United States 119th Congress Status: In Committee Bipartisan · 1 R · 1 D cosponsors

S 196 — MAIN Event Ticketing Act

Last action — Placed on Senate Legislative Calendar under General Orders. Calendar No. 144.

Track this bill free

No card. One bill, free forever — alerts when it moves.

  1. ✓
    Introduced
  2. 2
    In Committee
  3. 3
    Passed Senate
  4. 4
    Passed House
  5. 5
    To Executive
  6. 6
    Enacted

This bill is in committee in the Senate. Introduced January 22, 2025. It must pass committee before a floor vote.

Next likely step: a committee vote, then a floor vote in the Senate.

Prognosis

Advancing 34% · moderate confidence

Where this bill stands today.

Odds of enactment

Low

How often bills like it became law.

  • In Committee

    Current position in the legislative process.

  • 2 sponsors

    1 primary, 1 co-sponsors signed on.

  • Bipartisan support

    Sponsored across 2 parties (1 R · 1 D) — cross-party backing.

Prognosis reads this bill's own signals — stage, sponsorship breadth, committee status, recorded votes and cross-state momentum. Odds come from a model trained on which bills have become law.

Summary

Mitigating Automated Internet Networks for Event Ticketing Act or the MAIN Event Ticketing ActThis bill expands measures to protect the security and integrity of online ticket sales.Specifically, the bill prohibits the use of applications that perform automated tasks to purchase event tickets from online ticket sellers in circumvention of the seller's posted ticket purchasing order rules. This includes using software applications that circumvent access control systems or security measures.In addition, online ticket sellers must establish, implement, and maintain reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, integrity, or availability of the seller's website or service. Further, online ticket sellers must report known incidents of circumvention to the Federal Trade Commission and take reasonable steps to address any such incidents.The bill establishes civil penalties for violations of the provisions of this bill (and related prohibitions under current law) and authorizes the commission to bring civil actions for such violations.Federal, state, and local law enforcement agencies must coordinate as appropriate with the commission to share information about known instances of cyberattacks against the websites or online services used by ticket sellers.The commission must report to Congress on the status of enforcement actions taken under this bill.

Bill Text

What changed in the latest version

353 added · 175 removed

Plain-language change summary

The amendment makes several changes to the language of the bill, including the removal of the short title and provisions related to the Better Online Ticket Sales Act of 2016. One key change is the modification of the language regarding the use of automated applications for purchasing event tickets, specifically by removing references to circumventing purchasing order rules and access control systems. Additionally, the amendment introduces requirements for online ticket issuers to implement site policies and safeguards to enhance security. This matters because it clarifies the expectations for ticket issuers in terms of security measures and reinforces the enforcement of purchasing limits on their platforms.

