But the teen’s mother, Michelle Bottoms, is quick to warn other parents that the collection of children’s biometric data by youth sports is “literally happening all across the country.”
And there are “no guardrails” when it comes to what companies can do with kids’ data. “Because once they have it, someone else has it. It’s not yours anymore,” she said.
‘No guardrails’ on how companies use kids’ data
It was in the fall of 2025 that Virginia residents Michelle and Doug Bottoms first discovered that the flag football leagues hosting their then-12-year-old son’s team tournaments required a digital ID for all players.
Representatives of RCX Sports — which operates NFL Flag, the NFL’s flag football program — told the Bottoms that NFL Flag had partnered with the data broker company National Sports ID (NSID).
Under the new partnership, NFL Flag required all players to upload a digital headshot and age-verification documents to the data broker before they could play in the tournaments.
Submitting their son’s biometric data didn’t feel right to the Bottoms. “We started tearing into the terms of service, which takes time,” Doug said.
That’s when Doug and Michelle discovered there were “no safeguards at all” when it came to their son’s biometric data.
The terms of service agreements gave the data broker, which contracted with the sports leagues, the right to share the child’s biometric data with their partners, affiliates and foreign countries.
According to Doug, the companies are creating digital ID profiles for children as a business asset, with no requirement to delete the data. The data could trade hands if and when the business is sold or merged. Parents and children don’t control the data. “The companies do,” he said.
“There’s no guardrails on where it can go and what they can do with it — and that’s the scary part,” Michelle said, “because once they have it, someone else has it. It’s not yours anymore.”
Industry ‘racing to normalize digital IDs for children through sports participation’
As Doug and Michelle soon learned, the practice of requiring digital ID for kids’ sports extends far beyond their own experience with their son.
RCX Sports has a wide reach. In addition to operating NFL Flag, it is also the youth arm for other national sports leagues, including the NBA, Women’s National Basketball Association, MLS, NHL and the National Baseball League.
Attorney Greg Glaser, who handles Children’s Health Defense (CHD) digital privacy lawsuits, said NFL Flag alone operates over 1,800 locally run leagues with over 585,000 youth athletes in all 50 states and Canada.
That means the collection of children’s biometric data in youth sports is “literally happening all across the country,” Michelle said.
For example, another tournament-hosting organization, Flag Football Life, partnered with Zorts Sports to require digital IDs for players. Zorts Sports verifies kids’ IDs by scanning their faces when they show up to play, and comparing the image to the child’s digital headshot submitted by the parents.
Doug called the system “dystopian.” He said, “There’s no other word for it, where kids are just lining up to have their faces scanned in order to check into a sporting event.”
But according to the Zorts Sports website, its “Flash Face ID technology” allows for quick check-ins and roster checks, “simply by pointing the camera at each player.”
Zorts Sports and NSID claim their ID and age-verification tools save coaches time.
But according to Glaser, the companies are monetizing the data they harvest from children. “The privacy policies admit to profiling children and families for ‘targeted advertising strategies,’” he said.
Companies also track children’s social media history and use it to market to them and their families. According to the NSID website, sport organizations that partner with the company can use the data to drive sales by running targeted ad campaigns on Google or Facebook.
Zorts has shared over $1.1 million with tournament organizers, Glaser said. “That creates a coercive financial loop, designed to get leagues to mandate the companies’ platforms” in exchange for financial gain, he said.
And the issue is growing worse — because the companies are expanding how they use the data they collect, according to Glaser, who said:
“Zorts is feeding the Flash Biometrics database, a subsidiary that advertises its facial recognition platform for government, educational institutions, financial services and large-scale events far beyond youth sports. The industry is racing to normalize digital IDs for children through sports participation.”
FTC not enforcing federal law intended to protect kids’ privacy
Doug and Michelle Bottoms contacted Glaser to help them secure an exemption so their son could avoid the leagues’ digital ID requirement.
“The Bottoms family, backed by CHD, successfully forced these leagues to accept manual, paper-based age verification,” Glaser said.
