Playing Exposed: Student Athletes and the Unregulated Collection of Biometric Data

Introduction

In December 2025, the National Collegiate Athletic Association (NCAA)’s Committee on Competitive Safeguards and Medical Aspects of Sports approved its first formal guidance on the responsible use of performance technologies in college athletics.¹[1]NCAA Comm. on Competitive Safeguards and Med. Aspects of Sports, Performance Technology Guidance Approved by CSMAS, NCAA (Dec. 11, 2025), https://www.ncaa.org/news/2025/12/11/media-center-performance-technology-guidance-approved-by-csmas.aspx. Following a summit by the NCAA Sport Science Institute that covered devices ranging from GPS wearables to heart rate monitors and sleep trackers, the guidance signals that the organization is finally grappling with the widespread deployment of biometric data (the physiological and performance information generated by wearable devices, including heart rate variability, GPS movement, sleep patterns, and recovery metrics) collection tools across college athletics.²[2]NCAA Comm. On Competitive Safeguards and Med. Aspects of Sports, supra note 1. Yet the guidance stops well short of binding regulation. It does not include mandatory consent requirements, establish enforceable data retention standards, or create private rights of action for athletes whose physiological information is being shared or monetized without their knowledge or consent. For the approximately eighty percent of student athletes whose teams already use athlete biometric data (ABD) tracking technology, the practical effect of the NCAA’s December announcement is modest at best.³[3]KINEXON Sports, A Collection of Insights: 2022 State of Performance Tracking in College Basketball Report, KINEXON SPORTS BLOG (Mar. 1, 2023), https://kinexon-sports.com/blog/2022-state-of-performance-tracking-in-college-basketball-report/.

This development arrives against a broader backdrop of unresolved legal questions about who owns the intimate physical data generated by student athletes’ bodies, and who is responsible when that data is misused. Courts have already recognized in O’Bannon v. NCAA and NCAA v. Alston that the institutional exploitation of student athletes’ personal attributes for commercial gain should not be insulated from legal scrutiny.⁴[4]O’Bannon v. Nat’l Collegiate Athletic Ass’n, 802 F.3d 1049 (9th Cir. 2015); Nat’l Collegiate Athletic Ass’n v. Alston, 594 U.S. 69 (2021). Biometric data collection has emerged as one of several unresolved questions in the wake of O’Bannon and Alston, and one where student athletes remain most exposed. In light of the NCAA’s recent guidance and the continued absence of federal biometric data privacy legislation, this blog examines the regulatory gaps governing college athlete biometric data collection and offers reforms through establishing a federal legislative floor for biometric privacy protection at the collegiate level, data governance standards binding on NCAA institutions, and state legislatures allowing for private rights of action.

Beyond NIL: Structural Vulnerabilities in Biometric Data Collection

The legal system has long struggled to keep pace with the institutional exploitation of student athletes’ personal attributes for commercial gain. In O’Bannon v. NCAA, the Ninth Circuit held that the NCAA’s rules preventing student athletes from being compensated for the use of their names, images, and likenesses (NIL) constituted an unreasonable restraint of trade under Section 1 of the Sherman Antitrust Act.⁵[5]O’Bannon, 802 F.3d at 1075-76. The court found that the NCAA had, for decades, profited from athletes’ most personal identifiers, such as their faces, bodies, and playing styles when they were rendered into video games and broadcast footage, without compensation or the ability to object.⁶[6]See O’Bannon, 802 F.3d at 1061–63. O’Bannon revealed that the NCAA treated student athletes’ likenesses as institutional property to be licensed without consent or compensation.

The Supreme Court’s decision in NCAA v. Alston sharpened this critique further.⁷[7]Alston, 594 U.S. at 69. Justice Kavanaugh’s concurrence adds to the growing consensus that the NCAA cannot invoke its structural power to suppress what student athletes are owed for the value they produce, writing that “[b]usinesses like the NCAA cannot avoid the consequences of price-fixing labor,” and that “[t]he NCAA “is not above the law.”⁸[8]Alston, 594 U.S. at 108, 112 (Kavanaugh, J., concurring). Taken together, O’Bannon and Alston establish that courts are prepared to scrutinize arrangements in which institutions systematically extract commercial value from student athletes.⁹[9]See generally O’Bannon, 802 F.3d 1049; Alston, 594 U.S. at 69.

