Terms Unconditional

Retirement & Telehealth · Retirement/Investment · No confirmed finding (unverified, not clean)

Principal Financial Group

Headline

Nothing confirmed

Principal is a major retirement and insurance provider, and the analysis mirrors Empower: participants are enrolled through employers, hold long-duration relationships they rarely review, and supply beneficiary…

Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.

What this pass recorded. Nothing confirmed this pass. Principal is a major retirement and insurance provider, and the analysis mirrors Empower: participants are enrolled through employers, hold long-duration relationships they rarely review, and supply beneficiary designations that map family structure including estranged relationships and second families. Beneficiary data is quietly among the most socially sensitive information in financial services and it attracts no special protection. Unverified rather than clean.

  • SeveritySeverity 2 of 5, not independently verified. Nothing confirmed this pass. Principal is a major retirement and insurance provider, and the analysis mirrors Empower: participants are enrolled through employers, hold long-duration relationships they rarely review…
  • Evidence tierUnassigned
  • Claims confirmedNo sourced claims yet
  • Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Last verified 96 days agoverified 96 days ago0180 days
Freshness. Last verified 96 days ago (2026-08-04); stale after 180 days.

Terms

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual account agreements; note the SAME general 401(k)/retirement-plan-provider industry concerns documented for Empower Retirement (see that row — using participant data to identify and cross-sell into fee-generating managed accounts) may be worth checking against Principal's own practices given the structural similarity of the business model.

Data sharing

Not independently confirmed this pass with a specific named data-privacy lawsuit or breach.

Fees and billing

Not itemized this pass.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (PFG). Service route: c/o General Counsel / Corporate Secretary, Des Moines, Iowa — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.

No published channel
Paper trail: none. No published channel.

Evidence

No claims have been itemized for this row yet.

No sources are on file for this row yet.

Source vault

Link status: Candidate - not yet fetched

DocumentLast fetchPDF
Privacy policy
principal.com/privacy-policy
Not fetched yetNO (HTML only)
Terms of service
principal.com/terms-of-use
Not fetched yetNO (HTML only)
Website
principal.com
Not fetched yet—
Primary source
No URL recorded
Verification: Unverified - heuristic first draft
Not fetched yet—

Enforcement

No enforcement actions are linked to this row.

State statute

Headquarters on file: Iowa. Provisions of ICDPA on file:

ProvisionTypeSource
Applicability Threshold
Iowa Code § 715D.2
thresholdsource
Consumer Rights — Second-Narrowest Regime
Iowa Code § 715D.3
hardsource
Sensitive Data — Opt-OUT Structure (Not Opt-In)
Iowa Code § 715D.4(2) (sensitive data defined at § 715D.1(26))
hardsource
Enforcement — AG; 90-Day Cure Period
Iowa Code § 715D.8
hardsource