Can an Algorithm Bench You? The Legal Risks of Athlete Health Data in College Sports

By Tanvi Bollepalli '28

---

College athletes are constantly under a spotlight, on and off the field. Coaches dissect their performance, athletic trainers monitor injuries, and medical professionals determine when they are ready to return to competing. Increasingly, however, another evaluator has entered the picture: technology.

The emergence of new tracking technology like wearables, cameras, and mobile apps has greatly expanded data collection about athletes. Their movements, workload, heart rate, recovery time, and other measures related to their performance can now easily be tracked. Furthermore, according to the NCAA, performance technologies refer to devices that can collect information regarding biometrics or performance of athletes, which include wearable devices, cameras, software, and mobile apps. (1) These technologies provide essential feedback in regard to training and prevention of injuries. However, this raises a complex legal question: How should cases be handled when information obtained from an athlete’s body determines eligibility to compete?

Decisions about playing time can have impacts far beyond one game for college athletes. Their performance has an impact on their scholarships, recruiting opportunities, professional prospects, and future within a program. Relying on biometrics or an algorithmic assessment that may suggest an athlete is fatigued, injury-prone, or not fully recovered can leave the athlete uncertain about how that conclusion was reached or how it will be used. (2)

Performance technology has become the norm in college athletics, but the law has not produced a uniform standard governing this information. Instead, athlete data exists at the crossroads of student privacy law, constitutional protections, state biometric privacy laws, university policies, and NCAA guidance. Universities should be required to explain how they gather and use the data about the athletes, allow the athletes to have access to that data, provide a means to contest the algorithmic assessment, and require human review before such assessments are used to make decisions about athletes’ medical clearance or scholarships.

The attraction of performance technology is easy to understand. Teams have always searched for ways to improve athletic performance while minimizing injuries. Decades ago, biometric and algorithmic data were extremely difficult to obtain. The appeal to coaches and medical professionals comes from the ease of receiving this information. Research has noted that biometric data can help athletic programs and potentially detect trends associated with injury and overtraining. (3)

Simultaneously, the magnitude and sensitivity of information being collected create new concerns. In contrast to a conventional statistic from a game, such as passing yards or shooting percentages, biometric information can reveal details about an athlete's physical condition. Once collected, that information may be stored, analyzed, shared, or interpreted by individuals far beyond the athlete who generated it.

One possible protection is the Family Educational Rights and Privacy Act, commonly known as FERPA. FERPA protects education records directly related to a student and maintained by an educational institution or someone acting on its behalf. (4) Federal regulations also include a "biometric record" within the definition of personally identifiable information associated with education records. (5) In many circumstances, schools must obtain written consent before disclosing personally identifiable information from a student's education records, although FERPA contains several exceptions. (6) One significant limitation with this safeguard is that, according to the U.S. Supreme Court case Gonzaga University v. Doe, students cannot use a § 1983 action to enforce the provisions of FERPA prohibiting the disclosure of educational records. Therefore, the athlete may be unable to sue using FERPA. (7)

However, FERPA does not answer every question involving athlete-generated data. Whether a particular set of performance information qualifies as an education record may depend on how the information is created, maintained, and used. The performance technology can include external vendors that gather or process the information for the athletics department. Therefore, classifying the information as "health information" does not necessarily determine what kinds of protection are needed or to whom this information is made accessible.

At public universities, the Fourth Amendment creates another potential issue. This amendment protects individuals against unreasonable government searches, and public universities are government institutions. According to Alicia Jessop, a legal scholar, there may be Fourth Amendment issues associated with the mandatory collection of biometric data from NCAA players at public universities because of the need for players to wear tracking devices. (8) In Skinner v. Railway Labor Executives’ Association, the Supreme Court held that government-required collection and testing of bodily samples counts as a Fourth Amendment search, but found the testing reasonable in that safety-sensitive setting. (9) Skinner establishes that government-required collection and testing of bodily samples can constitute a Fourth Amendment search even when justified by safety concerns. What remains unresolved is whether monitoring through wearables on the athletes qualifies as a search, and if yes, whether it is a reasonable one. To determine these issues, the content of information gathered, intrusion into the privacy of athletes, and reasonableness of such monitoring must be considered.

That question of consent may be one of the most complicated aspects of athlete tracking.

Consider a scenario where each individual on a college football team is required to wear the monitor during practice. In theory, the athletes can be made aware of the monitor and even get documents to sign to show their awareness. However, an athlete who chooses not to wear it will feel uneasy because he or she might want to avoid looking like an uncooperative player or missing out on game time. (10) Under the Fourth Amendment, consent to a search must be voluntary based on all the circumstances, not just a signature on a form. If refusing the device could cost an athlete playing time or a place on the team, that pressure could weigh against finding the consent voluntary. A court would still need to consider the actual consequences of refusing; team requirements alone do not automatically make consent invalid.

