"State regulators may consider requiring utilities and other firms to provide customers clear information regarding how their data may be used, if consumers authorize such use, and guaranteeing that customers have the ability to select the purposes for which their data may be used."