Your 401(k) recordkeeper holds your birthdate, Social Security number, account number, contribution rate, and balance. Nothing in ERISA says what it may do with that package once plan administration is finished.
The Government Accountability Office put numbers on the consequence in GAO-26-107271, published February 26, 2026. GAO reviewed the privacy disclosures of 31 service providers — 21 recordkeepers and 10 asset managers — serving a system of more than 126 million private-sector defined contribution participants and roughly $9 trillion in assets as of 2023.
The findings:
- 29 of 31 did not limit their ability to share participant data for marketing. They either expressly permitted it or were silent.
- 17 of 31 — more than half — did not limit their ability to sell participant data to data brokers or other third parties.
- 12 of 31 had disclosures that let a participant opt out at all.
ERISA Is Silent, and the Gap Is Deliberate
ERISA imposes a duty of loyalty and prudence over plan assets. It contains no data privacy provision. DOL's 2021 cybersecurity guidance tells fiduciaries to address privacy in vendor contracts, but — as GAO notes and DOL conceded — that guidance never defines what participant information counts as private or which uses are acceptable. DOL has brought no enforcement action against a plan for unauthorized data sharing.
GAO recommended the Secretary of Labor issue guidance clarifying what information requires protection and when written participant permission is needed before data is shared. DOL neither agreed nor disagreed, saying it would "carefully consider, as resources permit, whether supplemental guidance" could be issued. Translation: treat the current state as the durable one.
Notably, the sponsors and recordkeepers GAO interviewed generally supported a federal standard — the patchwork of state privacy laws is expensive to comply with and inconsistent.
Why the Marketing Pipeline Has a Legal Shield
The commercial value of this data is concentrated at one moment: your job change. A recordkeeper knows your balance, your age, and that you just separated — the exact profile for a rollover solicitation into a higher-fee retail product.
Litigants have tried to reach that conduct through ERISA by arguing participant data is a plan asset. Courts have repeatedly rejected the theory, and no court has held that recordkeeper cross-selling violates ERISA.
The live test case is Williams-Linzey v. Empower Advisory Group, filed August 2025 by Schlichter Bogard, alleging Empower used recordkeeping data to target rollover candidates for its managed account product. Empower's June 2026 motion to dismiss argues it was not a fiduciary, that IRAs fall under ERISA Title II rather than Title I, and that a one-time interaction fails the "regular basis" prong of the 1975 five-part test — the same test restored when the 2024 fiduciary rule was vacated in March.
Where participants have gained protection, it came from settlements, not statute. Vanderbilt University's $14.5 million resolution included a commitment barring the recordkeeper from using participant data to sell non-plan products.
Practical Takeaways
- Read your recordkeeper's privacy notice and find the opt-out. GAO found only 12 of 31 offer one. If yours does, exercising it takes minutes and is the single highest-leverage step available.
- Treat the post-separation phone call as marketing, not advice. Under the restored five-part test, a one-time rollover recommendation generally isn't fiduciary advice. Ask in writing whether the caller is acting as a fiduciary.
- Distinguish the two risks. Cross-selling costs you in fees; GAO's other concern is inadvertent exposure enabling identity theft or fraud. Freeze your credit and enable multi-factor authentication on the plan portal regardless.
- If you're a plan sponsor, this is a contract question. Negotiate data-use restrictions into the recordkeeping agreement — silence in a vendor's disclosure is permission.
- Don't wait for a federal rule. DOL has declined to commit, and the industry's own support for a standard hasn't produced one.
Sources: U.S. Government Accountability Office, GAO-26-107271 — Retirement Plans: Department of Labor Guidance Could Mitigate Privacy Risks for Participants (February 26, 2026); 401(k) Specialist — GAO Raises Red Flags Over How 401(k) Providers Use Participant Data; PSCA — Empower Moves to Dismiss Data Cross-Selling Suit (June 2026); NAPA Net — Empower Moves to Dismiss Schlichter's Participant Data Suit (June 2026); Jackson Lewis Workplace Privacy Report — University Settles Claims Involving Use of Retirement Plan Participant Data For Cross-Selling by Recordkeeper