The rules would require internet service providers to get permission before sharing or selling 'sensitive' consumer data