Sports Data Analytics Is Now a Data Centre Story: Costs, Breaches and Blackouts

The Register put the number at 17,333,335,124,315 rows. That is the estimate the researcher gave for the analytics databases he could reach. He had found that Titan, Microsoft's internal analytics platform, validated the contents of a JSON Web Token but never checked its signature. He reported the flaw, Microsoft locked down the API and paid a $5,000 bounty, and the company said the disclosure helped it harden its services.

Why does a Microsoft internal tool matter to anyone running sports analytics? Because the sports industry's data stack does not sit on its own wires. It runs on the same cloud regions, the same metadata layers and the same identity systems that carry everything else. And the same week that Faav's write-up went public, three other stories landed. Read together, they describe where sports data analytics actually lives now.

The cost side is a policy fight, not a product launch

On Wednesday, Senate Democrats blocked the Ratepayer Protection Act by a 57-to-43 vote, short of the 60 needed to advance, according to The Guardian. The bill would have required electric utilities to consider standards so that data centres pick up the cost of transmission, generation and distribution upgrades that would otherwise land on households and businesses. Chuck Schumer called it a "toothless" bill that "completely misses the mark". Jon Husted, the Ohio Republican who carried it in the Senate, said big tech "should be paying their own way, not passing the cost on to local communities and states". Four Democrats joined Republicans: Maggie Hassan, Amy Klobuchar, Jon Ossoff and Raphael Warnock.

"Americans are calling for real solutions, real guardrails, real solutions on AI. Republicans' toothless datacenter bill completely misses the mark," Schumer said in a floor speech.

The House had passed the bill almost unanimously earlier in September. The vote was one of the last the Senate is expected to take before the 3 November midterms. Whatever a club, league or broadcaster pays for compute is downstream of that argument, and the argument is not settled.

In Europe the numbers are more concrete and more awkward. NL Times reported on 30 September that fewer than a quarter of larger Dutch data centres publish figures on electricity and drinking water use. That is three years after the European Energy Efficiency Directive began requiring reporting for sites at 500 kW or more. The Dutch Datacenter Association counted 186 commercial data centres at that threshold at the end of last year. The Netherlands Enterprise Agency has data on 104, public electricity figures for 44 and water figures for 47. Statistics Netherlands puts Dutch data centre electricity use at 5.1 billion kWh in 2024, 4.6 percent of national consumption and close to double the level five years earlier. Grid operator TenneT projects 10 to 15 percent by 2030. Data from the RVO showed this summer that Microsoft's largest Dutch data centre alone accounts for 1 percent of national electricity consumption.

Who is allowed to look at the data

Then there is the question of who gets to see the underlying records. The Guardian reported on Wednesday that more than 44,000 people have filed formal objections under article 21 of the UK GDPR to NHS England's Palantir-powered Federated Data Platform handling their health data. The campaign was coordinated by 38 Degrees. Objectors also asked that processing through the platform be halted while the requests are assessed.

Palantir's UK and Europe executive vice-president, Louis Mosley, has accused critics of "Palantir derangement syndrome". A company spokesperson said trusts using the software recorded 117,000 additional operations, a 14.3 percent reduction in discharge delays for long-stay patients and a 5.6 percent improvement in people finding out whether they have cancer within 28 days. NHS England said organisations remain in control of their data and that suppliers cannot access it for their own purposes. Two Commons select committees have called for Labour to use the break clause in the seven-year, £330m deal, which comes into force in February 2027.

Sports analytics has a version of this problem. Wearable data, medical records, biometric screening and, increasingly, gambling-adjacent performance data all sit in third-party platforms. The governance questions are the same ones the NHS is being forced to answer in public.

The infrastructure underneath is changing fast

Away from the politics, the plumbing is moving. On 30 September AWS said Aurora PostgreSQL can now query Apache Iceberg and Parquet data in Amazon S3, S3 Tables or the Glue Data Catalog through foreign tables, using DuckDB embedded in PostgreSQL. The capability is generally available from Aurora PostgreSQL 17.11 and 18.6 in commercial and GovCloud regions at no additional charge. For anyone stitching together event data, tracking feeds and archive tables, that removes a class of ETL jobs.

Tigris, which runs its object storage on FoundationDB, wrote on 30 September about moving asynchronous tasks such as garbage collection out of a FoundationDB-based queue and onto Kafka, while keeping the original queues in place. The post is blunt about why. Scheduling generated read load that competed with user requests, and the custom code was hard for new engineers to learn.

Two other items are worth flagging as background rather than news. Panthalassa, an Oregon start-up, raised $140m in a round led by Peter Thiel earlier this year, with backing from Marc Benioff, Max Levchin and John Doerr, and says it sells compute capacity from wave-powered floating nodes linked by Starlink. Separately, The Decoder reported on 30 September that Meta saved $3.9 billion in 2025 through a federal research tax credit by classifying AI data centres as "pilot models", up from $2 billion the year before, according to the New York Times. Meta's own SEC filings warn the savings could be challenged.

None of this is a sports story on its face. All of it is the ground sports analytics stands on: where the compute is, what it costs, who is allowed to inspect the records, and how easily a single unverified token can open a door.