Last March, the FCC made the biggest telecom news in decades, voting to issue the Open Internet order and classify internet providers as carriers under Title II of the Communications Act. The ruling is still facing down various challenges, but the big issue of the net neutrality debate is effectively settled: from here on out, providers will have to treat all the web traffic on their network equally.

But net neutrality isn’t the only consequence of Title II classification, and a new fight is taking shape around a relatively overlooked portion of the ruling. The fight centers around customer data, and how much providers are allowed to collect. Gathering customer data can be extremely lucrative in the age of Google and targeted ads, but bringing providers under Title II means they have a whole new set of rules to follow when doing it. Those rules have never applied to companies like Comcast or Time Warner before, and wireless carriers like AT&T and Verizon have never had to apply them to mobile data. Suddenly, those companies are dealing with new restrictions, just as many of them are doing more ad-tracking than ever. It’s still unclear what kind of policy the FCC will set — or if it will set a policy at all — but the issue is already drawing fire from both sides.

Those rules have never applied to companies like Comcast or Time Warner before

The most recent salvo came on Thursday, when seven of the most powerful cable lobbying groups in the country signed onto a joint letter recommending any policy from the FCC be consistent with the FTC’s approach, which has basically been to stand back and impose meager fines on anyone who does anything really egregious. Reached for comment by The Verge, the FCC’s response was noncommittal: "Chairman Wheeler is eager to hear from all stakeholders on the right path forward for ensuring consumer privacy on broadband networks."

"Aggregate" can mean a lot of different things

The FCC can afford to play it cool because, for the moment, it’s holding all the cards. The core legal question is how the commission will interpret Section 222 of the Communications Act, which deals with the privacy of customer information and, as of last March, applies to both broadband providers like Comcast and mobile internet companies like AT&T. The broad strokes of the law are clear — carriers can’t share anything without customer permission, and the data must be stripped of personally identifiable information. But the language is ambiguous in a number of places: how can permission be collected? How much data counts as personally identifiable? The broad strokes restrict sharing to either aggregate or anonymized data — but "aggregate" can mean a lot of different things. If the FCC doesn’t set an explicit policy, companies will be free to experiment with data-mining programs similar to those already in place at online ad companies. On the other hand, if the FCC does set a policy and start to answer those questions, companies may not like the answers.

The stakes are particularly high because of recent corporate consolidation. When Verizon acquired AOL this summer, AOL’s ad business was at the center of the deal. Verizon has access to huge amounts of data, through both wired services like FiOS and mobile services like Verizon Wireless. AOL has the ad technology to make money from that data, and Verizon was willing to pay billions for it. But if the FCC decides to take a strict view of Section 222, that newly created business may not be nearly as profitable as Verizon planned. If the commission takes a hands-off approach, carriers like Comcast (which recently invested in Vox Media, parent company of The Verge) may decide to add targeted advertising to already significant media holdings.

"The ISP and the edge companies still have a special view of everything you do on the internet."

For many groups, the issue is the internet provider’s unique ability to collect data, a power first exploited by Verizon's "perma-cookie" tracking system in 2014. "The ISP and the edge companies still have a special view of everything you do on the internet," says Matt Wood of Free Press, a group that lobbied vigorously for Title II classification. "We’re not saying that no one can opt in, but they should know what they’re opting into. And potentially the FCC could look at the terms of the bargain too."

At the same time, carriers are far from the only group tracking what you do on the internet. Google has turned online ad targeting into a half-a-trillion-dollar business — the most valuable US company as of earlier this month. Those ads are anonymized but individually targeted, violating even the loosest interpretation of section 222, but since Google isn’t a carrier (or rather, it doesn’t need Fiber to track you), it doesn’t have to worry about that clause. That puts privacy advocates in an awkward position, trying to limit the carriers while acknowledging that the competition is already miles ahead. "We don’t like it when Google does it either," says Wood. "They’re just not subject to this statute."

It’s unclear if the FCC wanted this fight, but the Open Internet order has put them square in the middle of it, balancing privacy groups on one side and the widespread norms of the ad targeting industry on the other. The next step will likely come next month, when the commission is expected to take the first steps towards a new policy, and sketch out exactly how big a role it wants to play in the data fight. But whichever side they end up leaning toward, web advertising’s voracious appetite for data is going to play a much larger role in the Title II than anyone expected.

As mentioned in this piece, Comcast is an investor in Vox Media, the parent company of The Verge.

Ashley Carman contributed reporting to this piece.