The Second Pitch: When Fan Data Becomes an Asset

The match at Seoul World Cup Stadium had reached the 88th minute when I opened my phone in the press tribune. The report came from New Mexico: a state jury had found Meta, Facebook's parent company, responsible for 43,899,725 violations of the Unfair Practices Act. The statutory civil penalty runs up to USD 5,000 per intentional violation. A quick comparison: that violation count is more than twelve times the total in-stadium attendance of the 2026 World Cup in Qatar. Behind me, more than thirty thousand people were raising their phones to film a counter-attack. None of them were thinking that every ticket scan, every login to the club app, every replay watched on a streaming platform leaves a trace. Those traces are the raw material of an economy that football has never properly priced. The New Mexico verdict does not mention football once. It revolves around Cambridge Analytica, the 2026 US presidential election, and how a social platform handled user data. TikTok is named as the next link in the same chain of US legal pressure. The part worth reading closely is the mechanism: the penalty is calculated as a unit price multiplied by the number of adjudicated violations. One act, one count. Forty-three million acts, forty-three million counts. That mechanism is not new. But it raises something professional football must answer before it is asked: if every instance of a club collecting, sharing or selling access to fan data counted as one act, how many violations would a single season produce? Football entered the data economy long ago; nobody simply calls it by that name. One match in the Korean top flight generates tens of thousands of data points: ticket purchase history, seat location, shirt-buying habits, streaming history, social-media interaction. European clubs have systematised this into customer-relationship systems and resell it to sponsors as audience segments. Streaming platforms buy broadcast rights, and with them comes access to the user file. Spain has an instructive precedent. In 2026, LaLiga's official app was found to activate phone microphones and geolocation to track down illegal broadcasts. Spain's data protection authority opened an inquiry, and the debate ran for months. What stands out is that almost no one in the coaching staff or the dressing room knew it was happening. Start with the smallest object: the barcode scanner at the turnstile. At a mid-table match, that scanner records entry time, ticket code, gate and frequency. Combine it with purchase history in the club shop and you get a fairly complete profile of a fan: whether they arrive early or late, whose shirt they buy, which stand they sit in, when they leave if the home side is behind. Any sponsor would want this data, because it measures emotion in numbers. For years I have arrived at stadiums two hours early and sat in the administrative area. There I meet the people the scoreboard never names: ticket staff, the person managing the customer database, the technician running the app. I learn more from the man at the end of the bench than from the man lifting the trophy. That is true of players, and even truer of the people standing behind the touchline. At the 2026 World Cup in Russia, after the defeat to Mexico, I stood in the dressing-room corridor and watched Son Heung-min and goalkeeper Cho Hyun-woo neatly arrange boots and water bottles in rows themselves. Nobody took a photograph. But on another floor of the same building, data on the tens of thousands of Korean supporters in Russia was being collected and processed, from ticket scans to app sessions. In Korea, where I live and work, K League clubs have invested in their own apps, electronic ticketing and membership packages that collect data. In Japan, the J.League has built a centralised data system for the whole competition. In Vietnam, after 2026, when the national team made successive marks at the AFF Cup and in World Cup qualifying, the fan file grew very quickly. But most of that data sits scattered: tickets sold through third-party platforms, shirts sold via social media, supporter lists living in the personal accounts of communications staff. The infrastructure gap produces a paradox: younger leagues are more exposed, because they collect data without a legal department attached. The three-source verification rule I have followed throughout my career, applied here, produces an uncomfortable result. One: the club says it respects privacy. Two: the app's terms of use say it may share data with partners. Three: the sponsor contract says data is transferred as anonymised audience segments. Those three statements do not flatly contradict each other, but they do not quite match either. And in most cases, nobody at the club checks the third source again. There is a line I wrote years ago and still reuse: a forgotten contract, and one day it changes the wind of the whole season. The transfer market is where people pay for the future, but usually forget the past. With fan data, the opposite holds: clubs are paying for what they collected in the past without ever writing it down. In 2026, when the pandemic froze every competition, I asked to enter Seoul World Cup Stadium twice a week. There was Mr Kim Sang-oh, who had tended the pitch for fifteen years, still mowing regularly though no match was scheduled. The empty stadium that year taught me that noise is not football. It taught me something else too: even with no spectators left, the data flow continued. Season tickets not yet refunded, apps still logging sessions, platforms still measuring replays of old matches. Football can stop playing, but it does not stop collecting. The size of this market is not small. Big leagues sell broadcast rights, and access to audiences comes with them. Sponsors pay for the advertising board, but most of the contract's value lies in reaching a specific group of fans. Sports betting companies, in markets where they are legalised, are among the largest buyers of data. Video-game developers buy image rights and player data. Every link rests on one assumption: that the data was lawfully collected and is used for the stated purpose. That assumption is the weak point. In football, data usually passes through three or four intermediaries before reaching the end user: an outsourced ticketing-app operator, a data analytics firm, a sponsor, an advertising platform. Nobody holds the whole chain. As the chain lengthens, responsibility thins. The New Mexico lesson lies there. What made the verdict heavy was not the individual penalty but the counting method. When a regulator moves from one case to one act, the scale changes entirely. Football generates tens of millions of interactions every season. If one day a national data protection authority chooses a similar method of counting, the question will no longer be whether a club violated the rules, but how many times. Meanwhile, most public debate about data in football circles around heat maps and expected goals. For years I have argued that the heat map has become a new form of divination: it creates a feeling of precision while obscuring a player's real role in the system. It also obscures another kind of data, far more commercially valuable, sitting in the ticket office rather than on the pitch. The counter-intuitive view here is that small clubs carry more risk than big ones. A leading European side has a legal department, privacy counsel, and a review process for data contracts. A top-flight club in Southeast Asia often has one communications officer who also runs the social media accounts and the supporter list. The compliance-capacity gap is far wider than the transfer-budget gap. Clubs often tell me: "We don't sell data." Technically, that may be true. But selling advertising access based on fan segments is in substance no different from selling data, except that it is not called by that name. Next season I will still arrive two hours early. This time I will look for one more detail: at the ticket counter, next to the entry instructions, is there any notice about personal data. Every season is a drumbeat, and my job is to listen until it becomes a melody. The next beat may not come from the stands, but from a meeting room a few thousand kilometres from the stadium.