Article content
The company that holds your 401(k) or IRA already has your birth date, Social Security number, account balance, and beneficiary information. A federal watchdog just confirmed what that company is allowed to do with it, and for most retirement plans, the answer is more than you'd expect.
The Government Accountability Office reviewed privacy disclosures from 31 retirement plan service providers, covering more than 126 million Americans in employer-sponsored plans holding over $9 trillion in assets. Most of those providers either allow your data to be shared for marketing or don't say clearly whether they do.
Personalize this article
Name your plan or account provider
Naming it now makes the calls in this article faster to make.
Interactive toolLog every call about your data before you make the first oneKeep your provider, the date, who you spoke with, and what they promised, all in one place you can point back to.Show the toolHide the tool
Track offices, issues, promised next steps, and follow-up dates in one running log.
What the GAO Found
GAO's review found that 29 of the 31 providers it checked either explicitly allow sharing participant data for marketing purposes or don't specify one way or the other in their privacy disclosures. More than half, 17 of 31, place no limit on selling that data to data brokers or other third parties.
Only 12 of the 31 providers give participants any way to opt out of the sharing at all. GAO recommended that the Department of Labor clarify what participant information should be treated as private and when providers should have to get written permission first.
ChecklistKnow what's actually at riskThis is the specific data GAO flagged as exposed.Show the checklistHide the checklist
0 of 3 done.
Find and Read Your Privacy Notice
Every plan provider is required to give you a privacy notice, but almost nobody reads it when it arrives. It's usually on the provider's website under a footer link like "Privacy" or "Your Privacy Choices," or you can call and ask them to mail or email you a copy.
Look specifically for language about sharing information with "affiliates," "marketing partners," or "third parties." If the notice doesn't mention an opt-out, that's a sign your provider may be one of the 19 GAO found without one.
Choose your next move
What did you find in your privacy notice?
Pick the one that matches what you found, or your best guess if you haven't located it yet.
Good. Your next step is requesting it in writing.
Ask for the Opt-Out in Writing
Call the customer service number on your account statement, not a general search result, so you know you're talking to your actual provider. Ask directly: "Do you share or sell my personal data for marketing purposes, and how do I opt out?"
Citing the GAO report by name and number, GAO-26-107271, tends to get you past a first-line script faster, since it signals you already know this is a documented issue rather than a one-off complaint.
ChecklistDo these on the callA few specific questions keep the call from going in circles.Show the checklistHide the checklist
0 of 3 done.
If a benefits letter or account notice already has you worried about where your information is going, Verify a Social Security Email Before You Act covers a related risk worth ruling out.
If Your Provider Won't Give You a Straight Answer
Some providers will tell you an opt-out doesn't exist, or won't confirm one way or the other. If that happens, you still have somewhere to take it: file a complaint with the Department of Labor's Employee Benefits Security Administration, which oversees retirement plan providers under federal law.
If your account came from a current or former employer's 401(k), your employer's HR or benefits department is also a plan fiduciary and can press the provider on your behalf, since the plan sponsor has its own legal obligation to act in participants' interest.
TimelineWork it in orderCheck off each step as you complete it.Show the timelineHide the timeline
Check your provider's website or call to request a copy.
Request written confirmation instead of a verbal answer.
Contact your plan sponsor's benefits office, or file with the Employee Benefits Security Administration.
Save your plan
Save what you found and did so you have a record if the sharing continues.
Common questions
Can my retirement plan provider sell my personal data?
A GAO review of 31 retirement plan service providers found that 29 either explicitly allow sharing participant data for marketing or don't specify whether they do, and 17 place no limit on selling that data to data brokers or other third parties. Only 12 of the 31 give participants a way to opt out.
What information is at risk of being shared?
GAO flagged birth dates, Social Security numbers, account numbers and balances, and beneficiary information as the data retirement plan providers collect and, in many cases, can share or sell.
How do I opt out of my retirement plan sharing my data?
Find your provider's privacy notice, usually on their website or available by request, and look for opt-out language. Call the number on your account statement, ask directly whether they share or sell your data, and request written confirmation of any opt-out rather than a verbal answer.
What if my provider won't confirm an opt-out exists?
You can file a complaint with the Department of Labor's Employee Benefits Security Administration, which oversees retirement plan providers. If the account is tied to a current or former employer's 401(k), your employer's HR or benefits department is also a plan fiduciary and can press the provider on your behalf.
