Who Owns an Athlete’s Biometric Data?: The Emerging IP and Data Rights Crisis in Professional Sport
ABSTRACT
Athlete biometric data is encompassing heart rate variability, GPS movement, fatigue indices, and sleep metrics. It is now one of professional sport’s most commercially valuable assets. Yet the law has not determined who owns it. Existing IP frameworks cover inventions, creative works, and brand identifiers, but have no category for the raw physiological output of a human body. This blog examines the three-way ownership contest between athletes, franchises, and technology providers. Analyses landmark precedents including Baltimore Orioles v. MLB Players Association (1986), surveys the NFL, NBA, and GDPR frameworks and evaluates India’s emerging response through the Digital Personal Data Protection Act, 2023, and the National Sports Governance Act, 2025, identifying the legislative gaps that urgently remain.
INTRODUCTION
During the 2019 IPL season, each ball delivered, each run scored, was fed into data analytics platform powered by AIs. Streams of data streamed out, allowing teams to predict bounce patterns, sort out batsmen in line, construct specialized game plans. GPS devices tracked movements. Wearables quantified heart rate variability, fatigue levels and sleeping hours.
Under the current legal framework, that data-though generated by the athlete’s very body-isn’t even his to begin with. His contract with the team or the league does not allow for such usage nor is there any Indian law protecting such ownership. That “dead space,” lying at the intersection of advanced science and legal apathy is currently forming one of the most compelling debates in sports IP.
WHAT IS BIOMETRIC DATA IN SPORTS CONTEXT?
It is not only Finger-prints or Eye-biometrics, sport bio-metrics are so diverse that they cover heart rate-variability (HRV), fatigues parameters (e.g., central fatigue) and sleep parameters. Movement’s quality and efficiency, GPS data on speed and accelerations (e.g., max speed, average speed, acceleration values), shooting profiles (e.g. On a soccer ball, or a 10m air rifle shot), even mental states assessed by apps used during camps . Wearable devices, smart clothing and AI based sensors have resulted in ‘constant biometric and tactical streams of data,’ that is readily consumed for sport analytics, injury mitigation and sports entertaining.
This refers to a study published in Frontiers in Sports and Active Living (December 2025) whose authors warn: although the information comes from a human being’s body “the ownership and legal protection of such personal health-based information is very unclear.”
There’s also money to be made: Fantasy Sports, Online Betting platforms, marketing managers of sponsor teams, broadcasting producers and injury insurers are keenly interested. These data are also intimate, at times even more so than an average is (which even a spectator can see). The chronic fatigue of a bowler, a hitter’s panic while being at the plate with 2 strikes. This data can show the inner physiological and even mental states of an athlete.
THREE WAY OWNERSHIP DISPUTE
When a wearable device on a cricketer’s wrist generates performance data during an IPL match, at least three parties can claim a stake: the athlete whose body produced it, the franchise whose infrastructure enabled its collection, and the technology provider whose algorithm processed it. Leagues have historically leveraged their status as employers to claim control. The precedent runs deep: in Baltimore Orioles, Inc. v. Major League Baseball Players Association (7th Cir., 1986), the court held that clubs owned copyright in televised game performances as works made for hire, with that copyright preempting players’ rights of publicity in their own on-field performances — establishing that an athlete’s performance, captured by a third party, can become that third party’s intellectual property.
Biometric data complicates this logic further. Unlike a broadcast, it is not a creative work but a physical trace of a human body, sitting outside the neat categories of patent, copyright, and trademark law. This doctrinal gap makes the field an emerging frontier rather than settled law.
