The Open Sports Data Alliance develops guidance and recommended practices for companies that hold sports and activity data. We help device makers, activity hubs and apps meet their obligations under the EU Data Act and the GDPR, and apply the same practices wherever they operate, so that athletes can access their data and share it with the services they choose.
Which data is available to the athlete, and which is the company's choice?
Heart rate as measured by the sensor.
Spikes and dropouts removed. Processing disclosed.
Calculated by the company's own algorithm.
Activity data now flows from watches, bike computers, rings and phones, through platforms and APIs, to coaching, health, research and artificial intelligence services. Data protection laws around the world give athletes rights over this data, and European legislation sets these rights out most completely. No law specifies how companies should implement them for activity data.
People are entitled to receive the personal data they have provided, including data recorded by their own devices, in a structured and machine-readable format, and to have it transmitted to another service. This applies to device makers, platforms and applications alike.
Applicable since 12 September 2025. Users of connected products are entitled to access the data their products generate, continuously where relevant, and to have it shared with services of their choice. Products placed on the market from 12 September 2026 must be designed to make that data accessible.
Each company currently interprets the same obligations independently. Smaller companies often lack the resources to do so.
Developers encounter different interpretations, and different terms, at every platform they connect to.
Athletes have limited visibility of which services hold their data and for what purpose.
Our guidance builds on the GDPR and the Data Act because they set out these rights most completely, not because the Alliance is European. We read them as good practice that has been written into law. The Alliance is not a regulator and does not enforce legislation. Its recommendations stand wherever a company is established, and whether or not a law requires them.
That people may obtain the data held about them and know how it is used was set out in the OECD Privacy Guidelines in 1980. Portability and access to device data extend that principle to connected services. European law made it enforceable. It did not invent it.
The United Kingdom, Switzerland, Brazil, California and a growing number of other US states give people a right to a portable copy of their data. App stores and data platforms impose comparable conditions on developers worldwide through their terms.
A company serving athletes in several markets usually finds it easier to meet one demanding standard than to maintain a different practice for each. Any company with users in the European Union is subject to it already.
The sports technology industry is global, and so is the Alliance. Membership, voice and guidance are the same for every member, wherever it is established. Because our guidance names the source of every requirement, each company can see which ones bind it by law and which it adopts as good practice.
The Alliance publishes two complementary documents. Every statement in them is identified as either a legal requirement or a recommendation.
What the GDPR and the Data Act require of companies that hold activity data, explained in plain language.
How to meet those obligations well. Voluntary, and expressed as outcomes rather than a single prescribed API.
Short, practical material based on the Alliance's guidance, available to everyone. Each resource is a working draft and cites the source of every requirement. Use them to prepare and to brief your lawyer. They do not constitute legal advice.
Eleven legal requirements that apply from the first user and five practices that are easiest to adopt early, each with concrete steps, an effort estimate and, where useful, a model text. For founders of start-ups that collect or receive sports and activity data.
What your privacy policy must cover, including the statements required by the platforms you connect to, health and menstrual cycle data, the age of your users and US health privacy laws.
What your terms must and must not say when you offer a sports or training service to consumers in Europe: changes, subscriptions, liability, health claims, user content and the terms you must pass on from your data sources.
Four tiers of AI use, from insights for the athlete to training models, with what the platforms you connect to allow, the consent each tier requires, and model texts for asking athletes.
Athletes decide who may hold the data they generate, what it may be used for, including artificial intelligence, and whether it may be passed on. This applies equally to every company that holds it.
Heart rate, location, power, workouts and sleep, in raw or cleaned form, including the athlete's complete history. Available to the athlete and to any service they choose.
Proprietary metrics, algorithms, product designs and trade secrets. A company may choose to keep these to itself or to share them. European legislation protects that choice.
A proprietary metric may be offered alongside the data from which it was calculated. It should not replace that data.
We recommend no restriction on using data in competing services. Better products are the purpose of portability.
Platforms may charge other companies for access. Fees should be published, reasonable and non-discriminatory. Access for athletes themselves is free.
Membership is open to every organisation that holds or uses activity data, regardless of size or where it is established. Each member has a voice in what the Alliance publishes. Many companies fit more than one category.
Watches, bike computers, rings and sensors.
