MAIN Event Ticketing Act

The bill would amend the Better Online Ticket Sales Act of 2016 (BOTS Act) in two main ways. First, it would expand the existing prohibition on ticket-buying bots to cover applications that circumvent access-control systems, security measures, or other technological controls on ticket-sale websites — not just software that violates a site's posted purchasing limits. Second, it would impose new affirmative duties on online ticket issuers: establish and regularly update security controls to enforce ticket purchasing limits, report known circumvention incidents to the Federal Trade Commission within 30 days of discovery, and take reasonable steps to address the causes of any known circumvention. The FTC would be required to publish compliance guidance within one year of enactment.

The bill would also extend the BOTS Act's existing enforcement mechanisms to cover the new security and reporting requirements, and would direct the FBI, the Attorney General, and state and local law enforcement to coordinate with the FTC on sharing information about cyberattacks targeting ticket-selling platforms. The FTC would be required to report to Congress within one year on the status of enforcement actions and any identified limitations on its ability to pursue circumvention violations. The bill does not apply to offline ticket sales or non-commercial ticket transfers.

Online ticket issuers — companies and platforms that sell event tickets to the general public through websites or online services — would face new obligations to build and maintain security systems and report breaches. Bot operators who circumvent those security systems would face exposure under expanded BOTS Act prohibitions. Concert, sports, and other live-event fans are the intended beneficiaries of stronger anti-bot enforcement.

Online ticket sellers would be legally obligated to invest in security infrastructure and notify the FTC when those systems are defeated, giving regulators a clearer, data-driven picture of the bot problem and a stronger basis for enforcement. The broader bot prohibition explicitly covers circumventing security systems, closing a potential loophole that allowed bot operators to argue their tools did not technically violate posted purchasing rules.

Online ticket issuers would build or upgrade access-control systems and report discovered circumvention incidents to the FTC electronically within 30 days. The FTC would share those reports and related consumer complaints with state attorneys general as appropriate, and coordinate with the FBI and the Attorney General on cyberattack intelligence. Within one year, the FTC must issue compliance guidance — though that guidance cannot independently bind parties or serve as the sole basis for enforcement. The FTC must also file a congressional report within one year covering enforcement activity and any gaps in its authority to pursue circumvention cases.