While 70% of private-sector workers had access to a defined contribution retirement plan (as of March 2025), though only half (50%) participated in one, according to the National Compensation Survey conducted by the Bureau of Labor Statistics.

Still, about 70 million working Americans participated in 401(k) plans in 2025, according to the Investment Company Institute (ICI), with nearly $10.1 trillion in assets at year-end 2025.

So if you’re one of those millions of Americans with a 401(k) or other employer-sponsored retirement account, your personal and financial data could be at risk.

How 401(k) providers can use your data

Employers typically work with third-party service providers to manage employee 401(k)s. For example, payroll providers process your contributions and asset managers invest those contributions.

That means your employer needs to share some personally identifiable information (PII) with service providers, such as your birth date, account number, account balance and Social Security number.

“But many people may not be aware that service providers can also use your personal information to market financial products and services. And, service providers could potentially even sell your information to third parties, such as data brokers,” according to a report by the Government Accountability Office (GAO), an independent, nonpartisan government agency that serves as a congressional watchdog.

In a review of privacy disclosures for 31 service providers from January 2024 through February 2026, GAO found that 15 providers had policies that permitted the sharing of participant data for marketing purposes while 14 didn’t specify whether or not they did.

Of all 31 providers, only two actually prohibited the sharing of participant data for marketing purposes.

As for selling data, more than half (17 of the 31 providers) didn’t “limit their ability” to sell participant data to data brokers or other third parties.

That means you might start receiving more junk mail for financial products and services — which is annoying, but not the end of the world. But if your data is being sold to third parties, it also leaves you more vulnerable to data breaches.

And if your PII is exposed, that puts you at higher risk of fraud and identity theft.

Last year, for example, the U.S. Federal Trade Commission (FTC) received more than 1.3 million complaints of identity theft. It also received more than 3 million reports of fraud that resulted in losses of around $16 billion.

And not all 401(k) plans let you opt out. Indeed, GAO found that just 12 of the 31 providers had privacy disclosures allowing plan participants to opt out of having their data shared with marketers.

What can you do to protect your data?

There are some protections out there — but clearly, they’re not enough, considering that more than half of the providers reviewed by GAO don’t allow for opting out.

The Employee Retirement Income Security Act (ERISA), enacted in 1974 to govern employer-sponsored retirement plans, predates the digital age. While it’s been updated over the years — including the SECURE 2.0 Act that created automatic enrollment mandates for 401(k) plans — it doesn’t set out specific provisions that address data privacy.

Back in 2021, the U.S. Department of Labor issued guidance for plan sponsors on best practices for maintaining cybersecurity, including provisions that “electronic disclosure systems include measures calculated to protect Personally Identifiable Information.”

But GAO argues that “Labor’s guidance didn’t say what participant information should be considered private.”

There are also some protections at the state level. As of August, 24 states have enacted consumer data privacy laws. Of those, 20 laws are currently in effect; four were enacted this year but have future effective dates.

While most state laws allow you to opt out of having certain PII sold or shared, here’s the problem: ERISA typically supersedes state laws.

That’s why GAO is recommending that the Department of Labor provide additional guidance when it comes to participant data privacy. In the meantime, there are a few things you can do to protect your data.