Christopher BellAs millions of UK fans stayed up past 1:15am to watch the Dallas Cowboys host the Tampa Bay Buccaneers in NFL Week 5 Thursday Night Football on Amazon Prime Video, many reached for their phones to check their fantasy scores. What they almost certainly did not read — at that hour — was the privacy policy of the app they were using to do it.
The 8 October clash at AT&T Stadium in Dallas had plenty of talking points: a 0-4 Buccaneers side pinning their hopes on undrafted rookie quarterback Jalon Daniels after Baker Mayfield's injury, against a Cowboys team arriving 2-2 after a 34-30 win over Houston. But beyond the on-field drama, the millions of UK users active on NFL Fantasy and ESPN Fantasy that night were sharing personal data with US corporations — most with no clear idea what British law actually says about it.
The Question UK NFL Fans Are Actually Asking
It is not, as you might assume, about betting odds or team form. Increasingly, it is this: "I've downloaded these American sports apps — what are they actually doing with my data, and do I have any rights?"
That question has grown sharper in 2026, as the Data (Use and Access) Act 2025 came into full effect, updating how UK GDPR applies to international data flows — including from popular US sports platforms that millions of British fans use every week during NFL season. The answer, for most users, is: you have substantial rights, and almost no idea how to use them.
What Data Do NFL Fantasy Apps Actually Collect?
The NFL Fantasy Football app, published by NFL Enterprises LLC, and ESPN Fantasy Football are the two most widely used platforms among UK NFL fans. Both collect considerably more than an email address and team preferences.
According to NFL Fantasy's own App Store privacy disclosures, data collected for tracking purposes can include purchases, precise location, contact information, and device identifiers. The app also embeds Nielsen's proprietary measurement software, which contributes to Nielsen's audience ratings — a commercial arrangement users agree to simply by downloading the app, without any separate prompt.
ESPN's fantasy platform transfers UK user data to American servers under the UK-US Data Bridge, the UK extension of the EU-US Data Privacy Framework, to comply with UK international transfer rules. In practice, your browsing habits, in-app search activity, watch-time patterns, and in-app purchase history can flow to US-based advertising partners under this arrangement.
Third-party tracker analyses of the ESPN Fantasy app have also found that it requests Bluetooth and calendar access — permissions classified as "dangerous" under both iOS and Android standards because they extend well beyond what a fantasy sports application strictly requires.
Does UK GDPR Protect You When Using American Sports Apps?
Yes — and more robustly than many fans realise.
Under UK GDPR and the Data Protection Act 2018, any organisation processing personal data about UK residents must comply with British data protection law, regardless of where the company is based. NFL Enterprises LLC and ESPN Inc are therefore subject to the authority of the Information Commissioner's Office (ICO), the UK's independent data regulator.
Your core rights as a UK user include:
Right of access (Subject Access Request): You can request a complete copy of all personal data a company holds about you. The company must respond within 30 calendar days, free of charge, and must specify what data it holds, where it is stored, who it has been shared with, and on what legal basis.
Right to erasure: You can request deletion of your personal data where you withdraw consent and the company has no other lawful basis to retain it.
Right to withdraw consent: For analytics tracking and marketing cookies specifically, you can withdraw consent at any time without losing access to the core service. This right is not removed by agreeing to terms of service.
Right to object to profiling: If a company uses your data for automated profiling or targeted advertising, you have the right to object and require it to stop.
The Data (Use and Access) Act 2025 introduced further provisions around data intermediaries and the algorithmic use of personal data — directly relevant given that both NFL Fantasy and ESPN Fantasy use recommendation systems to generate personalised in-app content and advertising.
The ICO has powers to fine organisations up to £17.5 million, or 4% of global annual turnover — whichever is higher — for serious breaches of UK data protection law. Its guidance on your individual rights is available at ico.org.uk/your-data-matters.
Cowboys vs Buccaneers and Your Digital Footprint: A Concrete Case
Consider a realistic scenario: Tom is a 34-year-old graphic designer in Leeds who has followed the Dallas Cowboys since 2020. At the start of the 2026 NFL season in September, he signed up for three platforms: NFL Fantasy Football, ESPN Fantasy, and Amazon Prime Video to watch Thursday Night Football.
Over the first five weeks of the season — including the Cowboys vs Buccaneers Week 5 matchup — Tom has unknowingly shared:
- Precise GPS location on every game night (location tracking is enabled by default in the NFL Fantasy app on iOS)
- His in-app browsing history, including player research, injury reports, and trade analysis
- An in-app purchase record after buying a £4.99 NFL+ subscription through the app
- Device identifiers that allow cross-platform tracking of his activity across NFL, ESPN, and Amazon
Under UK GDPR, Tom has 30 calendar days to receive a full response to any Subject Access Request he submits to these companies. If the request reveals that his precise location data was shared with third-party advertising partners without his explicit consent — and without a lawful basis other than consent — he has grounds for an ICO complaint and, under Section 169 of the Data Protection Act 2018, the right to pursue financial compensation directly against the company.
Without professional guidance, Tom may not know that he can revoke location permissions, opt out of advertising tracking, and submit a SAR — all while continuing to use the apps for their core fantasy sports purpose. An IT consultant spending one to two hours reviewing his account settings and data preferences — typically £60 to £120 at current market rates — could substantially limit ongoing data collection, identify any unlawful data sharing, and walk him through a formal ICO complaint if one is warranted.
The difference between acting and not acting is not abstract. Over an 18-week NFL season, platforms like NFL Fantasy and ESPN collect, aggregate, and monetise detailed behavioural profiles of users like Tom. Whether that data is handled lawfully, and whether Tom retains any control over it, depends almost entirely on whether he knows to ask.
What You Can Do Before the Next Kickoff
If you have used any NFL or sports fantasy app during the 2026 season, this checklist takes under 20 minutes:
1. Check your permissions now. On your phone, go to Settings → Privacy → Location Services and review which sports apps have access. Revoke location access for any app that does not need it to function.
2. Opt out of non-essential tracking. Both NFL Fantasy and ESPN Fantasy offer preference centres within account settings. Set tracking to "reject non-essential" — this does not affect core fantasy features.
3. Submit a Subject Access Request. Write to the NFL's privacy team at the contact listed in their privacy policy, and to ESPN's data protection officer. Request all personal data held about you, where it has been transferred, and on what lawful basis.
4. Check your UK-US Data Bridge rights. Under the UK Extension to the EU-US Data Privacy Framework, you can raise complaints about US companies' handling of your data through the ICO if the company is registered under the framework.
5. Consider an IT data rights consultation. For fans who use multiple connected platforms — or who have linked their sports apps to a Google or Apple account — an IT specialist can audit your digital footprint across platforms, identify any unlawful data flows, and draft formal complaints to the ICO or directly to the companies involved.
As explained in our guide to cybersecurity risks for UK streaming users in 2026, American platforms operating in the UK often rely on default settings that favour data collection over user privacy. The burden of opting out falls almost entirely on the user — and most users never do.
The Cowboys vs Buccaneers will not be the last NFL game UK fans watch at an hour that blurs good judgement. But data rights are not a morning-after problem. They accumulate quietly, week after week, across every app open during kickoff.
If you are unsure about your digital rights as a UK user of sports platforms, an IT consultant on ExpertZoom can review your accounts and guide you through your options in a single appointment — no legal jargon, no guesswork, just a clear picture of what your data is doing while you watch the game.
This article provides general information about UK data protection rights. It does not constitute legal or professional advice. For complex personal data situations, consult a qualified IT data rights specialist.
