The FCC confirmed that yes, regardless of consent, the ISP can collect 'sensitive' information if it is anonymized/de-identified before use or sharing. The ISP does need to make it clear to the user what information is being collected, but there's no way at present to prevent them from collecting it at all. They're also barred from attempting to de-anonymize the data, though a third party probably could.
More info here:
http://transition.fcc.gov/Daily_Releases/Daily_Business/2016...