The NCAA’s most recent guidance appears to recognize this problem. In March 2026, the NCAA released recommendations regarding the responsible use of performance technologies in collegiate athletics. The recommendations specifically identify student-athlete rights and protections, including informed consent, as subjects schools should address when educating people who use performance technology. (11) The guidance also recommends that schools determine who owns performance-technology data, where it is stored, who may access it, and how it may be used. (12)

The NCAA guidance is framed as recommendations for responsible use instead of a comprehensive federal privacy statute. This leaves a considerable amount of responsibility in the hands of universities to establish their own policies.

The legal landscape gets even more complicated when state law is considered as well. Several states regulate certain forms of biometric information, but the scope of these statutes varies significantly between states. For example, the Biometric Information Privacy Act of Illinois obligates private entities that own covered biometric data to disclose their policies on retention and destruction of the information. The statute does not include state or local governmental bodies as “private entities.” This implies the requirement does not directly apply to an Illinois public university, but the private technology firm that owns the information may qualify. The act obligates private entities in possession of covered biometric information to have policies for retention and destruction of the information. (13) Yet biometric privacy statutes were not built for the use of monitoring college athletics, and their definitions do not necessarily encompass every form of physiological or performance information collected by modern sports technology.

Consequently, two athletes who produce similar data could potentially receive different legal protections depending on what type of information is collected, who collects it, and where the university is located. The missing protection is a consistent rule requiring every athletic program to tell athletes how their data will be used, let them access and challenge it, and limit its use in consequential decisions, regardless of whether a public university or a private vendor collects it.

The privacy problem becomes even more prevalent when athletic departments move from merely collecting information to using algorithms to interpret it.

The software analyzes data from an athlete’s wearable device and estimates that athlete’s injury risk. Afterward, the coach can consider this analysis another useful piece of information in deciding whether or not the athlete should train or play in competitions. What if the algorithm turns out to be wrong? The athlete can request that the information in their educational records be corrected, but according to FERPA, they cannot overrule a coach’s decision or assessment. There might be an appeal process in place in case of scholarship cuts, and medical clearance should stay in the hands of athletic healthcare practitioners. However, none of these safeguards guarantees athletes access to the algorithm’s logic. (14)

Performance technologies are not necessarily perfect. The NCAA recommends that schools should prioritize evaluating technologies for factors such as accuracy, reliability, validity, and function before implementing them. (15) An algorithmic prediction is therefore not the same thing as a medical diagnosis.

This distinction becomes particularly important when medical clearance is involved. The NCAA recommends that medical professionals be involved in medical decision-making when using performance data. The guidelines further state that there should be respect for the autonomy of the medical practitioners in charge of primary athletic healthcare. (16) In essence, performance technology may be used as a means to assist healthcare professionals in their work, but it should never replace the personal medical opinion of a practitioner.

This ambiguity grows even greater when these decisions occur outside the strictly medical context. For instance, the coaching staff might use performance statistics in order to make decisions regarding playing time, roster composition, training workloads, or recruitment. The NCAA has established autonomy of medical judgment for medical decision-making and return-to-play considerations. (17) It is not clear whether a similar control system is exercised when coaches use algorithms to decide on playing time or team rosters. The athlete may not have any means through which they can view or dispute such risk scores before the coach employs them in decision-making.

In such a scenario, there exists the possibility that information gathered for the safety of the athlete would be used for an entirely new purpose. Researchers have warned about the possibilities of privacy, exploitation, revelation, and even commodification of the athlete's biometric information. (18) 

Other legal scholars have questioned who should ultimately own athlete biometric data when teams, leagues, universities, technology companies, and athletes may all have competing interests in the same information. (19)

The difference between collecting data to help an athlete and collecting data to evaluate an athlete is significant.

When a university tells an athlete that wearing the technology is going to help in avoiding injuries, one can interpret this as the data being used for health and athletic reasons only. This interpretation would change when the information starts influencing the decisions on the player's game time, scholarship, or recruiting prospects.

However, the utilization of performance technologies in sports does not automatically render them invalid. Many benefits can be derived from their implementation. More accurate information can help coaches manage training loads, allow medical practitioners to detect concerning patterns, and reduce preventable injuries in the process. A blanket ban on biometric monitoring could prevent athletic programs from using beneficial technologies.

The NCAA should turn its performance-technology recommendations into binding membership rules. Compliance needs to be a condition of NCAA membership, with schools required to document their compliance annually and face sanctions if they fail to correct violations. Enforcing these protections provides schools with a clear incentive to safeguard athletes’ data and provides accountability if they fail to do so. Schools would then have to explain data collection and use, give athletes access to their data, and include the same protections in contracts with technology vendors. The current NCAA guidance is advisory; this proposal would make those safeguards a condition of membership. (20)

Universities should be required to provide athletes with a clear explanation about what kind of information is being collected, the purpose of collecting such information, how long the information will be retained, and who has access to that data. Universities also need to be held accountable for distinguishing data collected for any medical purpose and data collected for coaching or evaluation. It is also important to ensure that athletes have access to their own data and an opportunity to challenge algorithmic assessments.