HOW GLOBAL LEGUE ARE NAVIGATING IT
The closest substitute for legislation is a CBA (Collective Bargaining Agreement). The 2020 NFL-NFLPA agreement has CBA Section 55 of it, and mandates player’s consent for the Collection and requires that no secondary uses occur besides for stated and a jointly approved “oversight”. The 2023 CBA between the NBA and NBA Player Association largely mirrored this with players’ have access and the NBA being not allowed to market athletes’ health and training data for commercial purposes without any consent and as back in 2017 the National Basketball Player Association secured rights over athlete’s biometrics information as fundamental CBA elements. CBAs like these are flawed in that they remain within employment and nothing like legislation, but they demonstrate existing framework options in terms of joint stewardship.
The strictest athlete privacy regulations are the GDPR in Europe. Most significantly for athletes in this case, the use of their information cannot be extended to commercial purposes- for example, betting and advertisements – without their new and distinct assent.
INDIAN PROSITION: A FRAMEWORK IN FROMATION
India has two primary pieces of legislation governing data and athlete privacy. Firstly, the Digital Personal Data Protection Act, 2023(DPDP Act) designates athletes as ‘data principals’ and necessitates consent in data collection, as well as purpose limitation-meaning biometric data collected for injury monitoring cannot be later used for fantasy sports without renewed consent. The National Sports Governance Act, 2025, which holds federations liable, is silent on athlete data privacy rights.
Article 21, of the constitution, protected under Justice K.S. Puttaswamy v. Union of India(2017) makes the Right to Privacy a fundamental right. Should federations be determined as ‘State’ under Article 12, such constitutional protections would directly apply to their use of athlete biometric data. However, the core problem with the DPDP Act’s consent mechanism is the inability for consent to be freely given when bundled in a franchise agreement. Franchises possess the leverage to decide a player’s selection, salary, and career trajectory; hence, players cannot effectively refuse consent to biometric data provisions, this resembles economic duress. The DPDP Act offers no special considerations for sports and, according to an April 2026 LawInSport analysis, very few player contracts drafted under Indian laws factor in such protections.
THE GAP THAT LAW HAS NOT FILLED
Data protection law tells us what consent is required, it does not tell us who owns the underlying data asset. IP law protects inventions, creative works, and brand identifiers; it has no category for the physiological output of a human body collected under a commercial employment contract. The right of publicity, recognised in various forms globally, protects the commercial use of a person’s name, image, and likeness, but courts have not clearly extended this to raw biometric streams. The result is a legal vacuum in which franchises, technology firms, and analytics companies are extracting enormous commercial value from athletes’ bodies with little legal obligation to share that value with the athletes themselves or to seek meaningful consent.
CONCLUSION
The body has always been the athlete’s most fundamental asset. In the age of AI-powered wearables and real-time biometric analytics, it is also a data source of extraordinary commercial value and, currently, very limited legal protection. India’s DPDP Act, 2023 offers a starting point through its consent and purpose-limitation framework, but it does not settle ownership. The NSG Act, 2025 builds institutional accountability but leaves athlete data rights largely unaddressed. What is needed, both in India and globally, is a purpose-built legal instrument: one that treats biometric data as co-owned between the athlete and the collecting entity, requires genuinely informed consent, limits secondary commercial exploitation, and ensures athletes share in the revenue their data generates. Until that instrument exists, the most valuable stats in sport will continue to belong to everyone except the person who produced them.
REFERENCES
Digital Personal Data Protection Act, 2023 (India)
Digital Personal Data Protection Rules, 2025 (notified November 13, 2025)
National Sports Governance Act, 2025 (tabled in Lok Sabha, July 23, 2025)
NFL–NFLPA Collective Bargaining Agreement, 2020, Article 55 (consent and joint oversight provisions)
NBA Collective Bargaining Agreement, 2023 (athlete access rights and commercial use restrictions)
“Lex Ludica and the Indian Athlete: Towards a Constitutional Law of Sport in India,” SCC Online Blog, October 23, 2025
“Next Frontier in Sports: Legal Ramifications of Biometric Data,” National Law Review, September 30, 2025
Baltimore Orioles, Inc. v. Major League Baseball Players Association, 805 F.2d 663 (7th Cir., 1986)
Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1