Academics and practitioners have been using the idiom of a 'toolkit' or 'toolbox' for governance regulatory policy, both in general and with specific application to controlling the invasive effects of technologies on human values. With regard to the latter, the regulatory instruments are now usually considered mainly to be laws and a large variety of 'privacy-enhancing' technological measures, about which there has been a burgeoning of interest. Working in this idiomatic 'toolbox' frame of reference has some advantages, but also some important drawbacks and inadequacies, conceptually, empirically and normatively. This paper explores this terrain, concentrating in particular on the relationship between legal, technical and other regulatory options. Emphasising the importance of actors and institutions, it looks critically and constructively at the 'tool' formulations of Lawrence Lessig and others. It suggests that we need new departures in thinking about regulation that draw upon these sources but go beyond them, both in terms of the 'tools', their effects, their power and normative dimensions, their regulators and the jurisdictional levels at which the regulation of technologies and their consequences is now required. Christopher Hood's The Tools of Government, a general work within political science, offers relevant further analytical equipment. His description of a range of regulatory tools and their combinations and substitutions allows for an improved understanding of how regulators can operate.