On top of the data transfer restrictions, the measure bars ISPs from using a lack of consent as an excuse to charge users extra or deny them service. There are exceptions for either selling the ISP’s own products or honoring a court order.

The bill echoes similar efforts in places like Seattle, and effectively restores key protections enacted by the FCC in 2016 and overturned by Congress in 2017. It’s not clear if this will affect ISPs’ strategies on a national level, but it could serve as a reference for other states that want to enact their own data privacy laws.