What American Professional Sports Reveals About the Legal Void Surrounding Bodily Data

Sensors worn by athletes in the major American leagues generate terabytes of data every season: heart rate, muscle load, sleep quality, recovery level, fatigue markers. This data is worth millions of dollars in performance gains, injury prevention, and roster optimization. Nobody knows who owns it.

This is not a metaphor. A study published in December 2025 in Frontiers in Sports and Active Living confirms that no collective bargaining agreement in the three major American professional leagues—the NFL, NBA, and MLB—defines the ownership of biometric data generated by sensors worn by players, nor the conditions for their sharing, nor athletes’ rights to object to their use. The void is absolute, and its consequences are beginning to emerge.

The Essentials

  • No collective bargaining agreement in the three major American leagues (NFL, NBA, MLB) defines ownership of biometric data generated by sensors worn by players, according to a study published in Frontiers in Sports and Active Living in December 2025.
  • Franchises and leagues capture and analyze this data in real time to adjust contracts, game scheduling, and medical decisions, with no legal obligation to share the results with the players involved.
  • Aging players and athletes in post-injury rehabilitation are most vulnerable: their fatigue and recovery data can be turned against them during contract negotiations.
  • Several initiatives are emerging—biometric consent clauses in certain union negotiations, academic reflection on a co-ownership model—but none have yet become law.

Sensors Everywhere, Rights Nowhere

Biometric tracking technologies invaded American professional sports at a speed institutions failed to keep pace with. The NBA officially authorized players to wear wearables in 2017. The NFL deployed RFID chips in shoulder pads in 2014 to track movements down to the yard. MLB measures swing speed, swing angle, and muscle effort using Statcast systems coupled with individual sensors at several clubs.

In less than a decade, the professional athlete became a living source of data. Teams know when he sleeps poorly, when his heart rate exceeds risk thresholds, when his sprint speed declines week after week. This information feeds predictive injury models that directly influence roster management decisions: playing time, placement on the injured list, and the value assigned to a player during contract negotiations.

What technology built in ten years, the law has barely touched. The Frontiers study makes an unambiguous finding: while the collective bargaining agreements of the NFL, NBA, and MLB recognize the existence of tracking technologies, data ownership remains undefined in all three leagues. On the question of their use for contractual purposes, situations differ significantly: the NBA CBA explicitly prohibits the use of biometric data in contract negotiations, under penalty of a $250,000 fine, and the MLB CBA contains similar confidentiality clauses; only the NFL CBA remains more ambiguous, though it does provide for joint NFLPA-NFL administration of tracking decisions. The player can be monitored. He does not always have the right to know what the monitoring says about him, nor to contest its use.

The Franchise as De Facto Owner

In the absence of an explicit rule on ownership, practice has settled by default: franchises control the data. They collect it through systems they finance, store it on their servers, share it with doctors and trainers they employ. The player wears the sensor. He has no access to the dashboard.

This imbalance is not without precedent in the digital economy. Daron Acemoglu and Simon Johnson, in their work on technology and the distribution of economic power, have shown that the capture of an innovation’s gains rarely follows a meritocratic logic—it follows the logic of who controls the infrastructure. In the case of professional sports, the infrastructure is the sensor, the server, and the algorithm. Everything belongs to the franchise. The book review of Power and Progress illustrates this mechanism more broadly: technology redistributes its benefits only under institutional constraint. Without rules, it consolidates existing asymmetry.

In professional sports, this asymmetry takes a particularly concrete form. The NBA CBA explicitly prohibits franchises from using biometric data to inform their contract offers, under penalty of a $250,000 fine, and the MLB CBA contains similar restrictions. By contrast, the NFL framework remains murkier on this point, despite the co-administration provisions in the 2020 CBA. In leagues where the rule is absent or ambiguous, the franchise can therefore negotiate knowing, before sitting down at the table, that a given player displays declining recovery markers or that his cumulative muscle load over three years exceeds thresholds associated with serious injuries—while the player, for his part, negotiates without this information, or with fragmented data that his agent sometimes had to extract through informal requests.

