Recommender systems are now widely deployed across multiple dimensions of the digital reality that increasingly shapes our lives. In doing so, they mould individual thoughts and actions and can affect individual and collective autonomy. In this paper we first discuss how the ubiquitous exercise of ‘soft’ power by recommender systems on individual users presents interference into individual autonomy and its legal dimensions, expressed through collective and individual self-determination, democratic values and institutions, as well as individual human rights and freedoms. We then argue that this exercise of power over individual and collective destinies necessitates regulatory action to establish an appropriate system of checks and balances on recommender systems and their creators. Utilising a bottom-up approach, we look at the fundamental aspects of a recommender system’s design and functioning that shape the impact these algorithms have on individual autonomy. On the basis of this, we identify three key areas where regulation can be targeted in order to empower users and address current power imbalances - (1) algorithmic design, (2) data protection rights, and (3) transparency and oversight. We map the key questions and options for future regulatory action in each of these domains, highlighting the decisions and competing interests that regulators will need to consider. We conclude by discussing the policy implications of this mapping of the debate and the relevance they have for the future of recommender systems regulation.