"You are just going to bring down the entire Internet."
That was how Internet service providers reacted when the Federal Communications Commission met with them to discuss new privacy protections, according to Gigi Sohn, a counselor to former FCC chairman Tom Wheeler.
The privacy protections, approved in the final days of the Obama administration, would have required ISPs to get permission from customers before collecting and sharing their data.
The rules threatened to make it harder for companies to cash in on lucrative user data. For the providers, that included data on customers' web browsing history, app usage and geo-location.
It wasn't just the Internet providers who were worried about the policy shift. Google (GOOGL), which built a massive business from online advertising, suggested in a letter to the FCC that much of our web browsing activity doesn't need extra protections.
Related: RIP Internet privacy rules. Is net neutrality next?
This week, their concerns were put to rest. President Trump signed off on a repeal of the Internet privacy protections before they were able to take effect -- despite an outcry from consumer groups and privacy advocates.
The White House, Republican Congress and the telecom companies argued the rules would place an undue burden on broadband providers while leaving Google and Facebook (FB) free to collect data without permission.
But rather than push for legislation to expand the rules to apply to more online businesses, Congress voted to scrap it entirely. Without the rules, consumers' online privacy faces an uncertain future.
"A weird gray area"
The Trump administration is averse to excessive new regulations. The FCC is barred from proposing rules that are "substantially similar" to the privacy protections because of an unusual congressional maneuver used to repeal the privacy rules.
USTelecom, an advocacy group for the industry, noted in a blog post after the vote that the "most sensitive data -- financial, Social Security, about your kids -- remains fully protected" thanks to existing rules at the Federal Trade Commission.
Shortly before the Internet privacy rules were issued last year, however, the FTC warned of "an enforcement gap," particularly in the area of data privacy. The FCC rules might have filled that gap.
Neema Singh Guliani, legislative counsel at the ACLU, calls it a "weird gray area." The concern, she says, "is you don't have rules on the books right now that govern how Internet service providers have to protect personal information like browsing information."
Several states, including Minnesota, Illinois and Texas, are now weighing Internet privacy protections, with more states likely to come. "The best hope for consumer protection is at the state level," says Sohn. But at best, this creates a patchwork of privacy standards around the country.
Related: Outrage grows over Congress' Internet privacy vote
The uncertainty over Internet privacy protections comes at a time when consumers are spending more and more time connected to the Internet -- through smartphones, wearables and even smart appliances in the home.
At the same time, the market for online data is only growing more sophisticated.
You probably already know Facebook and Google use your personal data to sell targeted ads. Data brokers, too, are information vacuums. These firms build databases of personal information on race, religion, political affiliations and more. This can then be sold to health, financial and marketing firms for advertising.
The Data & Marketing Association, a group that represents data firms like Acxiom and Epsilon, called the privacy repeal vote an "important victory" for the "data-driven marketing economy."
The new advertising giants?
After a wave of outrage over Congress' vote, the telecom industry stressed its limited footprint in online advertising.
"Internet service providers are relative bit players in the $83 billion digital ad market, which made singling them out for heavier regulations so suspect," USTelecom said in the blog post.
That might change, however.
AT&T (T) and Verizon (VZ) have bet billions buying up content companies, which can potentially be paired with subscriber data to build up advertising businesses. For example, AT&T has agreed to acquire Time Warner, the parent company of CNN. The deal is pending regulatory approval.
The goal, according to Craig Moffett, an analyst at MoffettNathanson, is to find an alternative revenue stream as subscriber growth slows.
Related: Worried about companies spying on your browsing? Here's what you can do
Just how aggressive the providers get with data collection and ad targeting remains to be seen.
"There is a level of self-regulation in how much they share," says Martin Utreras, an analyst at eMarketer. "They don't want consumers to feel they are being used."
Some Internet users are now preemptively turning to VPNs, which cloak your Internet activity. One service, NordVPN, saw a big spike in interest from the U.S. in the days following the Senate vote.
Since the vote, providers like Comcast have also reminded customers they can opt out of receiving targeted ads. But that puts the burden on the customer rather than the company.
Guliani, with the ACLU, said she decided to test out her own provider by using the online customer service chat option to determine how to opt out.
"It took 20 minutes just to get a link to the privacy policy and I never got clear direction for how to opt out," she said, before concluding: "There is no perfect solution for customers right now."
