For non-sensitive data, like how much data you use, customers would still have to opt out of allowing it to be sold, but for sensitive data, like social security numbers, geolocation data, and web browsing history, ISPs would be required to get customers to opt in.