THE AUTHORS:
Nariat Pashaeva, Associate Lawyer at Advokatfirma Haakstad & Co
Rishita Palepu, Law Clerk cum Research Associate at the Supreme Court of India
Introduction
At the 2026 FIFA World Cup, more than 1,200 players were subjected to a one-second digital body scan before a single match had been played, generating an accurate 3D avatar of each athlete. Built in collaboration with Lenovo and Football Technology Centre AG, these digital twins tracked every player across all 104 matches and appeared on stadium screens and global broadcasts to adjudicate offside calls.
A digital twin is more than a technical asset. It is a biometric representation of a specific individual that produces intelligence not only about in-match movement but about physiological characteristics, biomechanical patterns, and physical condition. This is the same category of information that the European Court of Human Rights (“ECtHR”) has treated as engaging Article 8 of the European Convention on Human Rights (“ECHR”) when captured or retained by state or private actors.
Professional footballers wishing to compete at a World Cup had no meaningful ability to decline consent to the scanning process, since participation requires compliance with FIFA’s rules. As discussed below, this compulsion is what the ECtHR addressed in Mutu and Pechstein v. Switzerland (Applications Nos. 40575/10 and 67474/10, Judgment of the ECtHR, 2 October 2018) (“Mutu and Pechstein”). The question that follows is whether digital replication of the player engages the athlete’s right to respect for private life under Article 8 ECHR.
Background
Private sports bodies responsible for organising sporting events have long been scrutinised for the de facto power they hold in society. Commentators have argued that their growing autonomy carries significant implications for human rights protections. The creation of digital twins of players brings a third dimension to the dyadic debate and is bringing private companies like Lenovo into this realm. This, in our opinion, has implications for players’ rights guaranteed under Article 8 ECHR, which current systems may be ill-equipped to handle.
In Mutu and Pechstein v. Switzerland, the ECtHR confirmed that Convention guarantees can reach disputes decided by private sporting bodies, as the State is answerable where its courts uphold a CAS award. Because Ms. Pechstein had no real choice but to accept CAS arbitration, her acceptance could not be treated as a free waiver of Article 6(1). The Court nonetheless found no violation in respect of CAS’s independence and impartiality, and found a violation only in the refusal of a public hearing.
This compulsion is not confined to dispute resolution. As we will see in our discussion in the section on consent below, this compulsion recurs when a governing body conditions participation on acceptance of its terms. Before that compulsion becomes legally significant, it must first be shown how Article 8 is engaged by this kind of data.
Scope of ‘Private Life’ and Why It Matters
The concept of “private life” is broad. As observed in S. and Marper v. the United Kingdom (Applications Nos. 30562/04 and 30566/04, Grand Chamber Judgment of 4 December 2008) (“S. and Marper”), it has deliberately been left open-ended for inclusion of various forms of personal data. The ECtHR also considered it unnecessary to attempt to give an exhaustive definition to private life and cannot in any way be limited to an “inner circle”. Beyond this, private life can be anything that embraces multiple aspects of a person’s physical and social identity (See, Denisov v. Ukraine, para. 95). This finding is crucial in our context given that football players operate in an environment that can be predominantly categorised as “public”.
The creation of a digital twin, which carries significant information about the player’s body dimensions, movement, and related patterns, attracts protection under Article 8 in its own right. That is so notwithstanding the argument that playing a sport is an activity of an essentially public nature.
This is also because the collection of data for testing conducted during competition and training will trigger Article 8 obligations, as held in Fédération nationale des associations et syndicats sportifs (FNASS) and Others v. France (Applications Nos. 48151/11 and 77769/13, Judgment of 18 January 2018).
The last analogy that solidifies Article 8 engagement in the case of digital avatars is that the different types of data can be categorised into different levels of sensitivity based on the extent of information that can be revealed through collection of such data. In S. and Marper, DNA samples were considered higher in sensitivity given the extent of information they are capable of revealing. While fingerprints and DNA samples are static, discrete identifiers revealing specific types of data about an individual, digital twins capture much more than a specific type of information. They reveal movement of a person over time. Unlike fingerprints, this type of data capture is continuous, studying the whole body, and is dynamic in nature. Digital twins provide accuracy because they are linked to real data sources from the environment and the twins update in real time (See, McKinsey, ‘What is digital-twin technology?’), and this is exactly the fidelity that FIFA would go on to invoke as justification for the technology’s deployment. Now, when the reasoning in S. and Marper is analysed to reveal the scope of Article 8 engagement, data capture by digital twins, capturing a continuous, whole-body, biomechanical record, would inevitably engage Article 8 irrespective of its proportionality assessment. Even if a digital twin is properly understood as derived or synthetic data rather than raw biological material, Article 8’s protection has never turned on the physical form data takes. The concern is the kind of information about the individual that such retained data is capable of revealing. A continuous biomechanical record revealing an athlete’s movement, gait, and physiological patterns discloses precisely the kind of information Article 8 was designed to protect, regardless of whether it originates from a biological sample or a computational reconstruction.