Aging Players as a Test Case

The problem is abstract for a 24-year-old star in peak condition. It becomes very concrete for a 32-year-old forward approaching the end of his contract. His biometric data—accumulated fatigue, recovery speed, cardiac markers—then becomes the direct stake in the impending negotiation. The franchise possesses these figures. The player’s agent, meanwhile, must often reconstruct them from visible on-field performance.

This scenario is not hypothetical. Incidents have emerged, without ever crossing the threshold of public litigation, precisely because no legal basis would allow them to be adjudicated. How can one contest the use of data one is unsure of having produced, whose transmission to anyone is unknown, and which is protected by no text? The legal void protects franchises as effectively as an explicit lock.

Players in post-injury rehabilitation are in a symmetric situation. Their return to play depends on a medical evaluation, which itself rests on biometric data collected during rehabilitation. If this data reveals slower-than-expected recovery, or persistent markers of fragility, it can justify a decision to terminate the contract. The player has no certainty that this data will be communicated to him, nor that it will not be shared with other franchises through informal information networks.

The irony is that this same data, if accessible to athletes, could also protect them. A player informed of his own fatigue markers can adjust his training, anticipate an injury, argue for a rest request. The asymmetry is not merely a contractual injustice: it is an obstacle to autonomous career management.

What the Unions Negotiated—and What They Failed to Achieve

Player associations have not remained idle. The NBPA (National Basketball Players Association) included clauses in recent collective bargaining negotiations limiting certain uses of wearables—players can theoretically refuse to wear certain devices during games. The NFLPA sought and obtained access to certain performance data collected by the league’s official systems. The MLBPA opened the subject without resolving it.

These advances are real but narrow. They address consent to wearing the sensor, not ownership of the data generated. They concern data from official games, not data collected during practice, medical sessions, or training facility use. And they do not address the central question: can the team use a player’s biometric data to inform its contract decisions without informing the player concerned?

The answer varies by league. In the NBA and MLB, collective bargaining agreements explicitly prohibit it. In the NFL, nothing clearly prohibits it. And in all three cases, the question of data ownership itself remains entirely open.

This situation illustrates a mechanism that researcher Axelle Arquié, a specialist in technology regulation and artificial intelligence, has documented in other sectors: when a data collection technology becomes embedded in a work relationship, the question of ownership and benefit-sharing is not resolved by market logic—it requires an explicit political decision. Without this decision, the party controlling the infrastructure captures the gains, and the party producing the most valuable data (the athlete, in this case) derives no legally protected benefit from it.

The parallel with the rest of the digital economy is striking. The ability of AI to progress on complex tasks in a matter of months makes this legal void increasingly costly: the more biometric analysis algorithms gain in precision, the more data captured today on a 28-year-old player is worth tomorrow in predicting what he will be at age 33.

Toward Co-Ownership of Bodily Data?

Several models circulate in academic and union discussions. The most debated is that of co-ownership: a biometric data would belong to an athlete, and its commercial use by the franchise would be subject to explicit agreement and benefit-sharing. Another model, closer to medical practice, would hold that an individual’s health data is inalienable—he can authorize its use, but cannot be dispossessed of it.

None of these models has yet been translated into an American collective bargaining agreement or law. American data protection law offers certain protections, but their application to data collected in professional sports contexts remains uneven across states. In California, the California Consumer Privacy Act now covers workers as of the expiration of the employee exemption on December 31, 2022: since January 2023, California employees benefit from the same rights as consumers under the CCPA. But this protection does not extend to states lacking comparable legislation, where data collected within an employer-employee relationship remains largely without specific protection.

The European Union is further advanced. The GDPR establishes that biometric data is sensitive data requiring explicit consent. But the GDPR applies to European residents, not NFL players. And even in Europe, its practical application to data collected in professional sports contexts remains an open undertaking.

This gap between European regulation and the lacunose American framework actually creates a geographic asymmetry in negotiations: a European player coming to play in the NBA enters a regulatory environment radically less protective of his bodily data than the one he left.

The Precedent of Genetic Data

A useful precedent exists. In 2008, the United States adopted the Genetic Information Nondiscrimination Act (GINA), which prohibits employers from using genetic data to make hiring or compensation decisions. The law arose from a simple concern: as genetic testing became more widespread, nothing prevented an employer from refusing to hire someone whose genome revealed a predisposition to a particular disease.

