What they're saying: Witnesses from companies including Google, Apple and AT&T expressed reservations about some particularly strong steps lawmakers could take to ensure user data privacy during a Senate Commerce Committee hearing.

• Mandatory opt-in: With the exception of Charter Communications, companies did not support a requirement that they obtain affirmative "opt-in" consent to collect user data. "I do think that there’s a concern that if you overlay a regulatory imperative like that on every action you really risk breaking … innovative products and services that we know customers love," said Amazon's Andrew DeVore.
• Letting the Federal Trade Commission set rules: Many witnesses weren't willing to commit to backing expanded authority of the Federal Trade Commission, which currently is limited to enforcing existing standards set by Congress rather than making its own.

More broadly, the companies expressed dissatisfaction with the California and European privacy laws.

• Google Chief Privacy Officer Keith Enright estimated that complying with the EU's General Data Protection Regulation had required "in the hundreds of years of human time."

Yes, but: The industry was not a fully united front, as some of the witnesses tried to distance their companies' data collection practices from the data-driven ad business models of Google and Facebook.

• Charter was the only company to whole-heartedly back mandatory opt-in for data collection; it's also an outlier among internet service providers rivals like AT&T and Verizon in that it has not sought as aggressively to compete with Google and Facebook.

What's next: “I think we might have a pretty good idea what a draft would look like [by the end of the year], but I suspect we probably wouldn’t get it acted on until next year," Commerce Committee Chairman John Thune.