Sarah PetersonWhen Chase Burns delivered his 97-mph fastball to open the first inning at Dodger Stadium on September 7, 2026, twelve high-definition cameras simultaneously logged his grip angle, release point, spin rate, and exit velocity the moment the ball left his hand. The Reds ace — 15-3 this season with a 2.79 ERA — is one of the most Statcast-tracked athletes in professional sports. So is every other player on that field. But as millions of fans follow the Reds-Dodgers series, a quieter question is gaining legal traction: who exactly controls all that data, and what happens when it is used in ways players never anticipated?
Q: What data does MLB actually collect during a game like Reds vs. Dodgers?
More than most fans realize. MLB's Statcast system, deployed at every major league ballpark including Dodger Stadium, uses a combination of radar and optical tracking to capture over 1,000 data points per pitch. That includes ball trajectory, spin axis, player positioning, sprint speed, arm strength readings, and fielding route efficiency — all updated in real time and stored indefinitely by the league.
Beyond Statcast, many clubs now equip players with MLB-approved wearable devices such as WHOOP bands, which track sleep quality, recovery scores, heart rate variability, and respiratory rate. According to a 2025 Foley & Lardner analysis of sports biometric data practices, some teams have expanded wearable monitoring to include GPS positioning during games — data that, combined with health metrics, qualifies as biometric data under California's Consumer Privacy Act (CCPA).
The Dodgers, based in Los Angeles, are subject to CCPA requirements that define biometric information as "physiological, biological, or behavioral characteristics" capable of identifying an individual. Resting heart rate patterns, gait analysis, and muscular output readings from wearable tech all qualify. Any Dodgers player wearing a team-issued monitoring device during the Reds series is generating data that California law specifically regulates.
The scope is expanding rapidly. Starting in 2026, Statcast data is captured for all minor league games — extending the same tracking infrastructure to thousands of players who have no equivalent collective bargaining protections.
Q: Who legally owns a player's Statcast and biometric data?
Ownership is split — and contested. MLB's framework distinguishes between performance data captured by Statcast and health data collected through wearables, and the rules governing each are different.
For Statcast performance data, MLB retains broadcast and commercial rights. Individual player statistics are governed by longstanding licensing agreements with the MLB Players Association, meaning a player cannot unilaterally sell his own Statcast numbers to a betting platform — that requires league licensing and revenue sharing.
For wearable health data, the rules are stricter. Following years of MLBPA advocacy, MLB's 2022 Collective Bargaining Agreement explicitly prohibits clubs from selling or licensing "a player's confidential medical information, personal biometric data, or any nonpublic data used to evaluate player performance in practices or training sessions." Under the same CBA, both the player and the team can access and analyze the data internally — but neither can commercialize it without the other's consent.
The CBA framework also established that analytics vendors have no independent rights to the data they process. But the agreement does not address what happens when those vendors retain player health data on their own servers after a player's contract expires.
Previous Dodgers matchups have drawn attention to how deeply analytics shape roster decisions — as explored in earlier reporting on how baseball's data revolution reshapes performance evaluation. The Reds-Dodgers series adds a new dimension: when does performance tracking cross into a player's private health profile?
Q: What did the 2022 CBA actually change — and what remains unresolved?
The 2022 protections represented a significant shift from MLB's earlier approach, which left biometric data governance largely to individual team-player agreements. Prior to 2022, consent forms varied widely across clubs, and players reported feeling implicit pressure to comply with monitoring programs as a condition of staying on the active roster.
The new provisions give players the right to review their data, restrict commercial use, and — in theory — decline participation in non-mandatory monitoring programs. In practice, opting out of a team's biometric program carries a reputational cost: it can signal unwillingness to engage with sports science staff, something most players avoid.
There is also a significant legal gap at the federal level. The FTC's Policy Statement on Biometric Information and Section 5 of the Federal Trade Commission Act, issued in May 2023, identifies surreptitious data collection and inadequate vetting of third-party partners as potentially unfair trade practices. The FTC specifically calls out "failing to provide appropriate training" and "diligence failures on third party partners" as areas of concern. But this guidance does not carry the force of binding law, and no enforcement action has been brought specifically against an MLB club or its analytics vendors.
The California Lawyers Association has flagged that biometric privacy laws — including California's Biometric Information Privacy protections — may apply to professional sports contexts in ways courts have not yet fully adjudicated. Similar Statcast-driven data questions have surfaced across other Dodgers matchups this season, as the Cubs-Dodgers series illustrated in an earlier deep-dive on baseball's data infrastructure.
As the Reds and Dodgers face off this week with NL West playoff positioning on the line for Los Angeles (86-57, leading the division), both rosters are generating biometric data under frameworks legal specialists consider structurally incomplete.
Case in Point: When a Pitcher's Heart Rate Data Affects His Paycheck
To understand what is actually at stake, consider this scenario grounded in the kind of consent agreements MLB teams routinely use in 2026.
A Dodgers starting pitcher signs a standard tech rider at spring training, granting the club access to his WHOOP biometric readings for the season. His device baseline shows a resting heart rate of 48 bpm at the start of the year. During the September Reds series — four games in seven days, including two back-to-back starts — his resting heart rate climbs to 67 bpm, a 40% spike that the team's sports science staff flags as potential overuse fatigue.
Acting on this data, the coaching staff reduces his workload for the final four weeks of the regular season. His standard contract includes a performance bonus of $250,000 tied to reaching 180 innings pitched. He finishes the season at 174 innings — six short of the threshold — because his workload was managed down. He loses the bonus. The team acted on data they legitimately collected and that he consented to share. But the outcome — a $250,000 reduction in his earnings — was almost certainly not what he had in mind when he signed the tech rider.
Now add a second layer. The wearable vendor's contract with the Dodgers includes a data retention clause specifying that all device readings are stored for 24 months. After the pitcher's contract expires in October 2026, his health data — resting heart rate, sleep scores, recovery patterns — remains on the vendor's servers for another 22 months. Under the 2022 CBA, the club can no longer access it. But the vendor is a third party, not a CBA signatory. No current federal statute explicitly requires them to delete it. If the vendor later shares that retained data with a prospective new team's analytics staff, the pitcher has no clear remedy under existing MLB or federal law — only a potential civil claim under California's CCPA, which carries statutory damages of $100 to $750 per consumer per incident of unauthorized disclosure.
What Players and Organizations Should Do Now
For players at any level — including the minor leaguers now subject to Statcast tracking for the first time in 2026 — data privacy specialists recommend a consistent set of steps: read every consent form carefully before signing, ask explicitly whether biometric data is shared with third-party vendors, request a data retention limit in writing, and confirm whether the program is genuinely voluntary or implicitly required.
Amateur and college athletes face identical dynamics without any collective bargaining safety net. A high school pitcher whose coach tracks velocity via a connected radar app, or a collegiate player monitored by a university sports science program, has no equivalent protections to what MLB's CBA now provides.
For teams and athletic organizations at every level, data privacy expertise has become a legal necessity. Structuring consent agreements that are genuinely voluntary, vetting analytics vendors for data retention practices, and understanding what CCPA requires for California-based organizations — these are decisions with direct financial and legal consequences that benefit from qualified professional guidance.
The Reds-Dodgers series will be decided by what happens on the field. What happens to the data generated during it will be decided in boardrooms, legal agreements, and eventually in court — in ways that affect every player whose biometric profile is now permanently on file somewhere in the cloud.
This article addresses legal and data privacy topics. The information presented reflects publicly available CBA provisions and regulatory guidance. Players and organizations with specific data governance questions should consult a qualified IT compliance or data privacy professional.
