US regulators have ordered data brokers to turn over information about how they collect and use information about consumers, in a move hailed by internet privacy activists.
The US Federal Trade Commission said nine firms were ordered to hand over information that will be used to study privacy practices in the data broker industry.
The move drew immediate praise from the Centre for Digital Democracy, a Washington-based group which monitors online privacy.
"Today's action by the FTC will unmask this largely stealth consumer surveillance industry," the group said on its blog.
"It will shine a powerful regulatory spotlight on such disturbing practices... Our data is sold to the highest commercial bidder in milliseconds, who can use the information for almost any purpose -- yet it is unavailable so a consumer can review or challenge it."
The FTC said data brokers are companies "that collect personal information about consumers from a variety of public and non-public sources and resell the information to other companies".
The agency said data brokers in some ways help consumers and the economy by aiding companies prevent fraud, and by providing information to firms to better market their products and services.
But an FTC report earlier this year called on the data broker industry to improve the transparency of its practices.
The agency said consumers are often unaware of the existence of data brokers as well as the purposes for which they collect and use data.
The nine data brokers receiving orders from the FTC are Acxiom, Corelogic, Datalogix, eBureau, ID Analytics, Intelius, Peekyou, Rapleaf and Recorded Future.
The FTC is seeking details about the nature and sources of the data collected, how companies use and disseminate the information; and the extent to which the data brokers allow consumers to access and correct their information or to opt out of having their personal information sold.
The agency will use the responses it receives to prepare a study and to make recommendations on privacy practices.
Earlier this year the Electronic Privacy Information Center and CDD asked the FTC to investigate whether Facebook's data-matching arrangement with Datalogix violates a settlement on privacy.
