A company that offers pregnant women and new parents health advice and gifts, faces a fine for illegally sharing more than a million people's personal data with the Labour Party.
The UK's data watchdog intends to issue the owner of the Emma's Diary service, external a £140,000 penalty.
It said Lifecycle Marketing had sold the data for use in the 2017 general election campaign without disclosing it might do so.
The firm disputes the findings.
It said it had not been given an opportunity to respond to the Information Commissioner's Office's complaints before the report was published
"As a result, details of the ICO's findings, including those being reported by the press, contain significant factual inaccuracies which we trust will be corrected," said a spokeswoman for Lifecycle Marketing.
"This includes the untrue claim that we sold data from expectant mothers to the Labour Party. Furthermore, Lifecycle has never been, nor ever will be, involved in collecting data from mothers in maternity wards."
It is common for political parties to buy personal information to target their campaigns, but appropriate consent must have been obtained by the providers.
Labour has said that it will review its "approach to acquiring data from third parties" in light of the report.
One legal expert said the intervention was likely to cause wider concern.
The benefits of joining include tailored emails with pregnancy and breastfeeding advice, as well as discount vouchers for high street stores and gift packs including nappies, baby wipes and other similar items.
A companion app also allows mothers-to-be to keep a journal of their pregnancies and make a time-lapse video of their growing bumps.
The business' privacy policy stated that in return for such benefits, users permit third parties to contact them for marketing purposes.
But while the policy had listed several business sectors and specific companies that might get the data, the ICO said there had been no mention of political parties.
In fact, the watchdog added, the policy was only amended to do so in January 2018 after the ICO had told the company it was under investigation.
This, the regulator concluded, breached the Data Protection Act's "fairness" requirement that organisations be transparent about how gathered personal data might be used.
It added that there may also have been a breach of the European Convention on Human Rights.
In considering the size of its penalty, the watchdog said it had taken into account that it understood Lifecycle Marketing had not shared personal data with a political party on any other occasion, and had expected the information to be deleted after the general election vote.
But it added that it was not clear how the firm could be confident that the data had indeed been permanently erased.
The ICO added that it would make a final ruling after hearing back from Lifecycle Marketing, and would confirm the size of the penalty on or after 30 July.
"[We] will be submitting our written representations to challenge the ICO's findings in accordance with the usual process," said a spokeswoman for Lifecycle Marketing in response.