The Federal Communications Commission is proposing much tighter rules on what broadband providers can do with customer data without consent. Thanks partly to regulatory quirks, the rules would mean the likes of Verizon and Comcast are much more restricted than sites such as Google and Facebook.

The planned rules are an attempt to apply the principles of the Telecommunications Act of 1996 in a way better suited to today’s technology.

The proposals don’t completely outlaw any particular use of data. Instead they divide customer data into three categories, each with its own rules on consent:

1) Customer data needed to provide and market services, such as an email address for billing, or keeping track of total data use and then offering the customer a package with an appropriate data cap. The new rules would say customers signing up with a broadband provider inherently consent to this type of data use.

2) Customer data used by the broadband provider (and its “affiliates”) for marketing its other communications services such as telephone line rental. This would be allowed by default but customers could choose to opt out.

3) Customer data used in any other way, including passing on to third parties such as advertisers. This would be banned by default and only allowed if customers explicitly opt-in.

The rules would also require broadband providers to have clear policies to minimize the risk of data breaches. If a provider did discover a breach, it would have seven days to tell the FCC and 10 days to tell all affected customers. If the breach affected more than 5,000 customers the company would have seven days to tell both the FBI and Secret Service.

According to the FCC, the rules are needed for two reasons. Firstly, a broadband provider inherently has access to a large amount of information about a customer’s online activity. Secondly, the existence of contracts and minimum terms makes it harder for a customer to stop using a provider’s service if they object to data use than it is for the customer to stop using a particular website.

The proposal only affect the broadband providers themselves. Website operators are instead regulated by the Federal Trade Commission.