Meta, 43.9 Million Violations, and the Silence No One in Football Has Turned To

In a New Mexico courtroom, at the moment the jury announced its verdict, no reporter in the room had prepared for the number that followed. The jury found Meta, Facebook's parent company, liable for 43,899,725 violations of the state's consumer-protection law. Not 43 million users affected. But 43,899,725 separate legal violations, each potentially punishable by up to USD 5,000 under New Mexico's Unfair Practices Act. I read the verdict three times. Not because of the shock of the number, but because of its structure. This was a case about data, about how a platform collects, stores and monetises the personal information of tens of millions of people, then describes that act in language drafted by lawyers. The New Mexico jury did not buy that language. They counted each violation, and the final figure was large enough that the state estimated the penalty could reach billions of dollars, though the final amount will be decided by a judge. When I closed the file, the question that surfaced was not about Meta. It surfaced about my own profession. While the whole world fixed its gaze on Big Tech, another industry had quietly built its own data empire, and that industry is football. We call it by a very wholesome name: fan engagement. To understand why a verdict in an American desert state made a journalist sitting in Incheon reopen his entire archive, we need to go back to 2026, when Christopher Wylie, a former Cambridge Analytica employee, stepped before the public and told the story of how the personal data of tens of millions of Facebook users had been exploited for political campaigns. That scandal is tied to the 2026 US presidential election, and it turned the phrase data protection from a dry technical topic into a global moral question. Six years later, New Mexico became the only US state to take Meta's case before a jury trial rather than settling out of court. The verdict is a milestone, but I noticed another detail in the file: TikTok, the next social platform on the list, is also facing similar legal pressure in the United States. That means the per-violation liability model is becoming a template, not an exception. Throughout that decade, as American courts wrestled with the question of who owns user data, the football industry in Europe and Asia answered that question in a different way. Their answer fit neatly into a clause in an appendix that most sports journalists, even the best ones, never turn to. I began my investigative career with a case I still tell as an introductory lesson. In 2026, during the summer transfer window, I cross-checked Busan IPark's financial reports against the player registration records at the Korea Football Association. There was a discrepancy of 2.3 billion won tied to the transfer of striker Kim Hyun-sung. I dug into the agency fee lines and found a shell company registered on Jeju Island, with no real office, no real staff, only a string of account numbers and a signature. But what chilled me more than the money was another column in the spreadsheet. It was the fan data column. The club collected information from hundreds of thousands of supporters through its ticketing system, mobile app and membership cards, then resold it to sponsorship partners and a handful of betting companies, with the value recorded in the reports as an invisible revenue stream. No one asked those supporters whether they had agreed. Numbers do not lie, but the people who write the reports do. Three years later, when the pandemic halted the entire league in 2026, I retreated into a project analysing the transfer history of 48 Korean clubs. I found a pattern: teams whose chairman was also a local government leader often concealed unpaid wages through undeclared image-consulting contracts. Seongnam FC was the textbook case, with 4.7 billion won of unpaid wages booked into murky advertising transactions. I found contracts buried under three layers of appendices and one layer of silence. And in those three layers of appendices, there was always a clause on the right to use players' and supporters' image and personal data, extending indefinitely. That was when I realised football and Big Tech are no different in business nature. They differ only in the level of scrutiny. Meta was counted violation by violation by a US state demanding USD 5,000 each. A Korean football club selling the data of a hundred thousand supporters to a betting company is called a strategic commercial partnership. The difference is not morality. It is whether anyone bothers to turn each page of the appendix. Let us try applying New Mexico's per-violation liability model to football, just to see what the number would look like. A club in the Korean national championship has roughly two hundred thousand users on its official app. If their system collects location data, payment data and biometric data without clear consent, and if each affected account counts as one violation, the number would exceed hundreds of thousands. Multiply by ten leagues, multiply by twenty countries, and you understand why no one wants to open this investigation. Football is not clean, but financial reports taught me how to find the stains line by line. And the lines about fan data are always at the bottom of the table, under a heading no one reads. In Europe, the problem is even more serious. Big clubs no longer simply sell tickets. They run ecosystems of mobile apps, streaming platforms, e-wallets, loyalty programmes and even financial products linked to betting services. Every time a supporter scans a ticket at the gate, every time they log in, every time they watch a match online, a new data point is created and flows into a database no one audits. The hidden transfer is not in the news; it is in the footnote no one turns to. The irony is that football itself has given the data industry its most sophisticated tools. GPS systems in shirts, sensors in balls, player motion-tracking data have turned sport into an industrial-scale data-collection laboratory. I have spent years tracing fitness