Contributes: Knowledge of what devices record, and how.
Gains: A shared reading of the Data Act, and protection for proprietary metrics.
Training logs, route planners and athlete communities.
Contributes: Experience of running the APIs that many apps rely on.
Gains: Clarity on portability, and trustworthy services to share data with.
APIs that connect apps to many data sources.
Contributes: Practical knowledge of formats and terms across many sources.
Gains: Clarity on their role as processor, and a credible signal of trust.
Training, coaching, nutrition, health and AI apps.
Contributes: The services athletes share their data for.
Gains: Predictable access, clear rules for AI, and a trust mark athletes recognise.
Sports science, public health and academia.
Contributes: Independent evidence and scientific expertise.
Gains: An ethical, consent-based route to data.
Tools that read data directly from athletes' devices.
Contributes: Longer use of devices, including those no longer supported.
Gains: Clear boundaries for lawful direct access.
Everything we publish is assessed first on whether it gives athletes control over the data they generate.
Every statement is identified as either our reading of legislation or our recommendation.
Obligations apply equally to every party that holds an athlete's data. Members follow our guidance wherever they operate, and even where legislation exempts them.
We build on legislation and established standards before writing anything new.
A company may choose to keep its proprietary metrics, algorithms and trade secrets to itself.
Certification will involve independent audits and the possibility of revocation, not self-assessment.
Drafts are reviewed by members. Final guidance is published openly.
We operate under competition law counsel. Members do not discuss pricing or commercial terms.
The Alliance does not create new rights. It helps implement existing rights for activity data, and cites the source of every requirement.
| Subject | Source |
|---|---|
| Portability of personal data to another service | Art. 20 GDPR |
| Access to data generated by connected products | Art. 3–4 Data Act |
| Sharing data with a service chosen by the user | Art. 5–6 Data Act |
| Raw and cleaned data versus derived data | Recital 15 Data Act |
| Compensation when data is shared at a user's request | Art. 8–9 Data Act |
| Unfair contractual terms between companies | Art. 13 Data Act |
| Consent and health data | Art. 7, 9 GDPR |
| Codes of conduct and certification | Art. 40–42 GDPR |
| Authorisation and data formats | OAuth 2.0, FIT, JSON |
The Alliance was initiated in March 2026 by SweatStack. It will be registered as an independent organisation, governed by its members. Its first guidance documents are in draft and will be reviewed by legal experts and founding members before publication.
Purpose, scope and principles of the Alliance.
Draft 0.1 of the Activity Data Compliance Guide and the Recommended Practices.
Review of the drafts by legal experts and founding members.
Registration as a separate legal entity, governed by its members. The legal form will be chosen with the founding members.
Publication of the first edition, and engagement with the European Commission.
No. The Alliance does not campaign for or against any company and does not negotiate commercial terms on behalf of its members. It publishes guidance and recommendations that any organisation may use.
No. Certification will indicate that an organisation handles activity data responsibly. Each platform continues to decide whom it works with, within the requirements of applicable legislation.
No. The guidance explains obligations under European legislation and cites the source of each one. It becomes final after review by our members and legal experts. It does not replace legal advice or the interpretation of regulators and courts.
Micro and small enterprises are exempt from certain obligations of data holders under the Data Act. The GDPR, including the right to data portability, continues to apply. Members of the Alliance follow its guidance regardless of their size.
Yes. A company may choose to keep its proprietary metrics, algorithms and trade secrets to itself, and the Data Act protects that choice. The Alliance's guidance concerns the data athletes generate, including their complete history.
Yes. The Data Act and the GDPR apply to every company serving users in the European Union, wherever it is established. Beyond that, the Alliance treats them as good practice: the Recommended Practices are written for use worldwide, and membership is the same for every company, wherever it is established. See European law as the reference, not the boundary.
Members and observers both see the guidance while it is being written. Only members help decide what the Alliance publishes.
Help shape the guidance. Members comment on every draft and have a say in what is published. Organisations that join now are founding members.
Suited to: Companies that hold or use activity data.
Follow the guidance as it develops. Observers see every draft and can share their expertise, but do not take part in decisions.
Suited to: Research and health organisations, and companies that want to follow the work before deciding to join.