A new report from the Government Accountability Office (GAO) warns that Americans’ retirement plans may be sharing or selling personal information that can be used to market financial products and services, underscoring how routine plan administration can also involve sensitive data handling behind the scenes.

More than 126 million Americans are enrolled in employer-sponsored retirement plans, such as a 401(k) or similar account, and those plans hold more than $9 trillion in assets, according to the GAO.

These plans are typically administered by external financial services providers. The report said employers share some personally identifiable information with asset managers, payroll providers and record keepers who handle investment management and contribution processing.

The personal data employers may provide to those service providers can include a birth date, Social Security number, account numbers, balances and other information.

The GAO said service providers can use that data to market financial products and services and, in some cases, may sell it to third parties, increasing the risk of inadvertent exposure.

GAO’s analysis reviewed privacy disclosures from 31 service providers. Of those, 29 either explicitly allowed data sharing or did not specify whether participant data could be shared for marketing purposes.

The report also found that 17 of the 31 financial service providers did not limit their ability to sell participant data to data brokers or other third parties.

In addition, only 12 of the 31 service providers had privacy disclosures allowing plan participants to opt out of data sharing.

The GAO recommended that the Labor Department provide additional guidance on data privacy for retirement plan participants, sponsors and service providers.

In particular, the GAO said the labor secretary “should clarify what participant information should be considered private and the circumstances in which service providers should obtain written permission before using or sharing this information.”

“Such guidance could also identify best practices including for providing individual participants with choice, to the extent practicable, about how their personal information may be used, sold or shared,” GAO added.

The Labor Department said in response that it “fully supports the goal of appropriately protecting the personal information of participants and beneficiaries of plans,” but it neither agreed nor disagreed with the report’s recommendations.

The agency pointed to its 2021 cybersecurity guidance, which discussed data privacy as part of service providers’ fiduciary responsibilities to plan participants and said contracts should spell out the provider’s obligation to protect private information.

The Labor Department added that while it believes the 2021 guidance makes clear to fiduciaries that they must include data privacy considerations in their contracts, it will, as resources permit, “carefully consider whether supplemental guidance aligned with the recommendation could or should be issued.”

MOST AMERICANS STILL TRUST FINANCIAL ADVISORS OVER AI TOOLS FOR MAJOR MONEY DECISIONS, STUDY FINDS

AMERICANS' 401(K) BALANCES HIT RECORD LEVELS IN 2025

FIDELITY ESTIMATES RETIREES WILL SPEND $185,500 ON HEALTHCARE AND MEDICAL EXPENSES IN RETIREMENT