THEY SAY the Internet never forgets, and remembering is particularly profitable for broadband providers such as Comcast and Verizon: Collecting consumer information can allow Internet companies to tailor advertisements to individual customers. Out of concern for user privacy, the Federal Communications Commission promulgated rules last year restricting how companies could use that information. But Congress moved to repeal the rules this week. Now, if President Trump signs their bill, it will be on legislators to craft privacy protections that they find more reasonable.

In the Obama-era net neutrality overhaul, the Federal Trade Commission, which could have addressed privacy concerns, lost its jurisdiction over Internet service providers. The FCC, newly the only cop on the beat, moved to fill the gap with stringent regulations on when and how companies could collect user data. The FCC’s rule applied only to broadband companies and not to platforms such as Google and Facebook, which mine similar data on a similar scale. Consumers, the thinking went, should have more of a choice about the kind of information their broadband providers can control and sell, because in the modern age they may not have much choice about whether to use the Internet or what company to buy access from. By contrast, it was suggested, they don’t have to use Facebook if they don’t like its privacy policies.

Critics nevertheless argued that the FCC had fashioned its rules all wrong. Not only had the FCC given Google and Facebook a free pass, but instead of mirroring the FTC’s opt-out framework, which allows consumers to request that companies relinquish their data-collection rights, the FCC adopted an opt-in regime that required companies to obtain permission from consumers to collect data in the first place — placing an unnecessary burden on providers. The FCC also failed to distinguish between sensitive data, such as a user’s health history, and less sensitive data, such as what newspaper a user likes to read. These same critics, who included congressional Republicans, claimed the FCC passed its rules along partisan lines with no effort to secure buy-in from the other side of the aisle.

Some of the criticism was fair. But now those Republicans have axed the rules along partisan lines with no effort to replace them: The Congressional Review Act, which Congress used to strike down the regulations, is a blunt instrument that now bars the FCC from drafting any replacement order that would be “substantially the same” as the overturned rule. In other words, at the moment only Congress can make something happen.

So what next? Congress could pass provider oversight back to the FTC and give the commission authority to establish a more carefully crafted policy. Or legislators could draft their own rules. Internet commerce depends on companies’ abilities to draw in advertising dollars, and drawing in those dollars depends on access to user information. At the same time, users deserve a say in how their sensitive information is used. Congress will have to take this on, because right now arguably no one else can.