Privacy risk assessments have been touted as an objective, principled way to encourage organizations to implement privacy-by-design. They are central to a new regulatory model of collaborative governance, as embodied by the GDPR. However, existing guidelines and methods are vague, and there is little empirical evidence on privacy harms, questioning the suitability of privacy risk assessments as an effective policy instrument. In this talk I will present a close analysis of US NIST’s Privacy Risk Assessment Methodology, highlighting multiple sites of discretion that create countless opportunities for adversarial organizations to engage in performative compliance. I will argue that the premises on which the success of privacy risk assessments depends do not hold, particularly in regard to organizations’ incentives and regulators’ auditing capabilities. I will highlight the limitations and pitfalls of what is essentially a utilitarian and technocratic approach. Lastly, I will briefly outline and discuss alternatives and proposals for a better realignment of our policy and research objectives.