The headline is somewhat misleading. ISPs don't have an affirmative duty to protect user privacy. They aren't "on the hook" for e.g., how Facebook uses the data that Facebook collects on you by virtue of using their service. But remember, the ISP runs the network, so they have a record of every web server you ever communicated with. (Netflow data is useful for this, as well as traffic engineering purposes.) These rules prevent them from selling your browsing history to third parties.

Here's the text of the statute describing the information that's covered:

47 U.S.C. §222(h)(1)(a): information that relates to the quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer of a telecommunications carrier, and that is made available to the carrier by the customer solely by virtue of the carrier-customer relationship

And here's the part of the statute that describes the restrictions-

47 U.S.C. §222(c)(1): Except as required by law or with the approval of the customer, a telecommunications carrier that receives or obtains customer proprietary network information by virtue of its provision of a telecommunications service shall only use, disclose, or permit access to individually identifiable customer proprietary network information

Instead of regulatory overreach, which ISPs want to portray this as, think of it as the FCC protecting you from this: