Every company selling into a rights-holder eventually claims a data moat. Very few have one. The claim usually rests on volume — millions of records, billions of events — when the question that determines defensibility is not how much data a company touches, but what it would keep if every customer contract ended tomorrow.
This is a short field guide to that question. We use a version of it in every diligence process where fan data forms part of the thesis.
Owned, rented and borrowed
It helps to sort data into three buckets before evaluating anything else.
- Owned Collected by the company, under its own consent, in a relationship the fan has with the company. Rare, and usually only in direct-to-consumer products.
- Rented Collected on behalf of a rights-holder, under the rights-holder’s consent, held by the company as a processor. This is the overwhelming majority of fan data in the sector, and it goes home when the contract ends.
- Borrowed Received from a third party — a broadcaster, a resale platform, a payments provider — under terms that may not survive that party’s own commercial changes.
A company whose asset is rented can still be an excellent business. What it cannot claim is that the data itself is the moat, because the customer can take it back. Confusing the two leads to valuations that assume a durable asset where there is really a durable relationship — which is a different, and often better, thing to underwrite.
The five questions
We work through these in order, and the answers are usually available inside an hour with the right person in the room.
One: what is the consent unit? Is consent captured per purpose — marketing, personalisation, sponsor sharing, research — or bundled into one acceptance? Bundled consent is fragile: it does not survive a regulator’s attention, and it cannot be re-used for a new purpose without going back to the fan. Per-purpose consent, stored with the legal basis and the timestamp, is the difference between a monetisable audience and a liability.
Two: who is the controller? Read the data processing agreement. In almost every rights-holder contract, the club is the controller and the vendor is the processor. That determines who may licence the audience to a sponsor, who answers a subject access request, and who owns the export at termination.
Three: what does identity resolution actually do? Ask to see the match rate between anonymous and identified records, and ask what it was twelve months ago. A resolution engine that improves with each new rights-holder — because the underlying population overlaps, or because the matching logic learns — is a genuine compounding asset. One that resolves each tenant in isolation is a feature.
Four: what happens at termination? Can the rights-holder export a complete, consented dataset in a usable format, including the consent record itself? If yes, the vendor has a relationship moat and should be valued as such. If no, the vendor has a lock-in that will eventually be renegotiated under duress, usually at renewal, usually badly.
Five: does the data change a decision? The most common failure is a beautiful single-customer view that nobody uses. We ask which decision changed because of it: a price, an allocation, a stocking level, a sponsorship valuation. If the answer is “we produce a dashboard”, the product is reporting, and reporting is bought at a much lower price than infrastructure.
Volume is not a moat. A consented, portable, per-purpose record that improves the buyer’s next decision is a moat — and it is usually smaller than the number in the pitch deck.
Where genuine defensibility comes from
In our experience there are only three durable sources in this sector, and they are all structural rather than volumetric.
The first is the system of record. A company that issues the admission credential holds the only dataset that reliably links a person to an attendance. That position is hard to displace because replacing it means replacing the gate, and nobody replaces the gate mid-season.
The second is cross-tenant learning that is lawful. Some products genuinely improve for every customer as more join — fraud models, demand forecasting, seat-level pricing. The critical word is lawful: the improvement must come from aggregated, de-identified signal that the processing agreements permit. We ask counsel to look at this specifically, because a model trained on data the company was not permitted to use is a contingent liability rather than an asset.
The third is workflow entrenchment. When a ticketing director runs their season on a vendor’s allocation and ballot tooling, switching means retraining a department during the only quiet weeks of the year. That is unglamorous and extremely durable.
A company that quotes total records under management but cannot quote its per-purpose consent rate from memory. The first number is inventory; the second is the only one that can be sold to a sponsor or defended to a regulator.
The regulatory floor is rising
Any assessment of a fan data business now has to price the compliance trajectory. The European and United Kingdom regimes have settled into a pattern where consent quality, retention discipline and international transfer mechanisms are examined seriously. The California framework has moved in the same direction, with rights to know, delete and correct, and with meaningful obligations around how sharing is defined. Several other United States states have followed with their own statutes.
For an investor, the practical consequence is simple: the cost of retrofitting consent architecture into a product that did not have it is high and rises with scale. We would rather fund a company with a smaller, cleaner dataset and a defensible model than a larger one that will spend its Series B deleting records it should never have held.
What we conclude
The honest summary is that most fan data moats are relationship moats wearing a data costume. That is not a criticism. Relationships with rights-holders are hard to build, slow to erode and worth paying for. But they should be underwritten as what they are: contracts with renewal risk, seasonality and political exposure, not as a proprietary asset compounding on a server.
When we find the real thing — a system of record, lawful cross-tenant learning, deep workflow entrenchment — we pay attention, and we are willing to be patient about the growth rate. Those positions are rare, and they are usually being built by a team that talks about consent before it talks about scale.