→
Previous
Latest
196 Introduced in Senate (IS)] <DOC> 119th CONGRESS 1st Session S.
196 Reported in Senate (RS)] <DOC> Calendar No.
196 To improve online ticket sales and protect consumers, and for other purposes.
144 119th CONGRESS 1st Session S.
196 [Report No.
119-57] To improve online ticket sales and protect consumers, and for other purposes.
which was read twice and referred to the Committee on Commerce, Science, and Transportation _______________________________________________________________________ A BILL To improve online ticket sales and protect consumers, and for other purposes.
which was read twice and referred to the Committee on Commerce, Science, and Transportation September 2, 2025 Reported by Mr.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, SECTION 1.
Cruz, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] _______________________________________________________________________ A BILL To improve online ticket sales and protect consumers, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, <DELETED>SECTION 1.
SHORT TITLE.</DELETED> <DELETED> This Act may be cited as the ``Mitigating Automated Internet Networks for Event Ticketing Act'' or the ``MAIN Event Ticketing Act''.</DELETED> <DELETED>SEC.
2.
STRENGTHENING THE BOTS ACT.</DELETED> <DELETED> (a) In General.--Section 2 of the Better Online Ticket Sales Act of 2016 (15 U.S.C.
45c) is amended--</DELETED> <DELETED> (1) in subsection (a)(1)--</DELETED> <DELETED> (A) in subparagraph (A), by striking ``;
or'' and inserting a semicolon;</DELETED> <DELETED> (B) in subparagraph (B), by striking the period at the end and inserting ``;
or'';
and</DELETED> <DELETED> (C) by adding at the end the following new subparagraph:</DELETED> <DELETED> ``(C) to use or cause to be used an application that performs automated tasks to purchase event tickets from an Internet website or online service in circumvention of posted online ticket purchasing order rules of the Internet website or online service, including a software application that circumvents an access control system, security measure, or other technological control or measure.'';</DELETED> <DELETED> (2) by redesignating subsections (b) and (c) as subsections (c) and (d), respectively;</DELETED> <DELETED> (3) by inserting after subsection (a) the following new subsection:</DELETED> <DELETED> ``(b) Requiring Online Ticket Issuers To Put in Place Site Policies and Establish Safeguards To Protect Site Security.--</DELETED> <DELETED> ``(1) Requirement to enforce site policies.--Each ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall ensure that such website or service has in place an access control system, security measure, or other technological control or measure to enforce posted event ticket purchasing limits.</DELETED> <DELETED> ``(2) Requirement to establish site security safeguards.--</DELETED> <DELETED> ``(A) In general.--Each ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall establish, implement, and maintain reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, integrity, or availability of the website or service.</DELETED> <DELETED> ``(B) Considerations.--In establishing the safeguards described in subparagraph (A), each ticket issuer described in such paragraph shall consider-- </DELETED> <DELETED> ``(i) the administrative, technical, and physical safeguards that are appropriate to the size and complexity of the ticket issuer;</DELETED> <DELETED> ``(ii) the nature and scope of the activities of the ticket issuer;</DELETED> <DELETED> ``(iii) the sensitivity of any customer information at issue;
and</DELETED> <DELETED> ``(iv) the range of security risks and vulnerabilities that are reasonably foreseeable or known to the ticket issuer.</DELETED> <DELETED> ``(C) Third parties and service providers.--</DELETED> <DELETED> ``(i) In general.--Where applicable, a ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall implement and maintain procedures to require that any third party or service provider that performs services with respect to the sale of event tickets or has access to data regarding event ticket purchasing on the website or service maintains reasonable administrative, technical, and physical safeguards to protect the security and integrity of the website or service and that data.</DELETED> <DELETED> ``(ii) Oversight procedure requirements.--The procedures implemented and maintained by a ticket issuer in accordance with clause (i) shall include the following:</DELETED> <DELETED> ``(I) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue.</DELETED> <DELETED> ``(II) Requiring service providers by contract to implement and maintain adequate safeguards.</DELETED> <DELETED> ``(III) Periodically assessing service providers based on the risk they present and the continued adequacy of their safeguards.</DELETED> <DELETED> ``(D) Updates.--A ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall regularly evaluate and make adjustments to the safeguards described in subparagraph (A) in light of any material changes in technology, internal or external threats to system security, confidentiality, integrity, and availability, and the changing business arrangements or operations of the ticket issuer.</DELETED> <DELETED> ``(3) Requirement to report incidents of circumvention;
