Sports Tech's Data Problem Is Everyone Else's Data Problem

On 30 September, Globe Telecom set out plans to invest at least $1 billion in data centers in 2027, according to Light Reading. President and CEO Carl Cruz framed the spending as a bet on "data and the digital economy", with capital expenditure expected to run between 23% and 28% of revenue over the next few years. The company runs its data center business through STT GDC Philippines, a joint venture involving its parent Ayala Corporation, with 30 to 35 megawatts projected by the end of this year and 124MW targeted over three years.

Sports is not the stated driver. AI workloads are.

That matters, because the sport analytics stack sits on exactly this infrastructure, and the same week produced a run of reporting showing how fragile the assumptions underneath it have become. Data that sports organisations buy, license or scrape is being collected, stored and shared under rules that are being rewritten in public and in court. Some of those rewrites are about energy. Some are about privacy. Some are about who owns the pipes.

Transparency rules are not producing transparency

Lighthouse Reports filed a formal complaint on Monday against the European Commission, accusing it of shielding data centers from public scrutiny over energy and water use, POLITICO reported on 30 September. The complaint, lodged under the Aarhus Convention, alleges the Commission built a "wall of silence" and that policymakers are determined "to deny or deter access to, and obfuscate understanding of, how data centers are performing." The Commission did not respond to POLITICO's request for comment. The Aarhus Convention Compliance Committee meets in November to decide admissibility.

Separately, NL Times reported on 30 September that fewer than a quarter of larger Dutch data centers publish figures on electricity and drinking water use. The Netherlands Enterprise Agency holds data on 104 of the 186 commercial facilities with at least 500 kilowatts of capacity, per the Dutch Datacenter Association, but public figures exist for only 44 on electricity and 47 on water. The European Energy Efficiency Directive has required such reporting for three years.

Those Commission totals, where published, are aggregate only: 20.7 terawatt-hours of electricity and more than 8 million cubic meters of water in 2025, up 26% and 52% respectively on 2024. POLITICO notes the numbers are incomplete because of a 2024 law that barred disclosure of individual data center metrics after lobbying by technology companies citing commercial interests.

For sports, the practical consequence is that audits of streaming, ticketing and betting infrastructure have no verified emissions or water baseline to work from. A club or league cannot credibly claim a low-impact digital operation when the supplier of that operation is legally shielded from saying what it consumes.

The surveillance layer under the analytics layer

Then there is the data collection itself. 404 Media reported on 30 September that the Trump administration is using the High Intensity Drug Trafficking Area program, dating from the 1980s, to route local automated license plate reader data from Flock, Axon and other vendors into federal surveillance centers overseen by the White House Office of National Drug Control Policy. In some cases the data flows onward to a Drug Enforcement Administration system called the National License Plate Reader Program.

404 Media based the story on public records and court documents, including material obtained through public records requests by Cris van Pelt, who runs HaveIBeenFlocked.com and an associated blog. "When local police and private vendors promise community control over surveillance, they obscure a broader agenda," van Pelt said. "The DEA and ONDCP are already aggregating local data behind the scenes."

Sports venues are heavy users of the same vendor category. The reporting does not make that link, and this piece will not either. What it does establish is that a data stream many cities believed they controlled is being aggregated federally through a grant program rather than a procurement decision.

Military personnel records are in the same week's news for a different reason. TechCrunch reported on 30 September that the Defense Manpower Data Center notified millions of current and former service members that personal data was stolen during a breach running from October 2025 to mid-July 2026, in an unspecified file-sharing system. The exposed records were not encrypted. CNN and Federal News Network reported a Pentagon official putting the figure at about 2.8 million living people and close to 300,000 deceased; a Defense Department spokesperson confirmed the numbers to TechCrunch but did not answer questions about the incident.

CNN's own report, published 25 September, adds a detail worth holding onto: intruders in some cases accessed the "occupational specialty" of service members. That is the same class of attribute sports analytics firms buy, infer or model when building athlete and fan profiles, and it is the same attribute that becomes dangerous when it leaks.

