Access to the data of more than a million teenagers and students and thousands of their parents is being sold to advertisers such as mobile phone and energy drinks companies by Ucas, the university applications body.

The Universities and Colleges Admissions Service received more than £12m last year in return for sending targeted advertising to subscribers as young as 16.

The service, which controls admissions to UK universities and attracts 700,000 new applicants each year, sells the access via its commercial arm, Ucas Media.

Vodafone, O2, Microsoft and the private university accommodation provider Pure Student Living are among those who have marketed through Ucas, which offers access to over a million student email addresses and a market worth a claimed £15bn a year.

The Red Bull energy drink firm promoted three new drink flavours by sending sample cans to 17,500 selected students deemed to be trend-setting "early adopters" in order to create a "social media buzz".

Applicants can opt out of receiving direct marketing, but only at the cost of missing out on education and careers mailings as well.

Meanwhile, the Ucas offshoot Ucas Progress, set up two years ago to serve pupils from aged 13 looking for post-16 courses, is also collecting data. Children who sign up for Ucas Progress via their schools are encouraged by the company to agree to receive marketing by email from "carefully selected third parties". Ucas Progress says it currently only takes advertisements from education and training providers to put on its website and does not mail children directly.

Data campaigners condemned Ucas's approach as "underhand".

Ucas Media promotes its services to potential clients by emphasising the unique richness and accuracy of its data and the trust associated with its brand. Almost every student applying to a British university from the UK or overseas must use the online Ucas application gateway, which requires them to provide up-to-date identity and contact details. "We help them reach uni – we help you reach them," Ucas Media tells potential advertisers.

There is no suggestion that Ucas Media is breaking the law in selling access to data about university applicants and schoolchildren. It does not sell individuals' data directly, but markets access to it, using its own channels to deliver marketing – and keeping possession of a rich and highly valuable bank of personal information.

University applicants are given the option of refusing mailings when they register with Ucas. However, they have to opt out rather than in, and Ucas's application form does not disaggregate commercial mailings from information from education providers and employers.

As a result students who reject product mailings risk missing out on course information and potential career opportunities.

Teenagers using Ucas Progress must explicitly opt in to mailings from the organisation and advertisers, though the organisation's privacy statement says: "We do encourage you to tick the box as it helps us to help you."

Under the banner "Your gateway to undergraduates", Ucas Media's website states: "We're one of the most important organisations in the lives of any young person aspiring to get into university … With years of experience building relationships with students and having worked with some of the UK's best-known brands – from multinationals to independents – we can help you reach current and future students, a market worth over £15bn a year."

Its million-plus email addresses can be "filtered by age, region, subject, domicile, gender or university", it tells potential advertisers, boasting of reaching 100,000 16/17-year-olds, 90,000 mature applicants aged over 21 and 100,000 overseas applicants.

Ucas's website, which also hosts advertising, has more than 1.8 million unique users a month. The company also offers access to the details of 15,000 parents who have signed up with it for more information about higher education.

Emma Carr, deputy director of the privacy lobby group Big Brother Watch, said: "Ucas is perfectly within the law to sell on this information, but the way they are doing so, as is the situation with most data gathering organisations, is underhand. It goes far beyond what students would expect them to do with their data.

"Students should be explicitly asked for their permission before Ucas can sell their information on and Ucas should be open and transparent about who it is selling the data on to."

Rob Campbell, chair of the National association of Head Teachers' secondary education committee, said Ucas's marketing raised concerns. His own school, Impington village college near Cambridge, used Ucas Progress so pupils could choose post-16 options.

He said: "I have a degree of concern around that principle of to what extent students are aware when they opt out or otherwise what decision they are making. I would also have concerns as an educator and parent about the kinds of advertisers you want to specifically target these groups."

The revelation fuels concerns over whether young people are adequately protected against exploitation of their personal data. Data protection legislation does not treat young people any differently from adults, but a growing recognition that teenagers may be giving away highly commercially valuable information about themselves, potentially also risking fraud, has prompted moves to improve education on the issue.

A spokesman for the Information commissioner's office (ICO), set up to promote individuals' data privacy, said Ucas's activities did not appear to breach marketing rules under the privacy and electronic communications regulations.

But the spokesman said: "It's crucial people are aware of how their personal information is being used by an organisation. Where a company wants to use that information for marketing, it should be clear from the outset, and ensure it has the individual's consent, which must be freely given, specific and informed."

The ICO said the organisation was pressing for children to be taught in school about the value and importance of their personal information and how to look after it. There is no specific "age of consent" in the UK for sharing one's own data, though Scottish law states that young people can ask for data held on them at 12 and that age is broadly treated as, in effect, the point of "data responsibility". Many parents would be likely to disagree.

Ucas's accounts say "the majority" of Ucas Media's profits are gift aided to the parent company, which is a charity as well as a company. It argues that the contribution keeps down applicant fees, currently £23 a candidate.

Ucas, whose 2013 accounts show just over a third of its income came from Ucas Media last year, receives no money from the government and is not a quango.

An Ucas spokesperson said: "Ucas and Ucas Media comply strictly with all applicable laws and regulations, in the way in which we handle personal data. Ucas Media has strict guidelines for the different groups that we may cover, based on the age sensitivities of our audiences. For example, Ucas Media does not accept political, alcohol or tobacco related products for marketing."

Ucas Media could segment marketing campaigns by criteria such as geography, but "does not use sensitive data filters or any content from an applicant's personal statement".

The spokesperson said the number of mailings received would vary between applicants but was reviewed to ensure it was "reasonable" and applicants were told in each that they could opt out at any time.

Ucas Progress had no plans to make data from its school-age users available to third parties, and advertisements on its newsletters were "strictly vetted for relevance to help learners to make the right education and career choices for the right reasons with the right outcomes".

• This article was amended on 17 March 2014. An earlier version referred to "sales of the emails and addresses of subscribers". Ucas does not sell that data, but sends targeted advertising to subscribers who do not opt out.