consumer complaints.--</DELETED> <DELETED> ``(A) In general.--A ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall report to the Commission any incidents of circumvention of which the ticket issuer has actual knowledge.</DELETED> <DELETED> ``(B) Consumer complaint website.--Not later than 180 days after the date of enactment of the Mitigating Automated Internet Networks for Event Ticketing Act, the Commission shall create a publicly available website (or modify an existing publicly available website of the Commission) to allow individuals to report violations of this subsection to the Commission.</DELETED> <DELETED> ``(C) Reporting timeline and process.-- </DELETED> <DELETED> ``(i) Timeline.--A ticket issuer shall report known incidents of circumvention within a reasonable period of time after the incident of circumvention is discovered by the ticket issuer, and in no case later than 30 days after an incident of circumvention is discovered by the ticket issuer.</DELETED> <DELETED> ``(ii) Automated submission.--The Commission may establish a reporting mechanism to provide for the automatic submission of reports required under this subsection.</DELETED> <DELETED> ``(iii) Coordination with state attorneys general.--The Commission shall-- </DELETED> <DELETED> ``(I) share reports received from ticket issuers under subparagraph (A) with State attorneys general as appropriate;
and</DELETED> <DELETED> ``(II) share consumer complaints submitted through the website established under subparagraph (B) with State attorneys general as appropriate.</DELETED> <DELETED> ``(4) Duty to address causes of circumvention.--A ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets must take reasonable steps to improve its access control systems, security measures, and other technological controls or measures to address any incidents of circumvention of which the ticket issuer has actual knowledge.</DELETED> <DELETED> ``(5) FTC guidance.--Not later than 1 year after the date of enactment of the Mitigating Automated Internet Networks for Event Ticketing Act, the Commission shall publish guidance for ticket issuers on compliance with the requirements of this subsection.'';</DELETED> <DELETED> (4) in subsection (c), as redesignated by paragraph (1) of this subsection--</DELETED> <DELETED> (A) by striking ``subsection (a)'' each place it appears and inserting ``subsection (a) or (b)'';</DELETED> <DELETED> (B) in paragraph (2)--</DELETED> <DELETED> (i) in subparagraph (A), by striking ``The Commission'' and inserting ``Except as provided in paragraph (3), the Commission'';
and</DELETED> <DELETED> (ii) in subparagraph (B), by striking ``Any person'' and inserting ``Subject to paragraph (3), any person'';
and</DELETED> <DELETED> (C) by adding at the end the following new paragraphs:</DELETED> <DELETED> ``(3) Civil action.--</DELETED> <DELETED> ``(A) In general.--If the Commission has reason to believe that any person has committed a violation of subsection (a) or (b), the Commission may bring a civil action in an appropriate district court of the United States to--</DELETED> <DELETED> ``(i) recover a civil penalty under paragraph (4);
and</DELETED> <DELETED> ``(ii) seek other appropriate relief, including injunctive relief and other equitable relief.</DELETED> <DELETED> ``(B) Litigation authority.--Except as otherwise provided in section 16(a)(3) of the Federal Trade Commission Act (15 U.S.C.
56(a)(3)), the Commission shall have exclusive authority to commence or defend, and supervise the litigation of, any civil action authorized under this paragraph and any appeal of such action in its own name by any of its attorneys designated by it for such purpose, unless the Commission authorizes the Attorney General to do so.
The Commission shall inform the Attorney General of the exercise of such authority and such exercise shall not preclude the Attorney General from intervening on behalf of the United States in such action and any appeal of such action as may be otherwise provided by law.</DELETED> <DELETED> ``(C) Rule of construction.--Any civil penalty or relief sought through a civil action under this paragraph shall be in addition to other penalties and relief as may be prescribed by law.</DELETED> <DELETED> ``(4) Civil penalties.--</DELETED> <DELETED> ``(A) In general.--Any person who violates subsection (a) or (b) shall be liable for--</DELETED> <DELETED> ``(i) a civil penalty of not less than $10,000 for each day during which the violation occurs or continues to occur;
and</DELETED> <DELETED> ``(ii) an additional civil penalty of not less than $1,000 per violation.</DELETED> <DELETED> ``(B) Enhanced civil penalty for intentional violations.--In addition to the civil penalties under subparagraph (A), a person that intentionally violates subsection (a) or (b) shall be liable for a civil penalty of not less than $10,000 per violation.'';</DELETED> <DELETED> (5) in subsection (d), as redesignated by paragraph (1) of this subsection, by striking ``subsection (a)'' each place it appears and inserting ``subsection (a) or (b)'';
and</DELETED> <DELETED> (6) by adding at the end the following new subsections:</DELETED> <DELETED> ``(e) Law Enforcement Coordination.--</DELETED> <DELETED> ``(1) In general.--The Federal Bureau of Investigation, the Department of Justice, and other relevant State or local law enforcement officials shall coordinate as appropriate with the Commission to share information about known instances of cyberattacks on security measures, access control systems, or other technological controls or measures on an Internet website or online service that are used by ticket issuers to enforce posted event ticket purchasing limits or to maintain the integrity of posted online ticket purchasing order rules.
