MONTPELIER, Vt. (AP) _ Authorities from a group of states are investigating whether it is legal for banks that issue credit cards to sell data on customers' spending habits and creditworthiness to marketing firms.

``In this stage we're in the process of gathering information,'' Julie Brill, an assistant attorney general in Vermont and a leader of a national task force on the issue, said Monday. ``We're going to assess what the banks are doing. We'll be making decisions on it later down the road.''

Brill would not name the other states involved or the banks targeted. But Marc Violette, spokesman for New York Attorney General Eliot Spitzer, said dozens of states have joined the probe. Aside from Vermont, New York, Illinois and California are said to be taking lead roles.

``We are investigating,'' said California Attorney General Bill Lockyer. ``It's not clear yet whether there is adequate law to prosecute criminally or civilly for the sale of private financial information from customers. If the law is inadequate, it ought to be strengthened.''

Violette said banks ``may be breaching the trust of their customers by selling information about their customers' buying patterns, their credit limits and other personal data.'' The information is sold to marketing companies that use it ``in an effort to generate sales and then pay the banks a percentage from any new sales they make based on the information the banks provided them,'' Violette said.

Tom Kelly, vice president at Bank One Corp. of Chicago, said that company's First USA credit card division sometimes uses a wide range of data to generate lists of customers who might be interested in a specific product or service. It then hires a direct-marketing firm to make calls to a list prepared by the banking company.

``People are talking about us sharing confidential information,'' Kelly said. ``Here's what we share: name, address and telephone number.'' He said customers have a chance to ``opt out'' of receiving phone calls, mailings or e-mails containing the sales pitches.

But Jean Ann Fox, director of consumer protection for the Consumer Federation of America, said even in the scenario described by Kelly, ``they used information you gave the bank for a purpose other than the one for which you gave it, without your permission.''

She also said the ``opt out'' provision should be an ``opt in,'' in which consumers make the affirmative choice to have information used about them for marketing purposes.

A bill now before a conference committee on Capitol Hill would bring extensive deregulation to the financial services industry, allowing banks, insurance companies and securities firms to merge.

Fox said this raised the possibility of a customer's bank turning down a mortgage request because of something the bank's insurance division saw in the customer's medical records.

She said people should demand that their congressional representatives ``stop this wholesale trafficking in consumers' private information.''

Brill said the task force grew out of an investigation by the Minnesota attorney general's office into direct marketing practices of U.S. Bancorp.

Donn Wagge, senior vice president with that company, said Monday that his bank agreed to pay $500,000 to the state of Minnesota and $2.5 million to charities to settle that case.