Retirement Plans Could Be Sharing Your Personal Data. Are You at Risk?

More than 126 million Americans participated in employer-sponsored retirement plans with assets totaling more than $9 trillion (as of 2023). When your employer offers a 401(k) or other retirement account, they usually rely on outside service providers to manage it. For example, asset managers need access to your data to invest employee and employer retirement contributions. Payroll providers need the information to ensure retirement contributions are accurately processed. And record keepers need it to manage your account.  

The data that your employer shares can include personally identifiable information like your birth date, social security number, account numbers and balances, and more. 

But many people may not be aware that service providers can also use your personal information to market financial products and services. And, service providers could potentially even sell your information to third parties, such as data brokers. 

While some data sharing can be expected to administer the plan, here’s the concerning part: As more entities gain access to your data, the chances that your information may be inadvertently exposed increase. As a result, you might receive some unwanted marketing for financial products or services. But more concerning is that this sharing could put you at greater risk of identity theft or other fraudulent activity.

Privacy disclosures may not always protect your data

Selected Retirement Plan Service Provider Policies on Sharing or Selling Participant Data  

Image

We also found that while some plan participants can opt out of having their information shared for marketing, others cannot. For example, just 12 of the 31 service providers we looked at had privacy disclosures allowing for opt out. 

What’s being done to better protect consumers? 

The Employee Retirement Income Security Act (ERISA) governs most employer-sponsored retirement plans in the United States. Specifically, it sets protections for participants and responsibilities for plan sponsors and service providers.  

But ERISA doesn’t include explicit provisions addressing data privacy in this digital age.  

Some states and federal agencies have taken steps to better protect consumer data. For example, 19 states had enacted comprehensive data privacy laws as of November 2025. All or almost all of these laws provide consumers with the right to opt out of having certain personal information sold or shared. Most state privacy laws also allow consumers to review any personal information companies retain about them and request that errors be corrected. 

But questions remain about whether state privacy laws apply to retirement plans. ERISA generally supersedes state law. 

State Data Privacy Laws, as of November 24, 2025 

Image

At the federal level, the U.S. Department of Labor (Labor) issued cybersecurity guidance in 2021 on retirement plans’ use of participant data. The guidance states that plan sponsors should clearly address service providers’ obligation to keep private information private. And plan sponsors should prevent the use or disclosure of information without written permission. 

But Labor’s guidance didn’t say what participant information should be considered private. This guidance also didn’t provide information about when service providers should get written permission to use or disclose information.  

Having such privacy protections in place could shield consumers from unwanted marketing and give them more choice on how their data is being used and shared. 

Learn more about protecting your private information and our recommendations that Labor issue additional guidance about acceptable uses for participant data in our full report. 

---

• GAO’s fact-based, nonpartisan information helps Congress and federal agencies improve government. The WatchBlog lets us contextualize GAO’s work a little more for the public. Check out more of our posts at GAO.gov/blog.  

• Got a comment, question? Email us at blog@gao.gov.