The business of buying and selling consumer data is so vast and murky that Congress needs to pass a law regulating it, said Federal Trade Commission Chairwoman Edith Ramirez.

"This is an industry that largely operates in the dark," Ramirez told reporters today on a conference call. "We want to shed the veil of secrecy that surrounds data broker practices."

Most consumers don't know about data brokers, but the brokers sure know about them. Data brokers, like the nine studied in the FTC report published today, get information about consumers from the offline world: retailers, the Department of Motor Vehicles, and real property records. Increasingly, that data gets combined with online information collected via cookies, which provide details about what sites a person visits and what type of online information is being sought out.

Along with publishing the report, the FTC has put out a statement outlining legislation it thinks Congress should consider to make the industry more transparent about its practices.

The nine companies, chosen to represent a "cross-section of the industry," are Acxiom, Corelogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf, and Recorded Future. The FTC voted to require the brokers to produce their private information to the government in December 2012. The information learned by the FTC is presented in its report in an aggregated format and not linked to any of the specific companies.

The data-gathering companies serve legitimate business needs, including fraud prevention and targeted advertising, that "benefit consumers and our economy more generally," Ramirez acknowledged.

However, the vast trove of data they're gathering includes potentially sensitive information about race, income, political leanings, and health conditions. Data companies help put consumers into categories like "Urban Scramble" and "Mobile Mixers," "both of which include a high concentration of Latinos and African-Americans with low incomes," said the FTC in today's statement. One data broker created a category called "Rural Everlasting," a product that located men and women over 66 with "low educational attainment and low net worths."

Advertising based on increasingly pinpointed data could lead to some consumers being denied access to services and products that they would have otherwise had access to. "Will some consumers see only ads for subprime loans, while others see ads for credit cards?" asked Ramirez.

The FTC isn't asking for any of the data-gathering to be banned at this point, but it is calling on Congress to legislate additional transparency. The FTC argues that data brokers should be required to disclose their data sources, give consumers access to their data, and create some kind of centralized Internet gateway where consumers can learn more about their data collection practices. Consumers should also be given clear ways to "opt-out" and "suppress the use of their data."

For some sensitive data, such as health conditions, the FTC suggests retailers should be required to obtain "affirmative express consent" from consumers before sharing it with data brokers. For instance, data brokers are able to sift through purchasing information to identify consumers who are pregnant or have conditions like diabetes or high cholesterol. And while a diabetic consumer may not have a problem with health information being used to target her with advertisements for health products, "they would undoubtedly mind if an insurance company used that information to classify them as high risk," noted Ramirez.