They showed that making digital ID a requirement for kids to play flag football was illegal — because the Children’s Online Privacy Protection Act (COPPA) prohibits operators from conditioning participation on the disclosure of more personal information than is reasonably necessary.
The leagues were able to manually verify the teen “without any problem,” Glaser said, “But they refuse to offer this traditional and less invasive option to the general public.”
On Dec. 9, 2025, Glaser filed a complaint on behalf of the Bottoms with the Federal Trade Commission (FTC).
The complaint calls on the FTC to enforce COPPA. It also asks the agency to mandate that digital IDs in youth sports leagues be voluntary and operate on an opt-in basis.
The FTC should also protect children’s data by prohibiting companies from sharing children’s data with company “partners,” affiliates and foreign entities unless parents explicitly consent to it in an uncoerced way, according to the complaint.
The FTC confirmed that it has entered the Bottoms’ complaint in its database of cases. However, the agency has not indicated that it has launched an investigation or plans to enforce COPPA, Glaser said.
When asked if and when the agency plans to take action, an FTC spokesperson told The Defender in an email that the agency “can’t comment on these matters.”
Using a CHD action alert, over 2,000 people so far have urged the FTC to immediately begin investigating the data broker companies and mandate voluntary “opt-in” defaults for any digital ID in youth sports, Glaser said.
“This public pressure is essential to move the FTC toward actual enforcement,” he said.
FTC signals support for digital ID for children
Recent FTC actions suggest that the agency favors digital ID for children.
A Jan. 28 FTC meeting transcript shared with The Defender revealed that the FTC was considering age-verification technologies as a way to ensure that children do not access unauthorized online content.
On Feb. 25, the FTC announced it would not bring a COPPA against certain website and online service operators that collect, use and disclose personal information for the sole purpose of determining a user’s age via age verification technologies.
“Age verification technologies are some of the most child-protective technologies to emerge in decades,” said Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, in a press release.
The FTC isn’t alone in defending age-verification technologies. In a Feb. 10 letter, 40 state attorneys general (AGs) urged federal lawmakers to support the U.S. Senate version of the Kids Online Safety Act.
On Aug. 5, the U.S. Senate Commerce Committee advanced a package of bills, including the Kids Online Safety Act, which would require government officials and agencies to devise a plan for how computers, cellphones and operating systems could verify people’s age.
“The FTC’s idea of a solution is tech advancement, while we really need regulation prohibiting the aggregation of children’s data,” Doug said.
According to Doug, the FTC should also investigate what is being done with the data of children whose parents did not know they could seek an exemption from the leagues’ digital ID mandate and surrendered their child’s biometric data.
“There’s potentially some damage that’s been done to some very innocent children who just want to play a sport,” he said. “Where’s their data now and how is it being used? Should there be required deletions of data, if that’s even possible?” he asked.
Will Virginia’s AG get involved?
On March 13, the Bottoms sent a letter to Virginia’s AG office about how the leagues’ practice also violates Virginia’s consumer data protection law.
Virginia AG Jay Jones was not one of the 40 AGs who urged Congress to pass the Kids Online Safety Act.
The Bottoms urged the AG office’s consumer protection division to coordinate with the FTC to ensure that both federal and state privacy laws are enforced.
“The safety of Virginia’s children should not be the admission price for youth sports,” the letter stated.
The Bottoms also asked the AG office to seek civil penalties of up to $7,500 per violation if the leagues fail to implement a permanent, non-digital opt-out for Virginia families.
“Many children and parents and families have no idea what the leagues are doing,” Michelle said. That needs to stop, she said.
Doug agreed. “There’s clearly powerful entities that want digital ID. Nobody voted for them.”
Digital IDs should never be a requirement for access to any part of society, Doug added.
The Virginia AG office did not immediately respond to our request for comment.
Via Via https://childrenshealthdefense.org/defender/no-guardrails-youth-sports-leagues-mandate-digital-id-sell-kids-biometrics-profit/
(Photo credit: Alex Brandon / Ap Photo/alex Brandon)
(Photo credit: Ammar Awad/Reuters)
Photo Credit: The Cradle