Such coordination may include providing information about ongoing investigations but may exclude classified information or information that could compromise a law enforcement or national security effort, as appropriate.</DELETED> <DELETED> ``(2) Cyberattack defined.--In this paragraph, the term `cyberattack' means an attack, via cyberspace, targeting an enterprise's use of cyberspace for the purpose of-- </DELETED> <DELETED> ``(A) disrupting, disabling, destroying, or maliciously controlling a computing environment or computing infrastructure;
or</DELETED> <DELETED> ``(B) destroying the integrity of data or stealing controlled information.</DELETED> <DELETED> ``(f) Congressional Report.--Not later than 1 year after the date of enactment of this paragraph, the Commission shall report to Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives on the status of enforcement actions taken pursuant to this Act, as well as any identified limitations to the Commission's ability to pursue incidents of circumvention described in subsection (a)(1)(A).''.</DELETED> <DELETED> (b) Additional Definition.--Section 3 of the Better Online Ticket Sales Act of 2016 (15 U.S.C.
45c note) is amended by adding at the end the following new paragraph:</DELETED> <DELETED> ``(4) Circumvention.--The term `circumvention' means the act of avoiding, bypassing, removing, deactivating, or otherwise impairing an access control system, security measure, safeguard, or other technological control or measure described in section 2(b)(1).''.</DELETED> SECTION 1.
45c) is amended-- (1) in subsection (a)(1)-- (A) in subparagraph (A), by striking ``;
45c) is amended-- (1) in subsection (a)(1)-- (A) in subparagraph (A)-- (i) by inserting ``online'' before ``ticket issuer'';
and (ii) by striking ``;
``(C) to use or cause to be used an application that performs automated tasks to purchase event tickets from an Internet website or online service in circumvention of posted online ticket purchasing order rules of the Internet website or online service, including a software application that circumvents an access control system, security measure, or other technological control or measure.'';
``(C) to use or cause to be used an application, including a software application, that performs automated tasks to purchase event tickets from an Internet website or online service used by an online ticket issuer through the circumvention of an access control system, security measure, or other technological control or measure used by such Internet website or online service to enforce posted online ticket purchasing order rules of the Internet website or online service.'';
``(b) Requiring Online Ticket Issuers To Put in Place Site Policies and Establish Safeguards To Protect Site Security.-- ``(1) Requirement to enforce site policies.--Each ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall ensure that such website or service has in place an access control system, security measure, or other technological control or measure to enforce posted event ticket purchasing limits.
``(b) Requiring Online Ticket Issuers to Enforce Site Policies.-- ``(1) Requirement to enforce and update site policies.-- Each online ticket issuer shall-- ``(A) establish, implement, and maintain an access control system, security measure, or other technological control or measure to enforce posted event ticket purchasing limits and to maintain the integrity of posted online ticket purchasing order rules;
``(2) Requirement to establish site security safeguards.-- ``(A) In general.--Each ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall establish, implement, and maintain reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, integrity, or availability of the website or service.
and ``(B) regularly evaluate and make adjustments, as necessary, to such an access control system, security measure, or other technological control or measure in light of any material changes in technology, internal or external threats to system security, and the changing business arrangements or operations of the ticket issuer.
``(B) Considerations.--In establishing the safeguards described in subparagraph (A), each ticket issuer described in such paragraph shall consider-- ``(i) the administrative, technical, and physical safeguards that are appropriate to the size and complexity of the ticket issuer;
``(2) Requirement to report incidents of circumvention;
``(ii) the nature and scope of the activities of the ticket issuer;
consumer complaints.-- ``(A) In general.--Each online ticket issuer shall report to the Commission any incidents of circumvention of which the ticket issuer has actual knowledge not later than 30 days after the incident of circumvention is discovered by the online ticket issuer.
``(iii) the sensitivity of any customer information at issue;
``(B) Electronic submission.--The Commission may establish a reporting mechanism to provide for the electronic submission of reports required by subparagraph (A).
and ``(iv) the range of security risks and vulnerabilities that are reasonably foreseeable or known to the ticket issuer.
``(C) Coordination with state attorneys general.-- The Commission shall share with State attorneys general, as appropriate-- ``(i) any report received from online ticket issuers under subparagraph (A);
``(C) Third parties and service providers.-- ``(i) In general.--Where applicable, a ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall implement and maintain procedures to require that any third party or service provider that performs services with respect to the sale of event tickets or has access to data regarding event ticket purchasing on the website or service maintains reasonable administrative, technical, and physical safeguards to protect the security and integrity of the website or service and that data.
