Disclosure to Sports Leagues, Employers, and Governing Bodies

What it is

FanDuel may share your personal information, device identifiers, and precise location with sports leagues, colleges, governing bodies, and employers to help them enforce their own rules about who is allowed to bet, potentially including flagging your activity to your employer.

Why it matters (compliance & governance perspective)

This provision goes beyond standard law enforcement or fraud-prevention disclosures and authorizes FanDuel to share your identifying information with your employer or a sports organization without a court order or your specific consent, which could have professional or legal consequences for users who are athletes, employees of teams, or affiliated with competing platforms.

This document changed recently

Consumer impact (what this means for users)

If you are an athlete, team employee, or someone affiliated with a sports organization or competing daily fantasy platform, FanDuel may disclose your identity and activity to your employer or governing body, potentially affecting your employment or eligibility without prior notice to you.

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision implicates state and federal privacy frameworks, including the CCPA under which disclosure to third parties for non-advertising purposes may still constitute sharing of personal information requiring adequate notice. The FTC's unfair or deceptive practices authority is relevant if consumers reasonably could not anticipate employer-directed disclosures from a consumer gaming platform. Gaming regulators in jurisdictions where FanDuel operates have independent authority over disclosure requirements, which this provision acknowledges as a basis for sharing. (2) GOVERNANCE EXPOSURE: High. The authorization to disclose personal information to employers and sports organizations in connection with their internal eligibility rules is operationally distinct from standard law enforcement or legal process carve-outs. This disclosure does not require a subpoena, court order, or regulatory demand and is triggered at FanDuel's good faith judgment, creating exposure if disclosures are later found to be disproportionate or insufficiently grounded in legal necessity. (3) JURISDICTION FLAGS: Users in states with broad privacy rights (California, Colorado, Virginia, Connecticut) may have grounds to challenge the adequacy of notice for this type of disclosure. EU and UK users, if any are inadvertently covered, would face heightened scrutiny under GDPR proportionality and purpose limitation principles. Professional athletes and team employees represent a population with heightened exposure regardless of geography. (4) CONTRACT AND VENDOR IMPLICATIONS: The reference to league-designated vendors as disclosure recipients introduces a secondary data sharing chain that may not be fully described in the policy. Procurement teams and compliance officers should assess whether contractual protections extend to these downstream recipients and whether data processing agreements are in place with league-designated vendors. (5) COMPLIANCE CONSIDERATIONS: Legal teams should evaluate whether the breadth of this provision, particularly the employer and competitor-affiliate disclosure component, satisfies proportionality requirements under applicable state privacy laws and whether enhanced notice or a separate consent mechanism is warranted for user populations most likely to be affected.

Applicable agencies

Provision details

Other risks in this policy

• Precise GPS Location Collection and Third-Party Sharing high
• Data Sale and Targeted Advertising Opt-Out medium
• Identity Document Collection as Mandatory Condition high
• Audio Recording of Customer Communications medium
• Third-Party Targeted Advertising and Cross-Device Tracking medium
• Corporate Transaction Data Transfer medium