The retirement plan holding a decade of someone’s paycheck contributions is also, in many cases, sitting on a detailed profile of that saver: birth date, Social Security number, account balance, and contribution history. A new Government Accountability Office review found no federal agency actually oversees what the companies administering those plans do with that information once they have it, including using it to market other financial products back to the same savers. With roughly 126 million Americans holding money in 401(k)s and similar defined-contribution plans, as of 2023 the most recent year GAO cites, the gap GAO identified touches a large share of the country’s retirement savings.
What GAO Found When It Read the Fine Print
GAO reviewed privacy disclosures from a sample of 31 retirement-plan service providers, the companies, often called record-keepers or asset managers, that plan sponsors hire to administer 401(k)s and similar accounts on their behalf. According to the GAO report, plan sponsors, typically a person’s employer, share participant data with these providers so they can run the plan, but providers may also use that same information to market their own financial products and services, and in some cases sell it. All 31 disclosures GAO reviewed described their data collection and use practices, satisfying a basic transparency standard. Far fewer held up against a stricter test: 19 of the 31 disclosures did not indicate that providers would seek additional consent before using or sharing personal information beyond the purposes originally specified when it was collected.
GAO also reviewed disclosures from six plan sponsors directly and examined how a handful of states have approached consumer data privacy, finding that federal and state protections both leave gaps specific to retirement accounts. As the assets in these plans keep growing, now totaling more than $9 trillion, according to GAO’s 2023 figures, the report frames the stakes of unclear data rules as rising alongside the dollar totals involved.
Free retirement updates: Social Security and Medicare change every year, and nobody sends you a memo. Our free Retirement Shield newsletter breaks down what changed and what to do. Get it free in your inbox.
Why the Department of Labor Has Stayed on the Sidelines
The Employee Retirement Income Security Act, the federal law that governs most workplace retirement plans, does not address data privacy directly. Department of Labor officials told GAO they believe ERISA’s existing duties of prudence and loyalty, the legal obligations that require plan fiduciaries to act in participants’ best interest, should already be enough to deter plan sponsors and service providers from misusing participant data. DOL did issue cybersecurity guidance in April 2021 that touches on data privacy as one component of cybersecurity, but that guidance does not spell out what participant information should be treated as private or what counts as an acceptable use of it.
Service providers GAO interviewed pushed back on the idea that more sharing is purely a downside, arguing that broader use of participant data helps them target products and services that could actually benefit savers, such as flagging when someone might be under-saving or eligible for a lower-cost investment option. GAO’s report does not dispute that potential benefit, but notes that participants themselves have little visibility into which of those two outcomes, a helpful nudge or a marketing pitch for an unrelated product, their own data is being used to generate.
The lawsuits GAO references are not hypothetical. Participants in several large 401(k) plans have sued record-keepers and plan sponsors in recent years alleging that data collected to administer their retirement accounts was used instead to cross-sell unrelated financial products, from annuities to wealth-management services, without participants’ clear knowledge or consent. Those cases have tested ERISA’s fiduciary duties in court, but GAO’s report suggests that litigation alone is an inefficient substitute for clear, upfront federal guidance on what plan administrators can and cannot do with the data participants are required to hand over simply to enroll in a workplace plan.
A Recommendation the Labor Department Won’t Commit To
GAO recommended the Department of Labor issue additional guidance clarifying what participant information should be considered private and when service providers should get written permission before using or sharing it, along with best practices for giving participants more choice over how their data gets used. The Department of Labor’s response fell short of a yes: the agency neither agreed nor disagreed with the recommendation, telling GAO only that it would consider, as resources permit, whether supplemental guidance should be issued. In the meantime, plan sponsors and record-keepers themselves have told GAO they would welcome clearer federal standards, citing the absence of comprehensive national privacy law, a patchwork of differing state requirements, and their own exposure to lawsuits over how participant data gets used.
How a 401(k) record-keeper uses a saver’s data is one kind of gap regulators have been slow to close; whether an eligible household actually applies for the benefits it qualifies for is another, since programs like SNAP for adults 60 and older, state circuit-breaker property-tax credits, and VA Aid and Attendance are opt-in and nobody signs a person up automatically. Older households routinely leave that money unclaimed simply because no agency, and no record-keeper, is responsible for telling them it exists. The Benefits Checklist lists the programs older households often miss alongside their 2026 limits and the state office that handles each one.
This article was produced with the assistance of AI and reviewed by The Financial Wire editorial team.
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