The logic is identical for athletes’ biometric data. The data reveals information about the worker’s body. This information can be turned against him. And if nothing is done, career decisions will increasingly be informed by predictive algorithms to which the worker in question has no access.

GINA is not a perfect model—its application is limited and its exceptions numerous. But it demonstrates that sectoral regulation is possible, that it can pass through Congress, and that it has not killed the industry it regulates. Professional sports clubs did not start avoiding genetic testing because GINA prohibited them in employment decisions: they simply adapted their practices to a clear rule.

This is precisely the kind of clear rule that is lacking today for biometric data. And the cost of this absence is borne not only by professional athletes.

Sport as Laboratory Before the Factory

Professional sports is ahead of the rest of the labor economy, not because it is exceptional, but because it is concentrated, visible, and lucrative. What happens there with athletes’ biometric data arrives in other sectors with a few years’ lag.

Work-load tracking sensors, heart rate bands, physiological stress monitoring systems already exist in Amazon warehouses, in certain automotive production lines, in logistics centers in South and Southeast Asia. These devices are presented as tools for preventing injuries and optimizing working conditions—and they can genuinely serve that purpose. But they also collect, in the same motion, data that can inform human resources management decisions.

The question posed by the legal void in American sports is therefore broader: in an increasingly instrumented labor economy, who decides the conditions under which workers’ bodily data are collected, stored, analyzed, and used for decisions affecting their employment and income?

The market’s answer, in the absence of rules, is constant: whoever controls the infrastructure decides. This is not a fatality. It is a political choice that institutions have, so far, avoided making.

The unions of the major American leagues have demonstrated, on other issues, their capacity to negotiate substantial protections. The limit with biometric data is that the subject is technically complex, that its most harmful effects touch end-of-career players rather than stars in their prime, and that the leagues have a direct interest in maintaining ambiguity.

The next round of collective bargaining—the NFL collective bargaining agreement expires in 2031, the NBA’s in 2029-2030—offers a window. It will be preceded by regulatory developments that several American states (California foremost) are considering on health data collected in professional contexts. The question is not whether these rules will come. It is whether athletes, their unions, and legislators will have framed the subject before practice renders regulation obsolete before it is even adopted.

Sources

  1. Frontiers in Sports and Active Living—study on the ownership of biometric data in American professional sports (December 2025): https://www.frontiersin.org/journals/sports-and-active-living/articles/10.3389/fspor.2025.1742484/full
  2. Genetic Information Nondiscrimination Act (GINA, 2008)—Equal Employment Opportunity Commission: https://www.eeoc.gov/laws/statutes/gina.cfm
  3. Power and Progress, Daron Acemoglu and Simon Johnson—book review, Journal d’un Progressiste: https://journaldunprogressiste.fr/fiche-de-lecture-power-and-progress-dacemoglu-et-johnson-la-technologie-ne-profite-pas-a-tous-sauf-quand-on-la-force-a-le-faire/
  4. California Consumer Privacy Act (CCPA)—California Attorney General: https://oag.ca.gov/privacy/ccpa
  5. General Data Protection Regulation (GDPR)—official text, EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
  6. NBA CBA 2017 on wearables—Vice Sports / Sports Illustrated: https://www.vice.com/en/article/8qy5eg/the-new-nba-cba-addresses-wearable-technology-but-what-does-that-mean
  7. NFLPA—duration of NFL CBA (expires March 2031): https://nflpa.com/faq/how-long-does-the-current-cba-go
  8. NBPA—NBA CBA through 2029-30 season: https://nbpa.com/cba
  9. EEOC—discrimination on genetic information (GINA 2008): https://www.eeoc.gov/genetic-information-discrimination
  10. NFL RFID Zebra Technologies—deployment 2014: https://www.forbes.com/sites/aarontilley/2016/02/06/how-rfid-chips-are-changing-the-nfl/
  11. MLB Statcast—bat tracking: https://www.mlb.com/glossary/statcast
  12. NFLPA BreakAway Data—access for NFL players to their own data: https://nflpa.com/partners/posts/breakaway-data-nflpa-empower-nfl-players-with-their-own-athlete-data