Congress repealed a rule that had not gone into effect, so 'allows' isn't quite right. The FCC had a rule that would've prevented ISPs from some commercial use of the data they collect. It was targeted at limiting the violation of ISP subscriber privacy.
ISP vs Destination site (Facebook etc):
Facebook already sells you to advertisers - but the rule would never have applied to Facebook, Google, or any destination site (except when Google fiber is your ISP).
Uniquely identify users:
As long as Facebook uses an encrypted channel (https) the ISP doesn't see your URLs. This leaves the ISP with destination, timing, and message size. Identifying a unique user based on that data alone would prove impossible*. Sites without encryption are an open book.
Since you like arstechnica:
Technically you're asking a legal question about what data can be shared in absence of an FCC rule. Given that the laws of particular countries are typically only enforceable on entities within those countries, and given the amount of wrangling that usually accompanies laws, I don't believe anyone knows where the legal lines are drawn. IANAL
The practical truth is that ISPs want to profile you and sell you to marketers. This is the primary business model of Google and Facebook.
- Arguably, ISPs know more about 'you' (absent a VPN) they can see every domain you visit, and when.
- Arguably, Google and Facebook know more about 'you' because you have an individual account with them and they know specific information you access and 'like'.
IMHO Google and Facebook will remain more valuable to advertisers:
- Google and Facebook profile individuals instead of locations.
- Google and Facebook have a significant first mover advantage.
- ISP information will be limited by the increasing prevalence of secure communication, and is nearly eliminated by VPN.
- FCC rules aren't the only privacy laws. ISPs might be vulnerable to defamation suits if they aren't careful.
[*] Theoretically, a determined ISP with a deep understanding of an encrypted site might find ways to fingerprint the various connections required to render a particular URL. This metadata of the timing and pattern of content/ads served might be user and URL specific, but I doubt it would be economic to analyse as it would require privately held information about the inner workings of a dynamic site.