While student athletes may now profit from their NIL following Alston and the NCAA’s subsequent rule changes, the legal relationship between NIL rights and biometric data ownership remains entirely unresolved.¹⁰[10]Alston, 594 U.S. at 69; In re College Athlete NIL Litig. (House v. NCAA), No. 4:20-cv-03919 (N.D. Cal. June 6, 2025) [hereinafter House Settlement] (approving $2.8 billion settlement resolving antitrust claims that NCAA rules prohibited student athletes from receiving NIL compensation, and establishing a revenue-sharing framework permitting schools to pay athletes directly). There is no authority clearly establishing whether the commercial use of an athlete’s biometric performance data constitutes a compensable NIL use.¹¹[11]See Sarah M. Brown & Katie M. Brown, Should Your Wearables Be Shareable? The Ethics of Wearable Technology in Collegiate Athletics, 32 Marq. Sports L. Rev. 97, 103 (2021); see also See Maurice Wells, Biometric Backlash: The Rising Wave of Litigation Under BIPA and Beyond, Nat’l L. Rev. (Aug. 21, 2025), https://natlawreview.com/article/biometric-backlash-rising-wave-litigation-under-bipa-and-beyond; National Biometric Information Privacy Act of 2020, S. 4400, 116th Cong. (2020), https://www.congress.gov/bill/116th-congress/senate-bill/4400. In practice, biometric data is treated not as a personal asset belonging to the athlete but as institutional property available for commercial licensing.¹²[12]See University of Michigan–Nike Apparel Agreement § 1(a) (2016), https://www.toledoblade.com/attachment/2016/04/26/University-of-Michigan-Nike-contract-2016.pdf (defining “Activity Based Information” as performance and activity data collected from team members during competition and training, including heart rate and running routes, for use by Nike in manufacturing, advertising, and marketing on an anonymized and aggregated basis); see also Marc Tracy, With Wearable Tech Deals, New Player Data Is Up for Grabs, N.Y. Times (Sept. 9, 2016), https://www.nytimes.com/2016/09/11/sports/ncaafootball/wearable-technology-nike-privacy-college-football.html. The University of Michigan’s 2016 sponsorship agreement with Nike, the first major collegiate contract to grant apparel company rights to player-generated biometric data marked a turning point that would set the stage for House v. NCAA.¹³[13]Univ. of Mich.–Nike Apparel Agreement, supra note 12; Tracy, supra note 12; House Settlement, supra note 10. Negotiated in secret and only disclosed after Freedom of Information requests, the contract authorized Nike to use what it defined as “Activity Based Information”: performance and activity data collected from team members during competition and training, including heart rate and running routes, for use in manufacturing, advertising, and marketing purposes.¹⁴[14]Id. In practical terms, this means biometric data generated by athletes’ bodies directly informs product design (which shoe absorbs what load at what speed), validates performance claims in advertising (“engineered for athletes who generate X force per stride”), and shapes marketing strategy. The university’s commercial interest is indirect but significant: by licensing access to athlete generated data as a term of its apparel partnership, Michigan converted its athletes’ physiological output into a bargaining chip worth millions of dollars in apparel revenue, branding rights, and equipment supply.¹⁵[15]Id. The athletes whose bodies generated the data had no meaningful input, no ability to opt out, and no share of the commercial value.¹⁶[16]Id.; While the House Settlement resolved college athletes’ antitrust claims to broadcast and NIL compensation, it left biometric data untouched, and post-House litigation (e.g., Talanoa v. NCAA, No. 3:26-cv-05562 (N.D. Cal. June 9, 2026) (challenging the settlement’s revenue-sharing cap under state NIL laws)) confirms the framework remains unsettled. No reported case has addressed whether biometric performance data constitutes a compensable NIL asset.