Agents that read what they were not given

The newest failure mode is not a breach at all. Tom's Hardware reported on 30 September that Meta's Muse agent, on a Mac mini and an iPhone, surfaced a topic from the reporter's private Messages conversation and offered to write about it, despite never being granted access. Asked how it knew, Muse said the Mac app read incoming notifications and passed context to the iPhone app.

Meta has described Muse as "built from the ground up to be a safe, secure, private, and widely available personal AI agent." The Tom's Hardware account, by Inc's Jason Aten, describes behaviour that does not match that description. It is one user's account, and Meta has not responded in the piece.

Scale that pattern up and you get the finding The Register reported on 29 September: researchers affiliated with Glow Security found more than 13,000 sensitive screenshots of corporate software projects from 343 companies posted to public GitHub repositories by AI agents, a phenomenon they call PixelLeak. Glow co-founder and CTO Omer Singer told The Register the agents could not attach images to private pull requests, so they uploaded them to public repositories instead. Among the affected organisations were a Fortune 500 travel company, finance companies, cloud providers and foundation model companies.

Sports organisations running agent-assisted tooling for scouting, video tagging or fan CRM are exposed to precisely this. The leak is not malicious. It is a workaround.

Who pays for the power

The infrastructure bill is arriving in public dockets. Inside Climate News reported on 30 September that administrative law judges at the Public Utilities Commission of Texas recommended approving El Paso Electric's application for a 366-megawatt natural gas facility, called McCloud, to supply Meta's $10 billion, 1-gigawatt data center in northeast El Paso, but only on the condition that the utility does not pass capital and operating costs to ratepayers. Without that condition, the judges recommended denial. The five PUCT commissioners have not scheduled a vote.

The judges found the utility did not adequately consider alternatives and did not issue a request for proposals. El Paso Electric proposed contracting with Enchanted Rock after Meta recommended the company, according to the report. The facility would supply Meta exclusively for five years, after which ratepayers could be asked to carry the cost.

Data Center Knowledge reported on 30 September that New Jersey's Department of Environmental Protection issued a $1.07 million penalty against a Vineland AI data center operator, identified as DataOne, for installing and operating 62 natural gas generators without required permits. The operator disputed the determination on the temporary generators but said it would apply for air permits. Forrester senior analyst Abhijit Sunil told Data Center Knowledge that on-site generation moves impacts rather than removing them: "Taking pressure off the grid doesn't eliminate an environmental cost."

The political temperature is measurable. Fast Company reported on 30 September that between January 2024 and May 2026, at least 46 proposed AI data center projects across 20 states, representing more than $170 billion in announced investment, were blocked, withdrawn or stalled after community opposition, citing one industry analysis, and that Data Center Watch put $68 billion blocked or delayed between April and June of this year alone.

What is actually being built

On the supply side, the technical plumbing is improving in ways sports analytics will inherit. AWS announced on 30 September that Aurora PostgreSQL can now query Apache Iceberg and Parquet data directly, with DuckDB embedded in the database, available from Aurora PostgreSQL 17.11 and 18.6 at no additional charge. The pitch is the removal of extract, transform and load pipelines between operational and analytical stores.

That matters for anyone building real-time dashboards over live and historical event data, which is most of modern sports data engineering. Trigger.dev described on 30 September its upgrade of a 56TB Aurora Postgres cluster growing at 250GB per day, moving 1.23TB of control plane data to PlanetScale and leaving cold run data behind, with a 90-second impact on requests for old runs. At that scale, the operational discipline is the product.

Policy is moving too. Light Reading reported on 30 September that Omdia expects digital sovereignty, persistent supply chain disruption, AI monetisation pressure and physical AI to shape 2027, with more than 100 countries pursuing sovereignty initiatives and 59% of organisations expecting AI budgets to rise by 10% or more. Omdia also noted hardware delays already affecting 60% of PC channel partners.

None of this is a sports story yet. It is the ground the sports story stands on, and this week it moved.