and ``(ii) consumer complaints related to any violation of this subsection that are submitted through the Commission's website.
``(ii) Oversight procedure requirements.-- The procedures implemented and maintained by a ticket issuer in accordance with clause (i) shall include the following:
``(3) Requirement to address known causes of circumvention.--Each online ticket issuer shall take reasonable steps to improve its access control systems, security measures, and other technological controls or measures to address any known or reasonably foreseeable risks connected to incidents of circumvention.
``(I) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue.
``(4) Commission guidance.--Not later than 1 year after the date of enactment of the Mitigating Automated Internet Networks for Event Ticketing Act, the Commission shall publish guidance for online ticket issuers regarding compliance with the requirements of this subsection.'';
``(II) Requiring service providers by contract to implement and maintain adequate safeguards.
(4) in subsection (c), as redesignated by paragraph (2) of this subsection-- (A) by striking ``subsection (a)'' each place it appears and inserting ``subsection (a) or (b)'';
Show all 77 changed rows (37 more)
Previous
Latest
``(III) Periodically assessing service providers based on the risk they present and the continued adequacy of their safeguards.
and (B) by adding at the end the following new paragraph:
``(D) Updates.--A ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall regularly evaluate and make adjustments to the safeguards described in subparagraph (A) in light of any material changes in technology, internal or external threats to system security, confidentiality, integrity, and availability, and the changing business arrangements or operations of the ticket issuer.
``(3) Limitation on commission guidance.-- ``(A) In general.--No guidance issued by the Commission with respect to this Act shall confer any rights on any person, State, or locality, nor shall operate to bind the Commission or any person to the approach recommended in such guidance.
``(3) Requirement to report incidents of circumvention;
``(B) Specific allegations.--In any enforcement action brought pursuant to this Act, the Commission-- ``(i) shall allege a specific violation of a provision of this Act;
consumer complaints.-- ``(A) In general.--A ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall report to the Commission any incidents of circumvention of which the ticket issuer has actual knowledge.
and ``(ii) may not base an enforcement action on, or execute a consent order based on, practices that are alleged to be inconsistent with any such guidance, unless the practices allegedly violate this Act.'';
``(B) Consumer complaint website.--Not later than days after the date of enactment of the Mitigating Automated Internet Networks for Event Ticketing Act, the Commission shall create a publicly available website (or modify an existing publicly available website of the Commission) to allow individuals to report violations of this subsection to the Commission.
(5) in subsection (d), as redesignated by paragraph (2) of this subsection, by striking ``subsection (a)'' each place it appears and inserting ``subsection (a) or (b)'';
``(C) Reporting timeline and process.-- ``(i) Timeline.--A ticket issuer shall report known incidents of circumvention within a reasonable period of time after the incident of circumvention is discovered by the ticket issuer, and in no case later than 30 days after an incident of circumvention is discovered by the ticket issuer.
``(ii) Automated submission.--The Commission may establish a reporting mechanism to provide for the automatic submission of reports required under this subsection.
``(iii) Coordination with state attorneys general.--The Commission shall-- ``(I) share reports received from ticket issuers under subparagraph (A) with State attorneys general as appropriate;
and ``(II) share consumer complaints submitted through the website established under subparagraph (B) with State attorneys general as appropriate.
``(4) Duty to address causes of circumvention.--A ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets must take reasonable steps to improve its access control systems, security measures, and other technological controls or measures to address any incidents of circumvention of which the ticket issuer has actual knowledge.
``(5) FTC guidance.--Not later than 1 year after the date of enactment of the Mitigating Automated Internet Networks for Event Ticketing Act, the Commission shall publish guidance for ticket issuers on compliance with the requirements of this subsection.'';
(4) in subsection (c), as redesignated by paragraph (1) of this subsection-- (A) by striking ``subsection (a)'' each place it appears and inserting ``subsection (a) or (b)'';
(B) in paragraph (2)-- (i) in subparagraph (A), by striking ``The Commission'' and inserting ``Except as provided in paragraph (3), the Commission'';
and (ii) in subparagraph (B), by striking ``Any person'' and inserting ``Subject to paragraph (3), any person'';
and (C) by adding at the end the following new paragraphs:
``(3) Civil action.-- ``(A) In general.--If the Commission has reason to believe that any person has committed a violation of subsection (a) or (b), the Commission may bring a civil action in an appropriate district court of the United States to-- ``(i) recover a civil penalty under paragraph (4);
and ``(ii) seek other appropriate relief, including injunctive relief and other equitable relief.
