitations that make their implementation difficult to conceive. Firstly, data trusts, based on individual choice to entrust one's data to an external actor, replicate the difficulties associated with the notice and choice model. Their effective implementation also presupposes the interest, understanding and trust of individuals in the mechanism, which are far from being acquired. Secondly, the imposition of a duty of loyalty would require platforms to dramatically change their current business practices, changes that would not come without resistance. Privacy law, both in its individual and collective conception, is insufficient to adequately protect individuals in the digital environment. Other areas of regulation must be brought into play.