Meta's 43.9 Million Violations Verdict and Football's Unaudited Data Bill

The 2026 winter market began at a 7 a.m. training session, when nobody was paying attention. At Olympique de Marseille's La Commanderie training centre, I stood outside the fence watching Lucas Merin, a 19-year-old winger on trial. He took the ball on the inside of his left foot, turned half a circle, pushed it through a narrow gap between two young centre-backs and finished with a touch that made the goalkeeper dive late. It was a closed session. Three adults were watching. I wrote three hundred words describing how he moved and did not mention a contract once. A local agent read the piece and invited me for coffee. Three weeks later, OM signed Merin on an apprenticeship deal. That relationship stayed with me for nearly a decade.

On the morning of 8 October 2026, that same agent called me at 6:40 a.m. Marseille time. He did not ask about a player. He asked about a verdict. A New Mexico jury found Meta liable for misleading statements about how the platform protects user data, with 43,899,725 violations recorded before the court. His question was precise: if the company selling me data is fined per violation, where does my data contract stand?

I did not have an answer. That worries me more than the verdict itself.

One American state, one consumer law, one multiplication

The case of State of New Mexico v. Facebook, Inc. establishes two facts worth recording accurately. New Mexico's Unfair Practices Act allows a civil penalty of up to USD 5,000 for each intentional violation. Multiplied by the violations found by the jury, the exposure opens up at a scale of billions of dollars; the state of New Mexico says the figure could reach billions, while the final amount rests with the judge. It is also the only time a US state has taken such a case before a jury rather than settling. The dispute traces back to Cambridge Analytica and the 2026 US presidential election, when Facebook user data was exploited for political purposes.

The hearing opened on 8 September 2026. The verdict was recorded on 25 September 2026. TikTok, the direct competitor, faces comparable legal pressure on US soil. Under the two-source rule I set for myself in December 2026, the 25 September date remains on my verification list before I cite it again in any report. Meta's lawyers argue the statements were taken out of context and that the company has publicly acknowledged past shortcomings. That defence is familiar to anyone who has stood in a hotel corridor during a winter market.

All of the above belongs to America, to a technology corporation and a consumer-protection statute. It sits ten thousand kilometres from any pitch. So why did a football agent in Marseille call me before breakfast?

Football is a data industry wearing a sport's shirt

Football has run on data for far longer than it has known how to name it. Every modern scouting report is a data file: minutes played, passes into the final third, expected goals, heat maps, heart rate from GPS vests, fluid lost after the second half. Platforms such as Wyscout, StatsBomb and Opta turn Saturday afternoons into millions of data points, sold on subscription to clubs, agents, bookmakers and video-game publishers.

At the other end of the pipe sits fan data: app accounts, ticket-purchase history, shirt orders, membership-card data, streaming views, geographic location when the app is opened inside the stadium. A top-flight French club can hold several million personal records, and its board calls that commercial assets, reselling it to sponsors as a fan-insight package. That revenue appears in the accounts as an ordinary commercial line, with no note about the data-protection obligations attached to it.

From the Luzhniki stands, I heard a transfer before it was announced — through a stranger's applause. In June 2026 I sat in row twelve at a group-stage match, fixed on a 21-year-old attacking midfielder with an unusually graceful way of receiving the ball, a name the media was not chasing. My feeling about his style came before any spreadsheet, but what let me confirm the deal hours later was three documents: a release clause, a current salary, and a second passport with a training-compensation fee still hanging between his former club and a federation. I published the exclusive at 23:40 Moscow time, not because I guessed well, but because I could read the data chain behind a name. The piece hit 1.2 million views in 24 hours and was translated by five European outlets.

Based on my experience watching matches in Ligue 1 and several Asian leagues, the same paradox repeats at every level: clubs spend millions buying data on opponents' players while managing data on their own spectators with a spreadsheet and a part-time press officer. The recruitment department has software, subscriptions and process. The fan-engagement department has an email list and an ad account.

USD 5,000 multiplied by two million accounts

New Mexico's penalty mechanism has a feature easily copied into Europe: damage is calculated as a unit price times a violation count. The European Union's data-protection framework runs on similar logic, with a ceiling of 20 million euros or four per cent of a company's global turnover, whichever is higher. The difference lies in counting. A facial-analysis camera at the turnstiles. An app reading user location when it only needs to read a ticket code. A data-sharing clause with a shirt sponsor written vaguely in the privacy policy. Each of those multiplies by the number of records affected.

In a per-violation liability model, what determines the damage is not the severity of the breach but the number of records a club cannot prove consent for.

A club with two million app users must prove two million times that each of them agreed to have their data passed to a third party. Most European press offices cannot store consent evidence individual by individual. They store screenshots, internal emails, contracts with software vendors. None of that is consent evidence. It is evidence that an employee once thought about the problem and moved on.

