Profiting from Student-Athletes' Biometric Data and the Legal Landscape

Athlete biometric data refers to an athlete's physical or physiological characteristics, such as heart rate, body temperature, or sleep patterns. The aggregation and measurements of athlete biometric data can be extremely valuable for various purposes, including improving an athlete's performance and detecting oncoming injuries. Wearable technologies provide valuable insights to student-athletes and coaches, who can track student-athlete performance through smartwatches, sensors, and other equipment.

This specific data collection also has immense commercial value for sports leagues, teams, and athletes. However, commercializing athlete biometric data raises legal issues that could lead to litigation and fines, including data breaches, notice and consent requirements, and opt out rights. College sports present unique issues in this space due to the development of Name, Image, and Likeness (NIL) laws across the country. Because athlete biometric data is considered a unique identifier and part of an individual's likeness, student-athletes could be financially compensated for the licensing or sale of their biometric data. The NCAA has decided that it is not a violation of policy for conferences and schools to sell player data to sports betting operators if that data is also available to the general public. However, the NCAA has not yet set a policy regarding the sale or licensing of athlete biometric data that is not available to the public.

Similar to NIL legislation, the lack of a comprehensive federal data privacy or biometric law has led several states, including Illinois, Texas, and Washington, to pass laws that specifically regulate biometric data collection. Other states, such as California, Colorado, Connecticut, Virginia, and Utah, have passed data privacy laws that categorize biometric data as sensitive personal information. Because biometric data is widely considered sensitive data, some states have specific notice, consent, and opt out requirements for when an individual's biometric data is used for commercial purposes.

For example, in 2018, Illinois passed the Biometric Information Privacy Act ("BIPA"), arguably the most stringent biometric data law in the United States. Under the law, a private entity collecting biometric data must provide notice and obtain informed written consent. Most notably, BIPA prohibits a private entity from selling, leasing, trading, or otherwise profiting from an individual's biometric data. Under California law, the California Privacy Rights Act (CPRA) and California Consumer Privacy Act (CCPA) regulate the collection, use, and storage of personal information, including biometric data. The CPRA, which recently went into effect on January 1, 2023, expands upon the CCPA, which was enacted in 2018. While businesses may collect or process biometric data for the purpose of “inferring characteristics” about a California resident to provide goods or services requested by a California resident, California law requires companies to obtain consent before collecting personal information and provide data subject rights to individuals. These rights include but are not limited to the right to know what personal information is being collected, the right to limit and delete personal information, and the right to opt out of the sale of personal information.

The commercialization of student-athlete biometric data in college sports is likely to advance rapidly in the coming years. As data privacy, biometric data, and NIL laws develop nationwide, stakeholders considering collecting and profiting off student-athlete biometric data should evaluate: (1) how to comply with state laws that regulate the collection of biometric data, and (2) how to comply with NIL laws to ensure student-athletes are compensated for the commercialization of student-athlete biometric data relating to their name, image, and likeness.