Most importantly, universities must be responsible for limiting the extent to which automated assessments determine important decisions for the athlete. In the case that an algorithm identifies an increased risk of injury for an athlete, then it would certainly merit attention. Important decisions regarding medical clearances and scholarship offers should not solely depend on an automated test that an athlete cannot understand.

Interestingly, the NCAA’s current recommendations already move in this direction by encouraging schools to establish written performance-technology plans, clarify data ownership and access, educate athletes about privacy and informed consent, and obtain athlete feedback about how these technologies are affecting them. (21) These recommendations acknowledge that responsible use of performance technology requires more than simply purchasing an accurate device.

Performance technologies can enhance the safety of college sports. However, athletes should have meaningful notice and consent regarding how their information may be used to shape their athletic futures. The NCAA must mandate that member schools inform athletes about how their data will be used, provide athletes with access to their data, and provide a process for challenging algorithmic assessments before they are used to make major decisions about their athletic careers. By requiring transparency and a fair chance to challenge assessments, this proposal would allow for the pursuit of a safer and more efficient training process while ensuring that athletes are involved in the decision-making process.

Endnotes

1. National Collegiate Athletic Association, Performance Technologies Recommendations: Responsible Use in Collegiate Athletics (2026), https://www.ncaa.org/what-we-do/health-safety-and-performance/performance-technologies-guidelines/.

2. Chelsea Rush and Barbara Osborne, “Benefits and Concerns Abound, Regulations Lack in Collegiate Athlete Biometric Data Collection,” Journal of Legal Aspects of Sport 32, no. 1 (2022): 62–94, https://journals.indianapolis.iu.edu/index.php/jlas/article/download/25479/24183/49095.

3. Rush and Osborne, “Benefits and Concerns Abound,” 62–94.

4. 34 C.F.R. § 99.3 (definition of “education records”).

5. 34 C.F.R. § 99.3 (definition of “personally identifiable information”).

6. 34 C.F.R. § 99.30.

7. Gonzaga University v. Doe, 536 U.S. 273, 287–90 (2002).

8. Alicia Jessop, “Examining the Fourth Amendment and Biometric Data Privacy Law Implications of NCAA Athletes’ Mandated Use of Athlete Biometric Data Tracking Devices,” Cardozo Arts & Entertainment Law Journal 40 (2022): 81, https://larc.cardozo.yu.edu/cardozoaelj/vol40/iss1/5/.

9. Skinner v. Railway Labor Executives’ Association, 489 U.S. 602, 616–20 (1989).

10. Schneckloth v. Bustamonte, 412 U.S. 218, 226–27 (1973).

11. National Collegiate Athletic Association, Performance Technologies Recommendations, recommendation 2.

12. National Collegiate Athletic Association, Performance Technologies Recommendations, recommendation 3.

13. Illinois Biometric Information Privacy Act, 740 Ill. Comp. Stat. 14/10, 14/15(a).

14. 34 C.F.R. §§ 99.20–99.22; National Collegiate Athletic Association, “Student-Athlete Core Guarantees,” accessed October 6, 2026, https://www.ncaa.org/student-athletes/student-athlete-experience/core-guarantees/; National Collegiate Athletic Association, “Key Publications,” accessed October 6, 2026, https://www.ncaa.org/what-we-do/health-safety-and-performance/key-publications/.

15. National Collegiate Athletic Association, Performance Technologies Recommendations, recommendation 4.

16. National Collegiate Athletic Association, Performance Technologies Recommendations, strategy 3.3.

17. National Collegiate Athletic Association, “Key Publications,” accessed October 6, 2026, https://www.ncaa.org/what-we-do/health-safety-and-performance/key-publications/.

18. Jason F. Arnold and Robert M. Sade, “Wearable Technologies in Collegiate Sports: The Ethics of Collecting Biometric Data from Student-Athletes,” American Journal of Bioethics 17, no. 1 (2017): 67–70, https://doi.org/10.1080/15265161.2016.1251648.

19. John T. Holden and Kimberly A. Houser, “Taboo Transactions: Selling Athlete Biometric Data,” Florida State University Law Review 49 (2021): 103, https://ir.law.fsu.edu/lr/vol49/iss1/3/; Jack Vande Berg, “The Game-Changer: Legal Issues Surrounding Wearable Technology in Sports,” SMU Science and Technology Law Review 27 (2024): 151, https://scholar.smu.edu/scitech/vol27/iss1/9/.

20. National Collegiate Athletic Association, “Performance Technologies Guidelines,” accessed October 6, 2026, https://www.ncaa.org/what-we-do/health-safety-and-performance/performance-technologies-guidelines/; National Collegiate Athletic Association, “NCAA Membership Attestation Requirements,” accessed October 6, 2026, https://www.ncaa.org/governance/legislation-policy/membership-attestation-requirements/.

21. National Collegiate Athletic Association, Performance Technologies Recommendations, recommendations 1–5.