The paper analyses preferences towards new online mechanisms for protection of personal data mandated by the EU General Data Protection Regulation (GDPR). Authors estimate monetary valuation of the core instruments envisaged by the reform and assess potential welfare gains. On methodological grounds, they apply stated preference discrete choice experiment. With this approach, they provide ex ante insights into users’ preferences towards particular privacy control mechanisms, such as right to be forgotten, right to object profiling and personal data portability. Theirs study is based on online survey of 143 Polish university students conducted before the GDPR implementation. They use these data to estimate mixed logit model. The main finding from the analysis is that introduction of the GDPR increases consumer surplus by improving control over sharing of per-sonal data. The estimated value of median consumer surplus per capita amounts to 6.5 EUR per month. In the first place, users appreciate the right to be forgotten, extended information obligations and objection to profiling. Surprisingly, the role of personal data portability is sharply underestimated. Preference for the right to be forgotten is higher among more privacy concerned indi-viduals and lower for those respondents who actively use larger number of online services. Inten-sive online activity increases demand for informative and user-friendly privacy policies.