Commercial practices that exploit consumer behavioural biases (behavioural exploitation) are an increasingly prevalent issue in online choice architectures. EU policymakers have started to expressly regulate such practices. What remains unclear about this type of regulation is when an online choice architecture exploits biased consumers. What is the legal meaning and significance of exploitation in the digital environment? Even though the concept of exploitation is frequently used in scholarship concerning behavioural exploitation such as “dark patterns”, it is rarely defined. The concept’s normativity is mostly ignored, remains underdeveloped, and lacks solid foundations. This Article aims to close this gap by developing a theory of exploitation for (behavioural) consumer law in the EU that applies to online choice architectures and unfair commercial practices in general. The Article eschews welfare analysis and instead relies on the philosophical discourse on exploitation theory. Even though this discourse is mostly ignored by the literature, the Article submits that this analytical framework fits better with the existing goals and scheme of EU consumer law compared to an approach to legal analysis that is driven by promoting consumer welfare through market efficiency. Ultimately, the Article defends the autonomy theory of exploitation and contends that regulating behavioural exploitation in online choice architectures means regulating for autonomy.