``(B) Litigation authority.--Except as otherwise provided in section 16(a)(3) of the Federal Trade Commission Act (15 U.S.C.
56(a)(3)), the Commission shall have exclusive authority to commence or defend, and supervise the litigation of, any civil action authorized under this paragraph and any appeal of such action in its own name by any of its attorneys designated by it for such purpose, unless the Commission authorizes the Attorney General to do so.
The Commission shall inform the Attorney General of the exercise of such authority and such exercise shall not preclude the Attorney General from intervening on behalf of the United States in such action and any appeal of such action as may be otherwise provided by law.
``(C) Rule of construction.--Any civil penalty or relief sought through a civil action under this paragraph shall be in addition to other penalties and relief as may be prescribed by law.
``(4) Civil penalties.-- ``(A) In general.--Any person who violates subsection (a) or (b) shall be liable for-- ``(i) a civil penalty of not less than $10,000 for each day during which the violation occurs or continues to occur;
and ``(ii) an additional civil penalty of not less than $1,000 per violation.
``(B) Enhanced civil penalty for intentional violations.--In addition to the civil penalties under subparagraph (A), a person that intentionally violates subsection (a) or (b) shall be liable for a civil penalty of not less than $10,000 per violation.'';
(5) in subsection (d), as redesignated by paragraph (1) of this subsection, by striking ``subsection (a)'' each place it appears and inserting ``subsection (a) or (b)'';
``(e) Law Enforcement Coordination.-- ``(1) In general.--The Federal Bureau of Investigation, the Department of Justice, and other relevant State or local law enforcement officials shall coordinate as appropriate with the Commission to share information about known instances of cyberattacks on security measures, access control systems, or other technological controls or measures on an Internet website or online service that are used by ticket issuers to enforce posted event ticket purchasing limits or to maintain the integrity of posted online ticket purchasing order rules.
``(e) Law Enforcement Coordination.-- ``(1) In general.--The Federal Bureau of Investigation, the Attorney General, and other relevant State or local law enforcement officials shall coordinate as appropriate with the Commission to share information about any known instance of a cyberattack on a security measure, access control system, or other technological control or measure on an Internet website or online service that is used by an online ticket issuer to enforce posted event ticket purchasing limits or to maintain the integrity of posted online ticket purchasing order rules.
Such coordination may include providing information about ongoing investigations but may exclude classified information or information that could compromise a law enforcement or national security effort, as appropriate.
Such coordination may include providing information about ongoing investigations, but may exclude classified information or information that could compromise a law enforcement or national security effort, as appropriate.
``(f) Congressional Report.--Not later than 1 year after the date of enactment of this paragraph, the Commission shall report to Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives on the status of enforcement actions taken pursuant to this Act, as well as any identified limitations to the Commission's ability to pursue incidents of circumvention described in subsection (a)(1)(A).''.
``(f) Congressional Report.--Not later than 1 year after the date of enactment of this paragraph, the Commission shall report to Committee on Commerce, Science, and Transportation of the Senate and the Committee on Energy and Commerce of the House of Representatives on the status of any enforcement action taken pursuant to this Act, as well as any identified limitations to the Commission's ability to pursue incidents of circumvention described in subsection (a)(1)(A).''.
(b) Additional Definition.--Section 3 of the Better Online Ticket Sales Act of 2016 (15 U.S.C.
(b) Additional Definitions.--Section 3 of the Better Online Ticket Sales Act of 2016 (15 U.S.C.
45c note) is amended by adding at the end the following new paragraph:
45c note) is amended by adding at the end the following new paragraphs:
``(4) Circumvention.--The term `circumvention' means the act of avoiding, bypassing, removing, deactivating, or otherwise impairing an access control system, security measure, safeguard, or other technological control or measure described in section 2(b)(1).''.
``(4) Circumvention.--The term `circumvention' means the act of avoiding, bypassing, removing, deactivating, or otherwise impairing an access control system, security measure, safeguard, or other technological control or measure described in section 2.
<all>
``(5) Online ticket issuer.--The term `online ticket issuer' means a ticket issuer that owns or operates an Internet website or online service that, in the regular course of trade or business of the issuer, facilitates or executes the sale of event tickets to the general public.''.
Calendar No.
144 119th CONGRESS 1st Session S.
196 [Report No.
119-57] _______________________________________________________________________ A BILL To improve online ticket sales and protect consumers, and for other purposes.
_______________________________________________________________________ September 2, 2025 Reported with an amendment
⬇ Download PDF
View plain text versions (2)

