Internet providers would need customer permission for many data uses

Covered internet providers would generally need customers' express permission before using, sharing, selling, or allowing access to personal data. These rules would cover personal data obtained through relationships with current customers, former customers, and applicants for broadband service. Dial-up service is excluded. Providers meeting the referenced federal small-business standards would be exempt. Customers could withdraw permission at any time through a clear, easy, free process. Providers would promptly honor choices and could not tie service, prices, discounts, or benefits to consent. Permission would not be needed for providing service, collecting payment, complying with legal requirements, protecting property, preventing service abuse, or the listed emergency assistance. Providers could market their own communications services using personal data if they notified customers and let them opt out at any time. Providers could create, use, share, or sell group data that cannot reasonably be linked to a person, household, or device.

Covered internet providers would limit how long they keep personal data and take reasonable steps to protect it. These rules would apply to broadband providers except those meeting the referenced federal small-business standards. The storage limit would not apply to group data that cannot reasonably be linked to a person, household, or device. Providers would guard against unauthorized use, sharing, sale, access, destruction, or changes. They could use any lawful security measures. Providers using reasonable safeguards would be protected from liability for unauthorized access to customer personal data. Providers could keep personal data only as long as reasonably needed for the purposes for which they collected it, except for the permitted group data.

Covered internet providers would explain their data practices and send customers' personal data to someone they name in writing. These duties would apply to broadband providers except those meeting the referenced federal small-business standards. Notices would explain what data providers collect, how they use and share it, how long they keep it, and how customers can exercise their consent rights. Advance notice would cover significant changes that fundamentally alter the original scope of the service. Sending data to another person would require the customer's express written request. Providers would keep notices available, give required notice before major changes to notices or data practices, and remind customers yearly that they can change their consent choices.