The Wire
NCAA’s New Rules for Athlete Wearable Data Privacy
14 November 2026
How the NCAA frames wearables and biometric tools
The NCAA does not tell member schools to stop using performance technology. It tells them to write down how they will use it. The association recommends that every school establish a written plan for the responsible use of performance technologies, covering the heart-rate straps, GPS vests, sleep trackers and similar devices that now sit in many athletic departments. The NCAA says these tools require balancing innovation with student-athlete well-being, and it names privacy, mental health, informed consent and data concerns as the pressure points.
The guidance has a longer history than the current attention suggests. According to the NCAA Sport Science Institute’s recommendations, the NCAA Committee on Competitive Safeguards and Medical Aspects of Sports has given member schools health and safety considerations for performance technologies since 2014. In May 2025 the Sport Science Institute hosted the NCAA Summit on Performance Technologies in Collegiate Athletics, with the aim of producing evidence- and consensus-based recommendations. The result is a framework that treats a wearable as a health and governance matter, not only a coaching tool.
Selection is where the framework starts. The NCAA says schools should use a structured process to select and implement new technologies, and that the process should assess accuracy, reliability, validity and function. Marketing claims and dashboard polish do not substitute for that testing. Just as general digital directories like https://onlinebasketballbetting.net/ illustrate how niche sports portals organize their information, an athletic department weighing a monitoring vendor has a distinct set of technical standards to evaluate. The priority remains whether the device measures what it says it measures, and whether anyone has checked.
People are the second half of the framework. The NCAA recommends annual education for anyone involved in selecting, using or accessing data from performance technologies. That reaches beyond sports scientists to coaches, athletic trainers and administrators who may see a dashboard, and the annual cadence matters because products, vendors and state laws change faster than a one-time orientation can cover. A school that trained its staff once in 2022 would not meet the spirit of that recommendation.
Where athlete biometric data is protected today
Whether a student-athlete’s wearable data is legally protected depends heavily on who issued the device. A Duke University law blog post on athletic wearables and the limits of consent explains that school-issued wearable data may become part of a FERPA-protected education record, which would bring federal student-records rules into play. Data from a personal wearable may instead be governed by the device company’s privacy policy and applicable state law. Two athletes on the same roster, one wearing a team-issued tracker and one wearing a personal watch, can therefore sit under different legal regimes.
That split produces a patchwork. Rather than one federal law aimed at athlete biometrics, the protections described in the legal commentary come in pieces: federal education-records rules for some school-held data, state biometric statutes for some collection practices, and private contracts for data that passes through a consumer app. Legal scholarship published in the Journal of Legal Aspects of Sports identifies Illinois, Texas and Washington as the three states that have enacted biometric-data statutes. Athletes in the rest of the country cannot point to a comparable statute.
For schools, the practical difficulty is classification. A single data stream can be a training metric, a medical indicator and a biometric identifier at once, depending on how it is collected and stored. An athletic department that files everything under “sports performance” may be missing the legal category that actually applies. Compliance officers and counsel are better placed to make that call than the performance staff who bought the equipment.
Consent, access and limits on use
Consent is the NCAA’s stated concern, and the Duke post’s focus on the limits of consent explains why it is hard to get right. A student-athlete asked to sign a wearable-use form by the staff who control playing time is not in the position of an ordinary consumer clicking through terms. The NCAA lists informed consent among the issues schools must weigh, which suggests a signature alone does not settle the matter. Athletes need to know what is collected, who sees it and what happens to it.
On those last questions the NCAA is more specific. It recommends that schools determine who owns performance-technology data, where it is stored, who may access it and how it may be used. Each of those four questions can be answered badly by default. If the vendor holds the data on its own servers under its own terms, the school may not be able to say where the information sits or who at the company can view it. If access is open to every coach on a staff, an athlete’s sleep or recovery numbers can travel further than the athlete expects.
Legal scholarship adds a rule from inside college athletics. A legal article on NCAA athlete biometric tracking, published in the SMU Science & Technology Law Review in 2025, says real-time data analytics are prohibited, while athletes may use wearables in games. That distinction shows the limits on use are not only about privacy. A device can be permitted on an athlete’s body while the instant analysis of what it records is not.
A common mistake follows from this: treating permission to wear a device as permission to use everything it produces. The NCAA’s recommended written plan is the natural place to draw those lines, spelling out what staff may do with data, what they may not, and who answers for it when a question arises.
State-by-state rules shape what schools can collect and share
Because no single federal statute governs athlete biometrics, state law supplies much of the compliance map. The scholarship cited above identifies three states with enacted biometric-data statutes, and they differ in how they are enforced. The table below sets out what is known and what a school should verify.
| State | Biometric rule | Enforcement point for schools |
|---|---|---|
| Illinois | Biometric Information Privacy Act | Allows private actions and statutory damages for violations |
| Texas | Biometric-data statute enacted | Confirm statute text and enforcement route with counsel |
| Washington | Biometric-data statute enacted | Confirm statute text and enforcement route with counsel |
Illinois stands out. A Brooklyn Law School sports law blog post notes that the state’s Biometric Information Privacy Act allows private actions and statutory damages for violations. That means an individual can sue directly, not just wait for a regulator to act, and statutory damages mean a plaintiff does not have to prove a particular dollar loss. For a school or vendor, the exposure from a collection practice that falls short is different in kind from a compliance finding.
The patchwork also creates a quieter problem for athletic departments. Teams recruit from many states, travel to many more, and often use a vendor whose platform is built for national customers. A policy written for the strictest state may be the only workable standard for a department that does not want separate rules for separate athletes. A policy written for the most lenient will not hold up if a student-athlete, a roster or a vendor is tied to one of the states with a statute.
Schools in states without a biometric statute should not read that absence as a green light. The FERPA question from the Duke post and the NCAA’s recommendations on ownership, storage and access apply wherever the school is located. The three state laws set a floor in some places, not a ceiling anywhere.
Why this matters for college sports governance after House v. NCAA
College athletics is changing its structure, and the House v. NCAA era has put governance questions at the center of how schools run their programs. Biometric data is one of the quieter items on that list. The facts here point to a gap between the pace of the technology and the protections around it, and schools are expected to fill that gap with their own documents.
Part of the reason is who is not at the table. Legal scholarship says collegiate athletes are not covered by a players’ association or a collective bargaining agreement, unlike athletes in professional leagues. In professional sports, data use in wearables is a subject that can be negotiated by a union. A college athlete has no equivalent channel to bargain over what is collected, how long it is held or who can see it. The individual athlete’s protection comes from the school’s policy, the vendor’s contract and whatever state or federal law applies.
The NCAA’s own materials are guidance rather than binding rules, which places more weight on each school’s written plan. That plan is likely to be the first document examined if an athlete complains about how data was handled. The documents that would help a school defend itself are the ones the NCAA is already recommending: a written plan, a structured selection process with testing for accuracy, reliability, validity and function, annual education for staff, and clear answers on ownership, storage, access and use.
For an athletic director or compliance officer, the next step is concrete. Inventory every device and platform that touches athlete data, sort them into school-issued and personal, and check each against the state statutes that could apply. Then put the answers in the written plan before the next vendor demonstration, not after.
