No Pain, No Privacy: Athletic Wearables and the Limits of Consent

College athletes have long been measured by physical attributes and performance markers, like height, weight, mile times, vertical jumps, and body fat. Wearables offered something new: a glimpse into metrics not immediately apparent to the human eye. A watch, ring, band, patch, or sensor under a jersey can now collect heart-rate variability, respiratory rate, skin temperature, blood oxygen levels, movement, location, and other biometric signals. Software then converts those signals into estimates of sleep, stress, fatigue, workload, and readiness. Cameras, force plates, nutrition apps, and body-composition tests, including BOD POD and DXA assessments, add more detail to the record of an athlete’s body.

In an October 2025 NCAA Survey of nearly 6,800 Division I athletes from 153 schools, more than 60% of respondents reported using performance technology. Among users, 48% reported using it outside athletic-related activity. Though this is not a nationally representative survey, with an estimated 12% response rate, it does show how deeply these tools have entered athletes’ routines.

That integration can be enormously useful. Performance data can help coaches manage workload, medical staff identify patterns associated with injury risk and tailor training, and athletes understand their bodies with greater precision. For a pitcher, a workload monitor, like Pulse Throw, may flag elevated arm stress before a coach or trainer can see warning signs, just as pitch count limits aim to prevent overuse injuries, but with more individualized data. However, the same information that can help athletes train smarter can also expose parts of their lives and bodies they never meant to share. That raises a consequential question: when the athlete’s body becomes a source of constant data, who controls that data and how is it used? 

Social and Interpersonal Dynamics of Monitoring

The privacy risk is not simply that wearable data is personal. It is that analytics, including AI-enabled models, can combine data points and generate inferences an athlete never intended to reveal. Researchers have described data that can be used to infer mental states, including non-neural physiological and behavioral signals, as “cognitive biometrics.” In college athletics, the same privacy problem can arise in more familiar forms. A sleep score collected for recovery can reveal late-night activity. GPS data collected to measure movement can show where an athlete goes after practice. Body-composition data collected to tailor training can become a tool for shame. As more signals are collected, combined, and interpreted, performance monitoring can morph into personal surveillance.

As mechanical clocks standardized timekeeping, punctuality and hours worked became easier to quantify. This ability redefined what counted as a “good worker”. Clocks are obviously useful. Duke couldn't function if employees showed up whenever morning light hit the Chapel door handles. But workplace timekeeping also lets employers police lateness, restrict breaks, standardize the pace of labor, and treat time worked as a proxy for value. Wearable monitoring brings a similar logic to college sports. Constant monitoring can affect how teammates see one another and how athletes come to see and judge themselves.  When recovery scores or sleep data are visible to teammates and coaches, they can quietly become another form of comparison, another number to hit, defend, or explain. An exhausted athlete may feel pressure to produce a “good score” anyway, while an athlete who needs rest may feel compelled to justify it. Data intended to support recovery can end up shaping how athletes present their condition, not only how they train. 

Sleep tracking illustrates the risk of overreliance. Sleep researchers have identified an obsessive pursuit of ideal sleep metrics, termed orthosomnia, that can develop in people who use consumer sleep trackers. A 2023 commentary in the Journal of Sport and Health Science argues that perfectionist athletes may be especially prone to it, given sport-driven personality traits, elevated performance stakes, and constant access to their own metrics. The authors note that up to 70% of professional athletes report insomnia symptoms even before any tracker is involved. When a device layers a “readiness” or “recovery” score on top of that, a bad number the night before competition can undermine an athlete’s sense of self-efficacy and motivation regardless of how they actually slept. That is the trap, a tool that is meant to support recovery can instead become one more thing standing between an athlete and rest. 

What’s notable is how little research actually exists to confirm or rule out any of this. Trabelsi and colleagues are more than direct, mentioning that investigations into orthosomnia are still in their infancy. Studies examining its prevalence, alongside related mental health symptoms like anxiety and depression, specifically in athletes, are still needed. It’s hard to understand how devices so central to college athletics have not been thoroughly examined, particularly in regards to social dynamics and mental health. Athletic departments already lean on wearable data to shape training regimens, evaluate injury risk, and manage workload, in other words, to make real decisions about athletes' bodies. Yet the available literature offers little evidence that comparable attention has been paid to the psychological consequences of constant monitoring. If the data is good enough to build a training plan around, the absence of research into its psychological cost is not a minor gap. It is a blind spot. These potential consequences - the anxiety, the eroded self-trust, the quiet pressure to perform even at rest - are downstream risks of monitoring that no enforceable NCAA framework squarely addresses.

A legal patchwork

HIPAA, the federal law most people associate with medical privacy, is not a general health-data law. It applies to health plans, health care clearinghouses and health care providers, along with business associates acting on their behalf. HIPAA-covered hospitals and other providers have obligations when handling protected health information (PHI). But similar health data collected through a wearable platform, performance app, or athletic department may fall outside HIPAA if it is not collected or maintained on behalf of a covered entity.

