Parenting and pregnancy club Bounty has been fined for a data breach involving more than 14 million people.
The firm provides 'goodie bags' filled with products and money-off vouchers for new mums in hospital, as well as taking photos of newborns and relatives.
Its website and apps also offer advice and support for parents-to-be.
But an investigation by the Information Commissioner's Office found Bounty also operated as a 'data broking service' until April 2018, supplying data to third parties for the purpose of electronic direct marketing.
The ICO said Bounty collected personal information for the purpose of membership registration through its website, its mobile app, merchandise pack claim cards and directly from new mums at hospital bedsides.
They said Bounty breached the Data Protection Act 1998 by sharing personal information with a number of organisations without being fully clear with people.
The ICO has fined now fined Bounty UK Ltd £400,000 and a law firm is also pursuing a class action.
Read more of today's top stories here
Bott and Co estimates parents-to-be and parents affected could be entitled to a share of millions of pounds and individually, those whose data was compromised could receive hundreds and even thousands in compensation.
The law firm said names, dates of birth, postal and email addresses, expected due dates, whether a member was a first time mum and genders were shared without full knowledge.
The ICO said Bounty shared approximately 34.4 million records between June 2017 and April 2018 with credit reference and marketing agencies. In total, the company confirmed it shared personal data with 39 organisations, added the data regulator.
Steve Eckersley, the ICO's Director of Investigations, said: "The number of personal records and people affected in this case is unprecedented in the history of the ICO’s investigations into the data broking industry and organisations linked to this.
"Bounty were not open or transparent to the millions of people that their personal data may be passed on to such large number of organisations. Any consent given by these people was clearly not informed. Bounty’s actions appear to have been motivated by financial gain, given that data sharing was an integral part of their business model at the time."
Coby Benson, solicitor at Bott and Co, said: "Personal data is being lost, stolen and compromised on a mass scale and at an alarming rate - and it's simply not acceptable. In this case, Bounty sold its customers' data for its own financial gains, which is shocking. We're starting group legal action against Bounty as it has breached data protection laws by sharing personal and potentially sensitive information of millions of parents and parents to be."
Jim Kelleher, managing director of Bounty, said: "We acknowledge the ICO’s findings - in the past we did not take a broad enough view of our responsibilities and as a result our data-sharing processes, specifically with regards to transparency, were not robust enough. This was not of the standard expected of us.
"However, the ICO has recognised that these are historical issues. Our priority is to continue to provide a valuable service for new parents that is both helpful and trusted.
"As the ICO has highlighted, we made significant changes to our processes in spring 2018, reducing the number of personal records we retain and for how long we keep them, ending relationships with the small number of data brokerage companies with whom we previously worked and implementing robust GDPR training for our staff."
The firm added it was going to appoint an independent data expert to carrying out annual checks to be published.
Fugitive kitchen trader Vance Miller still owes £2million in ill-gotten gains
CBBC star Mya-Lecia Naylor dies aged 16 as tributes are paid to 'much loved' actress