What Congress says this changes

S. Rept. 119-57

Published by the reporting committee Not generated — this is the committee's own “Changes in Existing Law Made by the Bill, as Reported”.

Text to be removed appears in [brackets]. Newly inserted text is italicised in the official report and cannot be marked in this plain-text rendition — read the official PDF ↗ for the authoritative formatting. 

changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
material is printed in italic, existing law in which no change 
is proposed is shown in roman):

BETTER ONLINE TICKET SALES ACT OF 2016

 * * * * * * *

 [15 U.S.C. 45c; Pub. L. 114-274]

SEC. 2. UNFAIR AND DECEPTIVE ACTS AND PRACTICES RELATING TO 
 CIRCUMVENTION OF TICKET ACCESS CONTROL MEASURES.

 (a) Conduct Prohibited.--
 (1) In general.--Except as provided in paragraph 
 (2), it shall be unlawful for any person--
 (A) to circumvent a security measure, 
 access control system, or other technological 
 control or measure on an Internet website or 
 online service that is used by the online 
 ticket issuer to enforce posted event ticket 
 purchasing limits or to maintain the integrity 
 of posted online ticket purchasing order 
 rules[; or];
 (B) to sell or offer to sell any event 
 ticket in interstate commerce obtained in 
 violation of subparagraph (A) if the person 
 selling or offering to sell the ticket either--
 (i) participated directly in or had 
 the ability to control the conduct in 
 violation of subparagraph (A); or
 (ii) knew or should have known that 
 the event ticket was acquired in 
 violation of subparagraph (A)[.]; or
 (C) to use or cause to be used an 
 application, including a software application, 
 that performs automated tasks to purchase event 
 tickets from an Internet website or online 
 service used by an online ticket issuer through 
 the circumvention of an access control system, 
 security measure, or other technological 
 control or measure used by such Internet 
 website or online service to enforce posted 
 online ticket purchasing order rules of the 
 Internet website or online service.
 (2) Exception.--It shall not be unlawful under this 
 section for a person to create or use any computer 
 software or system--
 (A) to investigate, or further the 
 enforcement or defense, of any alleged 
 violation of this section or other statute or 
 regulation; or
 (B) to engage in research necessary to 
 identify and analyze flaws and vulnerabilities 
 of measures, systems, or controls described in 
 paragraph (1)(A), if these research activities 
 are conducted to advance the state of knowledge 
 in the field of computer system security or to 
 assist in the development of computer security 
 product.
 (b) Requiring Online Ticket Issuers to Enforce Site 
Policies.--
 (1) Requirement to enforce and update site 
 policies.--Each online ticket issuer shall--
 (A) establish, implement, and maintain an 
 access control system, security measure, or 
 other technological control or measure to 
 enforce posted event ticket purchasing limits 
 and to maintain the integrity of posted online 
 ticket purchasing order rules; and
 (B) regularly evaluate and make 
 adjustments, as necessary, to such an access 
 control system, security measure, or other 
 technological control or measure in light of 
 any material changes in technology, internal or 
 external threats to system security, and the 
 changing business arrangements or operations of 
 the ticket issuer.
 (2) Requirement to report incidents of 
 circumvention; consumer complaints.--
 (A) In general.--Each online ticket issuer 
 shall report to the Commission any incidents of 
 circumvention of which the ticket issuer has 
 actual knowledge not later than 30 days after 
 the incident of circumvention is discovered by 
 the online ticket issuer.
 (B) Electronic submission.--The Commission 
 may establish a reporting mechanism to provide 
 for the electronic submission of reports 
 required by subparagraph (A).
 (C) Coordination with state attorneys 
 general.--The Commission shall share with State 
 attorneys general, as appropriate--
 (i) any report received from online 
 ticket issuers under subparagraph (A); 
 and
 (ii) consumer complaints related to 
 any violation of this subsection that 
 are submitted through the Commission's 
 website.
 (3) Requirement to address known causes of 
 circumvention.--Each online ticket issuer shall take 
 reasonable steps to improve its access control systems, 
 security measures, and other technological controls or 
 measures to address any known or reasonably foreseeable 
 risks connected to incidents of circumvention.
 (4) Commission guidance.--Not later than 1 year 
 after the date of enactment of the Mitigating Automated 
 Internet Networks for Event Ticketing Act, the 
 Commission shall publish guidance for online ticket 
 issuers regarding compliance with the requirements of 
 this subsection.
 [(b)](c) Enforcement by the Federal Trade Commission.--
 (1) Unfair or deceptive acts or practices.--A 
 violation of [subsection (a)] subsection (a) or (b) 
 shall be treated as a violation of a rule defining an 
 unfair or a deceptive act or practice under section 
 18(a)(1)(B) of the Federal Trade Commission Act (15 
 U.S.C. 57a(a)(1)(B)).
 (2) Powers of commission.--
 (A) In general.--The Commission shall 
 enforce this section in the same manner, by the 
 same means, and with the same jurisdiction, 
 powers, and duties as though all applicable 
 terms and provisions of the Federal Trade 
 Commission Act (15 U.S.C. 41 et seq.) were 
 incorporated into and made a part of this 
 section.
 (B) Privileges and immunities.--Any person 
 who violates [subsection (a)] subsection (a) or 
 (b) shall be subject to the penalties and 
 entitled to the privileges and immunities 
 provided in the Federal Trade Commission Act 
 (15 U.S.C. 41 et seq.).
 (C) Authority preserved.--Nothing in this 
 section shall be construed to limit the 
 authority of the Federal Trade Commission under 
 any other provision of law.
 (3) Limitation on commission guidance.--
 (A) In general.--No guidance issued by the 
 Commission with respect to this Act shall 
 confer any rights on any person, State, or 
 locality, nor shall operate to bind the 
 Commission or any person to the approach 
 recommended in such guidance.
 (B) Specific allegations.--In any 
 enforcement action brought pursuant to this 
 Act, the Commission--
 (i) shall allege a specific 
 violation of a provision of this Act; 
 and
 (ii) may not base an enforcement 
 action on, or execute a consent order 
 based on, practices that are alleged to 
 be inconsistent with any such guidance, 
 unless the practices allegedly violate 
 this Act.
 [(c)](d) Enforcement by States.--
 (1) In general.--In any case in which the attorney 