Unlike professional athletes, who can negotiate the terms of wearable technology use through collective bargaining agreements, student athletes have no equivalent bargaining structure.¹⁷[17]See Jason F. Arnold & Robert M. Sade, Wearable Technologies in Collegiate Sports: The Ethics of Collecting Biometric Data from Student-Athletes, 10 Am. J. Bioethics 1 (2017), https://pmc.ncbi.nlm.nih.gov/articles/PMC5634810/. NIL agreements have quietly evolved into data contracts, particularly where wearable technology companies are involved. Brand partners increasingly prioritize access to ABD over simple sponsorship visibility, but the agreements authorizing that access rarely specify how long biometric data is retained or what happens to it when a partnership ends.¹⁸[18]See Doneld Shelkey, Sports Sponsorships Are Now Data Deals (Whether the Contract Says So or Not), Morgan Lewis Tech & Sourcing Blog, JD Supra (Mar. 26, 2026), https://www.jdsupra.com/legalnews/sports-sponsorships-are-now-data-deals-1877918/. Consent forms for biometric data collection are typically embedded in broader enrollment or participation paperwork, and scholars have documented that universities may pressure athletes to comply through threats of reduced playing time or removal from the team.¹⁹[19]See generally Brown & Brown, supra note 11; see also Tracy, supra note 12. Student athletes who have become adept at navigating NIL endorsements may still sign away rights to their physiological data without realizing it, because the biometric dimensions of these agreements rarely receive the same scrutiny as compensation terms.

While Alston addressed education-related compensation rather than data rights, that reasoning should carry to the biometric context.²⁰[20]Alston, 594 U.S. at 69. There are further underappreciated risks involving the downstream uses of a student’s ABD. Analytics companies that serve both college programs and professional leagues raise the possibility that a college athlete’s biometric profile could inform professional draft decisions and earning potential.²¹[21]See generally Arnold & Sade, supra note 17; Brown & Brown, supra note 11. Unlike a compromised financial account, ABD cannot be reset or reissued – the exposure is permanent. The foundational question of who owns that data remains unanswered, and as its commercial value grows through sponsorship deals, media integration, and beyond, the pressure to resolve it will only intensify. The reason it has gone unanswered is simple: no legal framework exists that was built to answer it.

Fragmented Protections and Institutional Silence

There is no federal statute that directly governs the collection, use, or commercialization of biometric data generated by student athletes.²²[22]See generally Arnold & Sade, supra note 17; Karson Taylor, NCAA Athletes’ Right to Privacy in the Digital Age, The Regulatory Review (Aug. 12, 2025), https://www.theregreview.org/2025/08/12/taylor-ncaa-athletes-right-to-privacy-in-the-digital-age/. The Health Insurance Portability and Accountability Act (HIPAA), the most commonly invoked health data protection law, does not apply to college athletic departments or any third-party wearable technology vendors they may engage, because these entities are neither “covered entities” nor “business associates” as defined by the statute.²³[23]Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of 42 U.S.C.); see also Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. §160.103 (2024) (defining “covered entity” and “business associate”). These categories instead encompass health insurers, hospitals, physicians, and third parties that handle protected health information on their behalf.²⁴[24]Id. The Family Educational Rights and Privacy Act (FERPA) offers limited protection for biometric data generated on the practice field, as its scope is generally confined to academic records and its enforcement mechanism is administrative rather than providing a private right of action.²⁵[25]Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g(a)(4)(A); see also Gonzaga University v. Doe, 536 U.S. 273, 287 (2002).

The most robust legal protections that exist for biometric data are at the state level. Illinois’ Biometric Information Privacy Act (BIPA), enacted in 2008, requires informed written consent before any private entity collects biometric identifiers, mandates retention and destruction schedules, prohibits the sale of biometric data, and provides a private right of action with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation.²⁶[26]Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/1 et seq. (2008).