FERPA adds another layer by protecting education records, records directly related to a student and maintained by a school, or by a party acting on its behalf. For example, records maintained by a student health clinic are governed by FERPA’s education and treatment record framework rather than HIPAA. That divide can create real confusion. A student-athlete’s biometric data may feel like health information no matter where it sits, but legally its protection depends less on what the data reveals and more on who holds it, why it was collected, and what role that holder is performing. 

Take a student-athlete’s heart-rate data. Data collected through a personal wearable account may be subject to the company’s privacy policy, Section 5 of the FTC Act, the FTC Health Breach Notification Rule, and applicable state law. That same information, when gathered through a university-issued wearable and maintained in an athletic department dashboard, may become part of a FERPA-protected education record. Data maintained by a HIPAA-covered physician may become part of a HIPAA-protected medical record. The information is the same, but its legal treatment changes depending on the holder.

State consumer-health privacy laws, such as Washington’s My Health My Data Act, can fill parts of the gap, but their coverage and requirements vary significantly. No comprehensive federal law attaches a consistent set of rights to athlete biometric data wherever it travels, leaving many of the most important questions to school policy and vendor contracts - who can access the data? What can it be used for? How long is it retained? Can the athlete refuse or delete it? 

Consent without leverage

For many student-athletes, the practical consequences of this fragmentation begin when they arrive on campus. By then, recruitment is over and the athlete has already committed to the school. Legal scholarship on collegiate biometric data describes athletes being presented with forms in group settings with little discussion of their content or implications. Rush and Osborne also warn that the power imbalance between athletes and coaches can make refusal feel unrealistic, even where participation is technically optional. By the time an athlete is asked to authorize collection, recruitment is over, and changing schools is not a realistic alternative for many. In that setting, consent is more of a formality than a meaningful decision, leaving athletes disconnected from any real understanding of who will see the data, how long it will be retained, or what it might later be used for. It is not as if every team requires tracking or retaliates against athletes who decline. It is that the power imbalance makes formal consent an unreliable substitute for what is truly needed - substantive limits.

Athletes in major unionized professional leagues have one structural advantage: collective bargaining. That leverage has allowed many unionized leagues to address this issue more directly. The NFL, NBA, WNBA, NWSL and MLB have explicit provisions related to biometric data and wearable devices in their collective bargaining agreements. The rules vary, and are by no means perfect, but they often include some mix of player consent, confidentiality, limits on commercial use, deletion rights, and restrictions on using wearable data in contract negotiations. College athletes lack that mechanism. They are not protected by a players’ association and therefore cannot negotiate league-wide protections through collective bargaining.

From Guidance to Rights

To its credit, the NCAA has begun to recognize performance technology as a governance issue. Its Committee on Competitive Safeguards and Medical Aspects of Sports approved guidance in December 2025 that calls on schools to educate athletes and staff, manage data responsibly, establish processes for reviewing new technologies, and create written plans governing collection, access, storage, and use. These recommendations are a start, but they are still merely recommendations. They alone do not create uniform, enforceable athlete rights to prohibit the sale or licensing of non-public biometric data, guarantee deletion when athletes leave school, require role-based coach access, or protect athletes from retaliation if they decline optional tracking, among other necessary regulations.

Commercialization may be the clearest boundary. Public game statistics are already valuable to broadcasters, sportsbooks, fantasy platforms, and analytics companies, but non-public biometric data is different. A shooting percentage or box-score statistic is not nearly the same as heart-rate trends, body temperature, or injury-risk indicators. Recent NCAA partnerships around official game data show how valuable college sports data has become, underscoring the need for a clear boundary: non-public biometric data collected through team programs should not be sold, licensed, or supplied to sportsbooks, scouts, advertisers, or NIL partners. Absent clear restrictions, a sleep score could inform scouting assessments, heart-rate data could shape a betting line, and neither would require the athlete’s meaningful consent. Some uses of biometric data can improve safety, training, research, and performance, but athletes should not lose control over sensitive bodily data simply because schools, vendors, and governing bodies failed to draw clear lines early enough.

The deeper governance problem is by no means unique to college athletics. Across emerging technologies, institutions are often expected to regulate practices from which they benefit. Frontier AI companies are asked to restrain increasingly capable systems while competing to develop and demonstrate those capabilities. Similarly, athletic departments and technology vendors are expected to limit data collection while benefiting from the performance, research and commercial value that data provides. Voluntary governance can certainly contribute experience and flexibility, but it cannot substitute for enforceable rights, independent oversight, and real consequences for noncompliance. A school deploying a technology should not have unilateral authority to determine whether its own safeguards are adequate. 

The NCAA should therefore convert its guidance into enforceable minimum standards for member schools that use performance technology. Those standards should preserve beneficial tools while requiring that they be necessary, scientifically defensible, transparent and bounded. 

