Not only can they sell your browsing history, they are in the unique position to associate your current IP address with your browsing history, and sell real-time access to that information. If I open up an Incognito window right now and go to a site I've never visited before, they couldn't serve me targeted ads, because without cookies they'd have no reliable way of knowing that I was the same 111.222.111.222 that connected a few days ago. But now, AT&T could set up a server that ad networks can call out to, that can return a browsing profile if queried with an IP address. You've given them permission to do that. As far as I know, Tor is the only way to circumvent this... and with the forthcoming FCC rules, Tor traffic could be significantly rate-limited. This is a pretty big deal.
This highlights the importance of obfsproxy development for tor. Not only can it allow tor's use in regimes that employ deep packet inspection to prevent tor traffic, it could also prevent throttling of tor traffic, as it would look just like normal traffic.
