Insurers and brokers are unlawfully accessing the personal details entered by users of price-comparison websites, The Times has learnt.

Two large motor insurance sites, Confused.com and gocompare.com, have admitted that privacy breaches have led to personal data, which can include your address and the kind of car you drive, being passed on to unsanctioned third parties.

Confused.com says that it discovered several instances where insurers had broken their contracts by contacting site users directly after receiving their personal information from the website. It also found that some unscrupulous companies were cold-calling consumers, claiming to have acquired their details through the website.

Gocompare.com said that in one instance Performance Direct, an insurance broker that provides quotes through the site, transferred personal details that it acquired through the website to another company, Call Connections, which then passed on the contact details to other insurers.

The privacy breaches will increase concerns over the safety of entering personal data online as competition in the price-comparison market intensifies. Last week Tesco launched Tesco Compare, a new car insurance comparison site.

A report published this week by Deloitte, the business consultancy, found that about 65 per cent of financial services companies report external security breaches.

Fears over data protection have already prompted the Association of British Insurers to begin talks to set up a code of practice for the industry, while the British Insurance Brokers’ Association has called for greater transparency and disclosure.

While it is lawful in some instances for selected companies to obtain and use customers’ details from the websites, it is becoming increasingly difficult for the sites to monitor where such information ends up.

Confused.com says that it recently launched a crackdown on companies that use its name illegally, while Gocompare says that it performs tests every day to ensure that the companies with which it is associated do not misuse information.

Both websites send users’ details to a number of insurers to generate the quotes, but contracts with the companies allow only the top one or two insurers offering the best quotes to contact you, either by e-mail or phone. None of the insurers or brokers is meant to pass on your details to other companies, yet an increasing amount of information is slipping through the net as insurers and brokers attempt to muscle in on the websites’ massive stores of valuable personal data.

Selling personal data is big business in the insurance industry. While Confused.com and Gocompare do not sell personal details, some sites, such as moneysupermarket.com, the comparison service that floated on the stock market this summer, make large sums through “lead generation”, the practice of selling contact details to other companies.

However, users can ban comparison sites from passing on their details. Anyone worried about their information being misused should check the terms and conditions of the website before submitting a request for a quote. On most sites, users can prevent their details being passed on by ticking or unticking a box during the application. For instance, users of moneysupermarket.com can withhold their details from its list of “trusted partners” by unticking a box.

Moneysupermarket says that its “trusted partners” are contractually bound to ensure that data is held and treated “in accordance with the relevant legislation”.

Gocompare is taking action against Performance Direct for breach of contract. Hayley Parsons, managing director of Gocompare, says: “We have been very stringent with companies and run daily tests, so we were disappointed to have been stung.”

Performance Direct said: “What happened in this instance was not a true reflection of our business practice and was down to staff error.”