If you’re one of the millions of Americans saving for retirement with a 401(k) or similar account, you assume (and hope) your financial and personal information are safe.
But did you know that retirement plan service providers may share or sell your personal information or use it to market other financial products and services?
Today’s WatchBlog post looks at our new report on why retirement plans share data and what’s being done to protect your personal information.
Image
When and why do retirement plans share data?
More than 126 million Americans participated in employer-sponsored retirement plans with assets totaling more than $9 trillion (as of 2023). When your employer offers a 401(k) or other retirement account, they usually rely on outside service providers to manage it. For example, asset managers need access to your data to invest employee and employer retirement contributions. Payroll providers need the information to ensure retirement contributions are accurately processed. And record keepers need it to manage your account.
The data that your employer shares can include personally identifiable information like your birth date, social security number, account numbers and balances, and more.
But many people may not be aware that service providers can also use your personal information to market financial products and services. And, service providers could potentially even sell your information to third parties, such as data brokers.
While some data sharing can be expected to administer the plan, here’s the concerning part: As more entities gain access to your data, the chances that your information may be inadvertently exposed increase. As a result, you might receive some unwanted marketing for financial products or services. But more concerning is that this sharing could put you at greater risk of identity theft or other fraudulent activity.
Privacy disclosures may not always protect your data
We wanted to find out more about how retirement plan service providers use and share participant data. So, we reviewed privacy disclosures for 31 service providers to determine who has access to it and why.
Here’s what we found:
- 29 service providers did not limit their ability to share participant data for marketing. They either explicitly allowed data sharing or did not specify whether they would share participant data for this purpose.
- More than half of service providers did not limit their ability to sell participant data to data brokers or other third parties.
Selected Retirement Plan Service Provider Policies on Sharing or Selling Participant Data
Image
We also found that while some plan participants can opt out of having their information shared for marketing, others cannot. For example, just 12 of the 31 service providers we looked at had privacy disclosures allowing for opt out.
What’s being done to better protect consumers?
The Employee Retirement Income Security Act (ERISA) governs most employer-sponsored retirement plans in the United States. Specifically, it sets protections for participants and responsibilities for plan sponsors and service providers.
But ERISA doesn’t include explicit provisions addressing data privacy in this digital age.
Some states and federal agencies have taken steps to better protect consumer data. For example, 19 states had enacted comprehensive data privacy laws as of November 2025. All or almost all of these laws provide consumers with the right to opt out of having certain personal information sold or shared. Most state privacy laws also allow consumers to review any personal information companies retain about them and request that errors be corrected.
But questions remain about whether state privacy laws apply to retirement plans. ERISA generally supersedes state law.
State Data Privacy Laws, as of November 24, 2025
Image
At the federal level, the U.S. Department of Labor (Labor) issued cybersecurity guidance in 2021 on retirement plans’ use of participant data. The guidance states that plan sponsors should clearly address service providers’ obligation to keep private information private. And plan sponsors should prevent the use or disclosure of information without written permission.
But Labor’s guidance didn’t say what participant information should be considered private. This guidance also didn’t provide information about when service providers should get written permission to use or disclose information.
Having such privacy protections in place could shield consumers from unwanted marketing and give them more choice on how their data is being used and shared.
Learn more about protecting your private information and our recommendations that Labor issue additional guidance about acceptable uses for participant data in our full report.
- GAO’s fact-based, nonpartisan information helps Congress and federal agencies improve government. The WatchBlog lets us contextualize GAO’s work a little more for the public. Check out more of our posts at GAO.gov/blog.
- Got a comment, question? Email us at blog@gao.gov.
GAO Contacts
Image
Related Products
GAO’s mission is to provide Congress with fact-based, nonpartisan information that can help improve federal government performance and ensure accountability for the benefit of the American people. GAO launched its WatchBlog in January, 2014, as part of its continuing effort to reach its audiences—Congress and the American people—where they are currently looking for information.
The blog format allows GAO to provide a little more context about its work than it can offer on its other social media platforms. Posts will tie GAO work to current events and the news; show how GAO’s work is affecting agencies or legislation; highlight reports, testimonies, and issue areas where GAO does work; and provide information about GAO itself, among other things.
Please send any feedback on GAO’s WatchBlog to blog@gao.gov.
Source: WatchBlog: Official Blog of the U.S. Government Accountability Office
Source: WatchBlog: Official Blog of the U.S. Government Accountability Office. Review credited third-party material before publication.