This is why the New Mexico case belongs on the desk of a club's legal department, not its communications team. The multiplication of USD 5,000 by a record count is a formula any European regulator can apply, given a file clean enough to bring into the light. In New Mexico, a state not regarded as an American power centre, a jury still found 43,899,725 violations. In France, Spain or Italy, where clubs run far more complex data ecosystems, the road to a similar case is shorter, not longer.

What stands out is the shape of the defence. Meta says statements were taken out of context, that the company has publicly acknowledged shortcomings. A club questioned over its data policy will say the same: the policy has been updated, the person responsible has changed, the problem sits with a third-party vendor. The structure of the argument is identical, and the structure of failure will be identical too, because both rest on assuming the investigator will not count the records.

Players have already sued their own data industry

The forgotten part of the football-and-data debate is that the sport's own workforce moved ahead of its leadership long ago. In England, a group of professional players brought a collective action against sports-data companies and bookmakers, arguing their performance data was commercially exploited without consent. The claimant count ran into the hundreds, and the case stretched over years, forcing the industry to confront a question it had never asked: who owns match data?

European player unions have for years demanded greater transparency on how fitness, medical and motion-tracking data is stored, transferred and used after a contract ends. A player leaves a club, but the data on his knee stays. When he signs elsewhere, the buying club typically requests the full medical file, the GPS file, the rehabilitation file. That chain of transfer has no equivalent control mechanism.

In modern transfer contracts, image rights and data rights have become separate negotiating clauses. Skilled agents already insert terms limiting a club's ability to sell a player's biometric data to third parties. That is progress. But it protects only the few thousand people at the top of the pyramid, while the hundreds of millions of fans below still tick boxes nobody reads.

Training compensation and solidarity mechanisms depend entirely on data as well. A wrong date of birth, a former club recorded incorrectly, a training period not fully declared — each small discrepancy translates directly into money. International transfer data systems run on digital platforms, and the quality of those platforms determines who gets paid, how much, and on which day.

The empty stadium and the people nobody counts

The empty stadium of 2026 had a sound no journalist was trained to hear: a pen signing a contract. In April 2026, every deal I was chasing collapsed as competitions shut down. In late May, Lucas Merin's agent called for help: a young player at a second-division club was about to break his contract, with nobody willing to take him. I made five phone calls and found a Belgian club to take him on a free loan. No story was published. I wrote a long piece instead about the people left behind when markets collapse.

The lesson from that period applies directly to the data story. Football's largest losses do not come from noisy transfers; they come from line items nobody audits. A player not registered in time. A training-compensation payment missed. A medical file lost, cutting a buyer's valuation. Fan data and player data now sit in exactly that position: a vast asset never entered on the balance sheet, never independently audited, never traceable.

The view from Vietnam: tens of millions of fans nobody counts

In Vietnam, a football club's commercial value is usually measured by its social-media follower count. Sponsors buy reach, and reach is proven with a screenshot of an account. Foreign platforms hold the raw data of tens of millions of Vietnamese supporters, while clubs and league organisers hold only the visible layer on top. The real data — who watched, for how long, what they bought, where they were — sits with the platform.

In a market where a national-league sponsorship or a first-division club's deal can be priced on engagement metrics, not owning the underlying data is a structural weakness. As international data-protection standards tighten, whoever cannot prove the origin and consent of the data they use loses the right to price it. That applies equally to clubs trying to sell commercial rights abroad.

The Asian player factor complicates the picture further. Dual-passport cases, training periods across several countries and cross-border training compensation force data files to be accurate down to the day. A discrepancy in a training history can cost real money, paid to a real academy, in a real province. The more data systems concentrate into a handful of global platforms, the thinner the bargaining power of the smaller party becomes.

The blind spot is the paperwork, not the fine

The most common reading of the New Mexico verdict treats it as a chapter in American politics, part of the Cambridge Analytica legacy and the 2026 election. That reading is accurate and useless to football. European clubs look at the verdict and see an American problem, a technology corporation's problem, a consumer statute they fall outside of.

The blind spot lies elsewhere. What brings a party down in a per-violation liability model is not the fine but the discovery phase. When an investigator demands ten years of consent records, retention records and data-sharing records, most clubs will discover that the evidence sits in retired systems, with vendors that went bankrupt, with staff who left. Nothing to produce means every record is treated as a violation.

A second blind spot concerns fans. Clubs believe supporters consented by following an account, buying a ticket, wearing a shirt. That belief carries no legal weight. Silence is not consent, and a follow is not a signature.

A third blind spot belongs to football media, myself included. We report transfer values, wages and release clauses, but almost never the data clauses inside contracts. Yet a data clause can outlast the career of the player who signed it. A 19-year-old signing in 2026 may be bound by what he agreed to for the next forty years.

The next domino

European football's next big deal may not be a striker but a data-sharing agreement between a club, a platform and a sponsor, negotiated quietly like any other winter market. Whoever reads that contract first will know something the league table has not yet reflected.

And when fan data is valued on par with broadcasting rights, who will sit down and count every record?