Having established that Article 8 is engaged, the next question is whether the purpose for which this data was collected limits how it may be used.
Purpose Limitation
Ahead of the 2026 FIFA World Cup, these avatars were justified as a way to achieve greater accuracy in on-field Video Assistant Referee (“VAR”) based decisions. What remains unresolved is whether the avatars may be stored, reused, or commercially exploited once created. S. and Marper is instructive on why this question matters. The Grand Chamber found that the capacity of DNA profiles to be used for familial searching or to infer ethnic origin made their retention “all the more sensitive” to Article 8 concerns (para. 76). The parallel from this to the digital twin case at hand is that betting distribution, video game licensing, AI simulation, and commercial image exploitation are all latent capabilities of the same biometric dataset, independent of how often FIFA actually exercises them. The UK’s retention regime was also decisive for mainly two reasons: 1) data could be retained no matter the “nature or gravity of the offence”, and 2) be kept without any limitation in time (para. 119). The World Cup scheme mirrors this structure, as all 1,200 players were scanned uniformly, with no case-by-case assessment.
There is a gap between the stated purpose and the actual scope of FIFA’s use and retention rights over biometric data captured by the digital twin. The FIFPRO Charter of Player Data: Managing Technology and Innovation, developed jointly with FIFA, does define biometric data in a way that includes the digital twin: “personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person”. It also sets out rights for players to access, revoke, and erase their data. However, the same Charter also states that it “focuses on player data from a rights protection perspective and does not directly address commercial exploitation issues”. The absence of a defined limit brings the capture of data within the S. and Marper proportionality concern. This is because biometric data retained without a specified boundary on its future use engages Article 8, regardless of whether FIFA ever exercises it to its fullest potential.
Consent and the Limits of ‘Agreement’
In Mutu and Pechstein v. Switzerland, the Swiss Federal Tribunal itself recognized that an athlete “wishing to take part in a competition organized under the auspices of a sports federation […] would have no choice other than to accept” the governing body’s terms, faced with the “dilemma” of compliance of branding the sport at professional level (para. 111). The ECtHR held that an athlete’s acceptance of CAS jurisdiction did not amount to a free and unequivocal waiver, since her only real choice was “between accepting the arbitration clause […] or not accepting it and being obliged to refrain completely from earning a living from her sport at that level” (para. 113). Collecting data for the creation of avatars is typically a condition of accreditation, of sponsorship compliance, or of participation itself. The same logic applies to biometric capture, as submission to scanning is not a freely negotiated term but a condition of professional survival.
Because FIFA is a private body and not a state, Von Hannover v. Germany (Application No. 59320/00, Judgment of 24 June 2004) supplies the doctrinal bridge, in which the Court held that Article 8 is not confined to a negative restraint on public authorities, but carries positive obligations requiring the state to secure respect for private life “even in the sphere of the relations of individuals between themselves” (para. 57). Germany in this case was found in breach of Article 8, not because it had published the photographs itself, but because its courts had failed to protect the applicant from a private publisher. An Article 8 claim concerning digital twins would therefore have to be directed against a state’s failure to regulate such private conduct and not against FIFA directly.
Von Hannover undermines the assumption that an athlete’s public visibility forfeits any privacy interest. The Court held that anyone, “even if they are known to the general public, must be able to enjoy a ‘legitimate expectation’ of protection of and respect for their private life” (para. 69), and that a zone of private-life protection can persist even in public settings (para. 50). If a public figure as visible as Caroline von Hannover retained this expectation, an athlete’s on-pitch visibility cannot, without more, be treated as a waiver of privacy in biometric detail no spectator perceives with the naked eye. Read together, compelled participation and the persistence of a legitimate expectation of privacy leave ‘consent’ doing little justificatory work.
Conclusion
Article 8’s implications on the creation of digital twins of football players call for a revisit to the current consent mechanics in play between private sports bodies and individual players. Guaranteed rights are superior to the commercial purpose of an action, and private bodies, such as FIFA, have positive obligations under the ECHR. Going forward, decisions within sports have to be governed by these settled principles. This is to prevent power imbalance between a private sports body and a player from harming human rights guarantees.