The Illinois Supreme Court strengthened BIPA’s reach significantly in Rosenbach v. Six Flags Entertainment Corp., unanimously holding that a plaintiff need not allege actual injury or adverse effect beyond a statutory violation in order to qualify as an “aggrieved” person entitled to bring suit.²⁷[27]Rosenbach v. Six Flags Entm’t Corp., 129 N.E.3d 1197 (Ill. 2019). In that case, Six Flags scanned a minor’s fingerprint without the required notice or written consent when issuing a season pass.²⁸[28]Rosenbach, 129 N.E.3d at 1201. The court held that the mere failure to comply with BIPA’s procedural requirements was itself a cognizable legal harm.²⁹[29]Id. at 1207. The implications for collegiate athletics are significant. Student athletes may sign consent forms for wearable technology use, but under Rosenbach’s reading, BIPA requires specific written notice of the data being collected, its purpose, and its retention before collection begins.³⁰[30]Id. A general participation waiver does not clear that bar, leaving any NCAA member institution operating in Illinois that collects biometric identifiers from athletes without compliant consent exposed to the same class action liability. The scale of that exposure is not hypothetical – in 2021, Facebook settled a BIPA class action for $650 million after its facial recognition technology scanned users’ biometric data without consent, demonstrating what liability at scale looks like when biometric collection goes unregulated.³¹[31]In re Facebook Biometric Info. Privacy Litig., No. 3:15-cv-03747-JD, 2021 WL 757278 (N.D. Cal. 2021).

Texas and Washington have enacted narrower analogues to BIPA: Texas’s Capture or Use of Biometric Identifier Act covers only biometric identifiers used for commercial purposes and limits enforcement to the attorney general, while Washington’s My Health My Data Act of 2023 provides a private right of action, but focuses primarily on consumer health data.³²[32]Tex. Bus. & Com. Code Ann. §503.001 (West 2009); Wash. Rev. Code § 19.373 (2023). The majority of states, however, have no biometric-specific statute at all.³³[33]See Maurice Wells, Biometric Backlash: The Rising Wave of Litigation Under BIPA and Beyond, Nat’l L. Rev. (Aug. 21, 2025), https://natlawreview.com/article/biometric-backlash-rising-wave-litigation-under-bipa-and-beyond. At the federal level, the National Biometric Information Privacy Act of 2020, introduced by Senators Jeff Merkley and Bernie Sanders, would have required written consent prior to collection, mandatory data destruction upon satisfaction of the data collection purpose or one year after the individual’s last interaction with the entity collecting, and a prohibition on the sale of biometric data, but the bill died in committee.³⁴[34]National Biometric Information Privacy Act of 2020, S. 4400, 116th Cong. (2020), https://www.congress.gov/bill/116th-congress/senate-bill/4400. Student athletes may assume that federal law or their contracts protect their biometric data, but no federal statute requires it and most contracts do not address it. The NCAA’s own bylaws contain no binding provisions governing biometric data collection, and its December 2025 guidance remains aspirational rather than enforceable.³⁵[35]NCAA Comm. on Competitive Safeguards and Med. Aspects of Sports, supra note 1.

Conclusion

The through-line that connects O’Bannon, Alston, and the current biometric data debate is consistent. Student athletes generate enormous value through their bodies, their performances, and their personal attributes, and the institutional structures surrounding college athletics have historically been designed to capture that value without adequate consent, compensation, or legal protection for athletes themselves. The NCAA’s December 2025 performance technology guidance acknowledges, for the first time at a national level, that biometric data collection raises genuine concerns about athlete wellbeing and privacy.³⁶[36]Id. at *4. However, the guidance provides little protection from ABD collection. Closing the regulatory gap will require layered action: federal legislation establishing a minimum floor of biometric privacy protection applicable to collegiate athletic contexts; NCAA rulemaking that makes data governance standards binding on member institutions; and state legislatures following Illinois’ lead in enacting statutes with private rights of action.³⁷[37]Id. at *4. Until those frameworks exist, student athletes will continue to give everything to their sport, including data about their own bodies, while the law looks away.

Written by: Chelsea Marlborough
Chelsea is a 2027 J.D. Candidate at Brooklyn Law School.