Every tool should have a written purpose before deployment. Schools should collect only what is reasonably necessary for that purpose, and restrict access to people who need the information to fulfill it. Athletic trainers and team physicians may need detailed health and recovery information to do their jobs. A coach, on the other hand, does not need raw sleep data, body composition records, or other sensitive health indicators just because a platform makes them available. Any materially new use should require a new review rather than being automatically authorized by the original consent. 

Consent should be specific, written, understandable, and revocable. Agreeing to use a device for recovery should not authorize data use for discipline, scholarship decisions and roster management. Athletes should know from the onset what is collected, who can keep it, how long it will be retained, and what the school or vendor stands to gain from it. When tracking is not medically necessary or required for safety, athletes should have a real opt-out. 

Vendor privacy practices are not uniform and should not be assumed to be so. A 2025 analysis of the privacy policies of 17 leading consumer-wearable manufacturers found substantial inconsistencies, with 76% receiving high-risk ratings for transparency reporting and 65% for vulnerability disclosure. These findings illustrate the risks created when outside companies receive sensitive biometric data. Vendor contracts should mirror the school’s obligations. Contracts should prohibit undisclosed secondary use, limit subcontractors, require breach notification (inform athletes when data is accessed, acquired, or disclosed without authorization) and mandate deletion after an athlete leaves. Any exception to deletion should be limited to a documented medical obligation or an approved research purpose, with a specified retention period and safeguards against unauthorized access and reidentification. Where feasible, schools should also favor systems that process data on-device or retain it only briefly, reducing the amount of raw biometric information transferred to vendors. A school’s privacy policy means little if the company running the platform is not held to it.

Enforceable rules require institutional oversight. Each school should establish a standing athlete-data governance committee with voting student-athlete representatives and members from sports medicine, privacy, legal, compliance and IT. This committee would review tools before they are deployed, approve changes in data use, periodically review vendors, and provide athletes with a channel for complaints and appeals. The NCAA should audit institutional compliance, provide a complaint channel outside athletic departments, require corrective action and impose consequences for repeated or serious noncompliance. The NCAA should also establish minimum procedural standards defining what committees must examine and document without prescribing exactly how each school must organize it. For example, before deployment, the committee should document the tool’s purpose, scientific validity, data flows, access controls, security risks, and likely effects on athlete well-being. 

Within those minimum requirements, schools should retain flexibility to determine the committee’s size, meeting practices, and additional protections suited to the technologies they use. The goal is for the NCAA to set guardrails without prescribing every turn, creating enough national structure to prevent schools from turning their committees into “governance theater.” Committees should document their decisions and issue a public annual summary of the tools and vendors reviewed and any material policy changes made. Without a national floor, athlete privacy will continue to depend too heavily on state law, vendor contracts, and the priorities of individual athletic departments, repeating the uneven, state-by-state confusion that marked the NIL era.

Athletes should have meaningful control over data produced by their bodies. The need for clear rules will only grow as performance technologies become more intimate. As Nita Farahany discusses in The Battle for Your Brain, EEG earbuds, headsets, and other neurotechnology tools are becoming smaller, more practical, and increasingly capable of inferring attention, cognitive load, and mental states. It is not hard to imagine a future where a quarterback studies plays in a VR headset while coaches track concentration, fatigue or emotional state through an EEG-enabled device. This very concern is appearing in international policy. UNESCO’s 2025 Recommendation on the Ethics of Neurotechnology specifically calls for consent standards in sports that safeguard against coercive use and protect athletes’ autonomy. The prospect of neurotechnology in college athletics may sound hyperbolic, but at the dawn of wireless heart-rate monitoring in the early 1980s, today’s continuous, multisensor monitoring might have seemed equally far-fetched. Technologies that initially seem intrusive often become everyday routine once institutions build practices around them. 

Regardless of the future state of the technology, the governing principle should remain the same: better training should not require student-athletes to surrender control over the private signals of their own bodies.

Cassidy Curd holds a BA in Public Policy with a minor in History and is an MA candidate in Applied Ethics and Policy both at Duke University. She is a professional softball player in the Athletes Unlimited Softball League after an illustrious playing career at Duke. Curd made 141 appearances (93 starts). Logged a 2.91 career ERA with a 63-20 record, eight saves, and 598 strikeouts over 551.1 innings. She is a three-time NFCA All-East Region and three-time All-ACC selection. Curd received the Food Lion Community MVP Award in 2026, given to athletes that demonstrate strong leadership and exceptional service in their local communities. 

Holden Buchanan joined Duke in May of 2026 as a Research Associate working in conjunction with the Tech Policy Program and the Science & Society Initiative. His work supports projects related to cybersecurity, health data policy, AI governance, and emerging technology. In this role, he assists with research, program support, course development, and external engagement across Duke’s technology policy initiatives.Holden holds a BA in Public Policy from Duke University, with minors in Economics and Global Health. Prior to returning to Duke, he worked in athletics development at Wake Forest University, where he supported annual giving, donor strategy, and data-focused fundraising projects.