The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL:


  SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, 2016.


The Migrating from SSL and Early TLS supplement states:


  The best response is to disable SSL entirely and migrate to a more modern encryption protocol, which at the time of publication is a minimum of TLS v1.1, although entities are strongly encouraged to consider TLS v1.2.


I have a few questions regarding the deprecation of TLS 1.0:


What is the reason for this recommendation?  Are there known vulnerabilities with the TLS 1.0 protocol?  (I'm aware that some faulty TLS implementations are vulnerable to POODLE but a SSL Labs scan indicated that my site was not vulnerable.)
Is it necessary/desirable to apply this standard to web applications using HTTPS that are not handling credit card information?
Is disabling TLS 1.0 and restricting to TLS 1.1 or 1.2 on public-facing websites using HTTPS likely to break browser compatibility for a significant proportion of users?


TLS 1.0 when properly configured has no known security vulnerabilities.  Newer protocols are better designed and better address the potential for new vulnerabilities.  So that's why 

I wouldn't personally recommend disabling TLS 1.0, primarily because IE 7-10 don't support TLS 1.1 out of the box.  In January 2020, IE10 has gone EOL, so I expect it's likely now a good idea to disable TLS 1.0 since there's likely little/no traffic from such an old browser.  If you look carefully at the support matrix at: https://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers you'll see that TLS 1.1 is disabled by default on everything but IE 11.  

Most people have a significant amount of traffic on these browsers, and your website suddenly not working would pose a significant business impact.  Many people here will advocate a single minded approach of "Security above all else", and tell you to strongly advocate for disabling TLS 1.0.  I'm of the belief that security needs to be balanced with business needs, and it's the job of the security professional to understand both the security side, and the impact of changes.  As of 2020, the general principle here still applies, but the tradeoffs have moved towards disabling TLS1.0 in most circumstances.  There may still be some special circumstances of old, embedded devices where you might be able to justify keeping TLS1.0 enabled.

In 2020, there's little reason to keep TLS1.0 around, at least for browsers as the client.  You obviously need to test the impact of this on the stock browser config, and understand how much business you may or may not lose from this change.