data to its source, from the gym to the laboratory, and I know that a sensor fitted to measure heart rate can also be fitted to measure a person's habits. Russian fitness is not a gym story, it is a laboratory story, and the story of fan data is the same: it does not begin with the ticket, it begins with the line a supporter clicks to agree without reading. In the Qatar 2026 file I obtained, there was a detail few noticed. Alongside the 8.2 million USD flow split into 11 small transactions, the organisers also signed audience-data distribution contracts with technology and media partners, in which the right to exploit viewers' behavioural data was valued higher than some traditional sponsorship contracts. The data of a supporter standing in the stands, who came only to sing the anthem and drink beer, is worth more than a billboard. The per-violation liability model New Mexico used was not designed for football. It was designed for platforms with tens of millions of users. But its logic can migrate. Imagine a Korean supporter discovering their personal data was sold to a betting company not on the published partner list. The issue is no longer public opinion. The issue is the violation count times the penalty, and a club already behind on wages will not have enough to pay. At that point, the name called in the courtroom will not be Meta, but the very club its supporters trusted for a lifetime. I wonder whether the football industry is aware of this. My answer is yes, and that is why they are silent. Silence is also a form of evidence, and it is filed with the record. Every blank space in a sponsorship contract, every coded line in the balance sheet, every appendix left on the last page, all are answers written in evasion. My file on fan data is thicker than I thought, but still thinner than the conscience of those who signed it. There is a counterargument I am forced to raise myself, and it is stronger than I would like to admit. Not every club is Meta. Collecting fan data can serve legitimate purposes: improving the stadium experience, personalising match information, detecting safety issues in the stands early, and generating revenue to fund youth academies. If a small provincial club uses its supporters' data to invite them to a free match for children, that is not a crime. Learning proper data governance is also a way of professionalising a football industry still running on handwritten paperwork. The real issue is not the nature of the data, but the power imbalance between those who create it and those who exploit it. Supporters have no bargaining power. No one reads them the contract. No agency specifically monitors data in sport. Continental football confederations check financial fair play, check transfers, check doping, but no one checks where supporters' data flows. The reasonable point of those defending the clubs is that they compete in a brutal market where every revenue stream is necessary. If a club voluntarily gives up its data revenue, it will weaken on the pitch, and supporters will not forgive failure, even when that failure comes from protecting their own interests. This is the exact paradox the technology platforms face: users want free services, and free services must be paid for with something else. The easy answer, to just let everything happen, is what took New Mexico to a jury. But there is a deeper blind spot both sides ignore. Football is not selling data to fund youth academies. Most of that revenue does not go to the pitch, but to intermediary companies, investment funds and advisory contracts with no product. Fan data, like transfer money, is being used to mask other money flows. And when ownership structures become complex, when many clubs sit in the hands of funds in Cayman or Luxembourg, tracing who owns the data of a Bucheon supporter becomes a problem with no answer. That is why I do not believe in an approach focused only on Big Tech. Meta was taken to court because its platform had tens of millions of interaction points, and because enough people read enough to build a file. A football club has fewer interaction points, but has something Meta does not: loyalty. Supporters believe in their club as they believe in a part of their identity, and that belief is what makes them sign anything without reading. That belief is the most valuable asset, and the least protected. During my career, I learned one thing from the Busan case and the Seongnam case. When you have gathered enough data, stop and ask: what was not written into the record? With Meta, what was not written is how many people actually read the terms. With football, what was not written is the revenue-sharing mechanism for fan data between the club, the parent company, the betting partner and unnamed intermediaries. That blank space is not carelessness. That blank space is designed. Football is not clean, and I never write about it as if it were. But I do not write about it as if it were the enemy of supporters either. The truth is that everyone in this system, from the supporter to the club president, lives on the same belief: that the match matters. And because that belief matters, the data generated from it needs to be protected by rules that have been written down, not by a silence renewed every transfer window. I do not await a New Mexico-style investigation in football. I await something else: a sports journalist stopping at the data clause in the appendix, reading it to the end, then asking the club a question at the press conference. A lawyer realising that USD 5,000 per violation, multiplied by ten thousand supporters, could bankrupt a club. And a supporter, for the first time, asking their club where my data is, how much it is worth, and to whom it was sold. The first question is always the hardest, and also the only one that truly opens the file. In the meantime, I still fill dates, account numbers and transactions into my spreadsheet, encrypt them, and keep a copy. Not because I am certain what will happen. But because I know what has not been written down, and the blank spaces in a record are always filled in at some point.