The Wearable Wild West: Assessing the Legal Risks and Protections for Athlete Biometric Data

The wearable technology industry and collection of biometric data have taken the sports world by storm. In collegiate athletics, approximately 80 percent of athletes report that their sports team utilizes some form of athlete biometric data tracking.¹ In professional sports, organizations have used this technology, commonly referred to as “wearables”, for years to gain a competitive advantage for their athletes.² For example, Major League Baseball (MLB) has approved an arm sleeve to track the stress on pitchers’ arms and another to track heart rate, skin temperature, and sleep cycle, while the National Football League (NFL) uses microchips in players’ jerseys to collect similar biometric data.³ The National Football League Players Association (NFLPA) has even partnered with the company WHOOP, the creators of a wearable biometrics tracker.⁴ Data about an athlete’s body, time, and activity, at both the collegiate and professional levels, are increasingly being collected and stored by teams, leagues, and third-party vendors.⁵ Despite the benefits that wearables provide in athlete health, development, and performance, the current legal framework at the intersection of contract, privacy, and employment law is fragmented and provides limited protections for athletes and their biometric data.  

Biometrics can be defined as “the measurement and analysis of unique physical or behavioral characteristics.”⁶ Wearables can monitor and collect biometric data through “measurements of brain and heart function, calorie intake, blood oxygen, sugar levels, ergonomic issues, distance and routes traveled, fatigue, and more.”⁷ Teams use biometric data for various reasons: “monitoring players’ health, wellness, and performance; establishing baselines, performing diagnostics, understanding player load, educating coaches (and players) on the effects of training on players; and designing appropriate training and recovery regimens.”⁸ Essentially, biometric data is collected and valued for its ability to optimize player performance and development, mitigate injury risk, and monitor existing injuries.⁹ While the benefits of using this technology are clear, there are inherent risks associated with collecting data of an intimate and sensitive nature at all times, even outside the scope of the sport activities, and which is managed and stored in the hands of third-party vendors.¹⁰ 

Currently, there is no comprehensive legal framework at the federal level to regulate biometric data privacy.¹¹ The Federal Trade Commission has warned that the misuse of biometric data may violate Section 5 of the FTC Act as an unfair or deceptive business practice, but the lengthy analysis under the FTC Act is far from an intensive legal framework encompassing the entirety of the risk inherent to biometric data collection.¹² The Health Insurance Portability and Accountability Act (HIPAA) may apply when biometric data is connected to medical services, but the companies that produce wearables are generally not a covered entity under HIPAA, meaning they need not comply with HIPAA regulations to protect patient privacy and security.¹³  

As of 2019, only three states, Illinois, Texas, and Washington, had implemented laws specifically to regulate the collection and retention of biometric data.¹⁴ Since then, a handful of other states have enacted certain privacy protections.¹⁵ Even so, the patchwork provided by state statutes is insufficient to address this national legal issues and provide the broader protections that athletes need. For example, Illinois’ Biometric Information Privacy Act (BIPA) is strong but narrowly defines a “biometric identifier” as “limited to retina or iris scans, fingerprints, voiceprints, and hand or face geometry.”¹⁶ Consequently, most wearable devices that track and collect what is normally considered to be biometric data do not apply under BIPA.¹⁷ Sparse and scattered state laws do not provide the necessary protections concerning the collection and retention of biometric data. Rather, it is an inadequate attempt to remedy issues that call for federal regulation as the proper and desperately needed solution.   

Wearables and the tracking of biometric data in sports are here to stay and are taking sports to new heights, but the legal protections lag behind. Athletes at both the collegiate and professional levels are highly susceptible to exploitation unless some proactive steps are taken. Lawmakers at the federal level should promptly implement federal regulations to protect athletes and their biometric data rather than wait for a data breach or unfair employment outcome to harm these athletes. Without uniform federal regulation, many legal questions surrounding the collection and use of biometric data arise. This leaves athletes, teams, and third-party vendors wondering about the consent and voluntariness of athletes' participation in biometric data collection, who owns and controls the data, and the data security and third-party access.¹⁸  

Sources:

[1] Karson Taylor, NCAA Athletes’ Right to Privacy in the Digital Age, 54 The Reg. Rev. (Aug. 12, 2025), https://www.theregreview.org/2025/08/12/taylor-ncaa-athletes-right-to-privacy-in-the-digital-age/.

[2], [3], [4], [6], [8], [9] Ayisha McHugh, On Federalism and Biometrics: The Balance of Privacy and Proprietary Rights Following Murphy v. National Collegiate Athletic Association, Columbia J. Transnat’l L. Blog (Mar. 11 2020), https://www.jtl.columbia.edu/bulletin-blog/on-federalism-and-biometrics-the-balance-of-privacy-and-proprietary-rights-following-murphy-v-national-collegiate-athletic-association-ncaa. 

