Companies such as Google and Facebook thrive on your personal data — the bits of information that tell advertisers how old you are, what brands you like and how long you lingered on that must-see cat video. Historically, how these companies use this data has been subject to oversight by the Federal Trade Commission (FTC), the government’s top privacy watchdog.

But a big court defeat for the FTC this week is putting the agency’s power to protect your online privacy in jeopardy, analysts say. The ruling could wind up giving Google and Facebook, not to mention other companies in the Internet ecosystem, the ability to escape all privacy oversight from the FTC, and possibly from the rest of government, too, critics claim, unless Congress intervenes.

In the wake of the setback, the FTC is mulling an appeal — which would mean either asking for a rehearing at the U.S. Court of Appeals for the Ninth Circuit, or escalating to the Supreme Court, according to a person close to the agency.

But unless regulators can persuade the courts to overturn Monday’s decision, the result will be “a fatal blow” to consumer protection, said Jeffrey Chester, executive director of the Center for Digital Democracy.

“The decision will enable a company like Google . . . to engage in unfair marketing and data-gathering practices without having to worry about possible FTC consequences,” he said.

The FTC did not immediately respond to a request for comment. Neither did Facebook and Google.

What’s potentially confusing is that the case doesn’t talk about Facebook or Google. The substance of the case concerns another company, AT&T. But the meat of the lawsuit actually matters less right now than how the Ninth Circuit dealt with it — which was to throw it out on a procedural argument that, analysts say, sets a precedent affecting the entire Internet economy. The case makes it possible for companies to effectively avoid privacy regulations by setting up or buying a phone or Internet service provider.

In its lawsuit, the FTC said AT&T had unacceptably tricked customers with its marketing surrounding unlimited data plans. AT&T’s unlimited data plans aren’t truly “unlimited,” regulators argued, because AT&T actually slowed down its heaviest data users to dial-up speeds after they consumed a certain amount of mobile data.

The FTC has used this truth-in-advertising approach for decades to go after numerous companies, and it represents one of the agency’s core legal tools.

But this time, the FTC’s lawsuit never got off the ground. The regulators’ claims of “unfair and deceptive” behaviour don’t apply, Judge Richard Clifton ruled, because no part of AT&T falls within the FTC’s jurisdiction. Clifton’s argument set off a shock wave among policy analysts — and here’s why.

As a telephone and Internet provider, AT&T is known in legal circles as a “common carrier,” and the FTC is explicitly forbidden by Congress from taking action against common carriers. Until now, most legal experts interpreted this ban to mean that the FTC could still go after such firms for their marketing and advertising claims, because only the core parts of the business were actually engaged in common-carrier activities such as offering home phone service or mobile data.

Clifton’s opinion surprised some policy analysts because it went much further, saying that all parts of AT&T, not just the core business, qualify for the FTC’s common-carrier exemption.

“The immediate effect (of the ruling) is that the FTC can’t pursue AT&T” for not being transparent enough about its unlimited data plans, said Paul Gallant, a telecom analyst at Cowen and Company, in a research note. “However, the court also ruled that the FTC is precluded from regulating any aspect of an ISP for privacy, even other units of the company. So (Monday’s) ruling seems encouraging for some ISPs like Verizon.”

Verizon, of course, is increasingly becoming an online content player with its recent acquisitions of AOL and Yahoo. Under the Ninth Circuit’s decision, the FTC would be barred from going after either subsidiary for any privacy abuses, analysts say, because Verizon also provides phone and Internet service out of a separate department and can claim common-carrier status.

Playing this forward, consumer protection advocates say Clifton’s argument would allow any company to evade FTC oversight simply by launching or buying a small telecom service. Google already benefits from this line of reasoning because it operates Google Fiber. A company such as Facebook, whose goal is to connect a billion additional people to the Internet, could acquire its own broadband provider and claim common-carrier status.

Monday’s ruling shines a spotlight on the Federal Communications Commission, the only federal agency with a mandate to regulate common carriers such as AT&T and Google Fiber. The FCC is currently developing a set of privacy regulations specifically for Internet providers. But unlike the FTC, the nation’s top telecom regulator is limited to regulating only the parts of telecom companies that actually deal with Internet and phone service, analysts say.

Between the FCC’s inability to regulate much beyond the communications-related units of a company and the FTC’s new-found prohibition on regulating any part of a company that owns a communications business, the Ninth Circuit decision creates a gap in consumer protection law, said Berin Szoka, president of the market-oriented think tank TechFreedom.

“Companies like Yahoo and AOL, all based (on) the Ninth Circuit (decision), may fall into a no man’s land of consumer protection, policed by neither agency,” Szoka said.

Even such companies as Apple could find themselves benefiting from this loophole, according to a lawyer who works for the telecom industry. If the FCC attempts to regulate iMessage or other messaging apps, justifying the move as a form of common-carrier regulation, the companies behind them could claim common-carrier status as well — and exemption from FTC oversight, said the lawyer, who spoke on the condition of anonymity to speak more freely.

The FCC said Wednesday it is still reviewing the Ninth Circuit’s decision.

The FTC’s common-carrier exemption was never intended to lead to this result, said David Vladeck, a law professor at Georgetown University who led the agency’s consumer protection bureau from 2009 to 2012.

The purpose of the exemption was to create a division of labour among different regulatory agencies, “not to have large swaths of the economy be unregulated by the federal government,” he said. Thanks to Monday’s decision, “AT&T could start selling high volumes of snake oil and be immune from federal law. Does that make any sense? I don’t think so.”