[5] Anna Smith, Privacy and Biometric Data: Legal Concerns with Wearable Sports Tech, Digital Age Lawyers Blog (Nov. 8, 2024), https://digitalagelawyers.com/privacy-and-biometric-data-legal-concerns-with-wearable-sports-tech/. 

[7] Tristan A. Dietrick, Biometric Monitoring Devices: Modern Solutions to Protecting Athletes’ Data Privacy, 21 Pitt. J. Tech. L. & Pol’y 61 (2021), https://doi.org/10.5195/tlp.2021.245. 

[10] Jennifer Park, Biometric Data Collection in Professional Sports Reveals Holes in Privacy Law, The Columbia J. L. & the Arts (Feb. 17, 2024), https://journals.library.columbia.edu/index.php/lawandarts/announcement/view/685; Anna Smith, Privacy and Biometric Data: Legal Concerns with Wearable Sports Tech, Digital Age Lawyers Blog (Nov. 8, 2024), https://digitalagelawyers.com/privacy-and-biometric-data-legal-concerns-with-wearable-sports-tech/. 

[11] Courtland Cuevas, The Next Frontier in Sports: Legal Ramifications of Biometric Data and Virtual Reality Innovation, Proskauer “Minding Your Business” (Sept. 30, 2025), https://www.mondaq.com/unitedstates/new-technology/1686414/the-next-frontier-in-sports-legal-ramifications-of-biometric-data-and-virtual-reality-innovation; Kate Donovan, Wearable Technology in College Athletics Creates Potential Privacy Violations with the Distribution of Student-Athlete Biometric Data, J. High Tech. L. Blog (Oct. 25, 2023), https://sites.suffolk.edu/jhtl/2023/10/25/wearable-technology-in-college-athletics-creates-potential-privacy-violations-with-the-distribution-of-student-athlete-biometric-data/.  

[12] Christopher S. Finnerty, Morgan T. Nickerson & Kelly E. Bungard, FTC to Scrutinize Commercial Use of Biometric Information Moving Forward, K&L Gates U.S. Policy & Regulatory Alert (June 2, 2023), https://www.klgates.com/FTCtoScrutinizeCommercialUseofBiometricInformationMovingForward622023. 

[13] Courtland Cuevas, The Next Frontier in Sports: Legal Ramifications of Biometric Data and Virtual Reality Innovation, Proskauer “Minding Your Business” (Sept. 30, 2025), https://www.mondaq.com/unitedstates/new-technology/1686414/the-next-frontier-in-sports-legal-ramifications-of-biometric-data-and-virtual-reality-innovation; Kayla Rohrer, Understanding Covered Entities Under HIPAA: A Complete Guide, Healthcare Compliance Pros Blog (Aug., 2025), https://www.healthcarecompliancepros.com/blog/understanding-coveredentitiesunderhipaaacompleteguide. 

[14], [16], [17] Melinda B. McLellan, Ronald B. Gaither, Elizabeth G. McCurrach & Robyn M. Feldstein, Wearables in Sports: Who Are You Betting On?, 35 Entertain. & Sports Lawyer 3 (Fall 2019), https://www.americanbar.org/content/dam/aba/publications/entertainment_sports_lawyer/Fall2019/esl_35_2.pdf.  

[15] Sabrina Janeiro, Cathy Mulrow Peattie & Jason J. Oliveri, July 2025 Privacy Compliance Countdown: Key Deadlines for Five State Privacy Laws and DOJ’s Bulk Sensitive Data Rule, Hinshaw & Culbertson LLP Privacy, (Jul. 8, 2025), https://www.hinshawlaw.com/newsroomupdates/pcadjuly2025stateprivacylawcompliancedojbulksensitivedata-rule.html; Kate Donovan, Wearable Technology in College Athletics Creates Potential Privacy Violations with the Distribution of StudentAthlete Biometric Data, J. High Tech. L. Blog (Oct. 25, 2023), https://sites.suffolk.edu/jhtl/2023/10/25/wearabletechnologyincollegeathleticscreatespotentialprivacyviolationswiththedistributionofstudentathletebiometric-data/. 

[18] Karson Taylor, NCAA Athletes’ Right to Privacy in the Digital Age, The Regulatory Review (Aug. 12, 2025), https://www.theregreview.org/2025/08/12/taylorncaaathletesrighttoprivacyinthedigitalage/; Nick Busca, As biometrics boom, who owns athletes’ health data?, The Washington Post (Feb. 2, 2021), https://www.washingtonpost.com/sports/2021/02/02/athletesbiometricsdataprivacy/.