 general of a State has reason to believe that an 
 interest of the residents of the State has been or is 
 threatened or adversely affected by the engagement of 
 any person subject to [subsection (a)] subsection (a) 
 or (b) in a practice that violates such subsection, the 
 attorney general of the State may, as parens patriae, 
 bring a civil action on behalf of the residents of the 
 State in an appropriate district court of the United 
 States--
 (A) to enjoin further violation of such 
 subsection by such person;
 (B) to compel compliance with such 
 subsection; and
 (C) to obtain damages, restitution, or 
 other compensation on behalf of such residents.
 (2) Rights of federal trade commission.--
 (A) Notice to federal trade commission.--
 (i) In general.--Except as provided 
 in clause (iii), the attorney general 
 of a State shall notify the Commission 
 in writing that the attorney general 
 intends to bring a civil action under 
 paragraph (1) not later than 10 days 
 before initiating the civil action.
 (ii) Contents.--The notification 
 required by clause (i) with respect to 
 a civil action shall include a copy of 
 the complaint to be filed to initiate 
 the civil action.
 (iii) Exception.--If it is not 
 feasible for the attorney general of a 
 State to provide the notification 
 required by clause (i) before 
 initiating a civil action under 
 paragraph (1), the attorney general 
 shall notify the Commission immediately 
 upon instituting the civil action.
 (B) Intervention by federal trade 
 commission.-- The Commission may--
 (i) intervene in any civil action 
 brought by the attorney general of a 
 State under paragraph (1); and
 (ii) upon intervening--
 (I) be heard on all matters 
 arising in the civil action; 
 and
 (II) file petitions for 
 appeal of a decision in the 
 civil action.
 (3) Investigatory powers.--Nothing in this 
 subsection may be construed to prevent the attorney 
 general of a State from exercising the powers conferred 
 on the attorney general by the laws of the State to 
 conduct investigations, to administer oaths or 
 affirmations, or to compel the attendance of witnesses 
 or the production of documentary or other evidence.
 (4) Preemptive action by federal trade 
 commission.-- If the Commission institutes a civil 
 action or an administrative action with respect to a 
 violation of [subsection (a)] subsection (a) or (b), 
 the attorney general of a State may not, during the 
 pendency of such action, bring a civil action under 
 paragraph (1) against any defendant named in the 
 complaint of the Commission for the violation with 
 respect to which the Commission instituted such action.
 (5) Venue; service of process.--
 (A) Venue.--Any action brought under 
 paragraph (1) may be brought in--
 (i) the district court of the 
 United States that meets applicable 
 requirements relating to venue under 
 section 1391 of title 28, United States 
 Code; or
 (ii) another court of competent 
 jurisdiction.
 (B) Service of process.--In an action 
 brought under paragraph (1), process may be 
 served in any district in which the defendant--
 (i) is an inhabitant; or
 (ii) may be found.
 (6) Actions by other state officials.--
 (A) In general.--In addition to civil 
 actions brought by attorneys general under 
 paragraph (1), any other consumer protection 
 officer of a State who is authorized by the 
 State to do so may bring a civil action under 
 paragraph (1), subject to the same requirements 
 and limitations that apply under this 
 subsection to civil actions brought by 
 attorneys general.
 (B) Savings provision.--Nothing in this 
 subsection may be construed to prohibit an 
 authorized official of a State from initiating 
 or continuing any proceeding in a court of the 
 State for a violation of any civil or criminal 
 law of the State.
 (e) Law Enforcement Coordination.--
 (1) In general.--The Federal Bureau of 
 Investigation, the Attorney General, and other relevant 
 State or local law enforcement officials shall 
 coordinate as appropriate with the Commission to share 
 information about any known instance of a cyberattack 
 on a security measure, access control system, or other 
 technological control or measure on an Internet website 
 or online service that is used by an online ticket 
 issuer to enforce posted event ticket purchasing limits 
 or to maintain the integrity of posted online ticket 
 purchasing order rules. Such coordination may include 
 providing information about ongoing investigations, but 
 may exclude classified information or information that 
 could compromise a law enforcement or national security 
 effort, as appropriate.
 (2) Cyberattack defined.--In this paragraph, the 
 term ``cyberattack'' means an attack, via cyberspace, 
 targeting an enterprise's use of cyberspace for the 
 purpose of--
 (A) disrupting, disabling, destroying, or 
 maliciously controlling a computing environment 
 or computing infrastructure; or
 (B) destroying the integrity of data or 
 stealing controlled information.
 (f) Congressional Report.--Not later than 1 year after the 
date of enactment of this paragraph, the Commission shall 
report to Committee on Commerce, Science, and Transportation of 
the Senate and the Committee on Energy and Commerce of the 
House of Representatives on the status of any enforcement 
action taken pursuant to this Act, as well as any identified 
limitations to the Commission's ability to pursue incidents of 
circumvention described in subsection (a)(1)(A).

 [15 U.S.C. 45c note]

SEC. 3. DEFINITIONS.

 In this Act:
 (1) Commission.--The term ``Commission'' means the 
 Federal Trade Commission.
 (2) Event.--The term ``event'' means any concert, 
 theatrical performance, sporting event, show, or 
 similarly scheduled activity, taking place in a venue 
 with a seating or attendance capacity exceeding 200 
 persons that--
 (A) is open to the general public; and
 (B) is promoted, advertised, or marketed in 
 interstate commerce or for which event tickets 
 are generally sold or distributed in interstate 
 commerce.
 (3) Event ticket.--The term ``event ticket'' means 
 any physical, electronic, or other form of a 
 certificate, document, voucher, token, or other 
 evidence indicating that the bearer, possessor, or 
 person entitled to possession through purchase or 
 otherwise has--
 (A) a right, privilege, or license to enter 
 an event venue or occupy a particular seat or 
 area in an event venue with respect to one or 
 more events; or
 (B) an entitlement to purchase such a 
 right, privilege, or license with respect to 
 one or more future events.
 (4) Circumvention.--The term ``circumvention'' 
 means the act of avoiding, bypassing, removing, 
 deactivating, or otherwise impairing an access control 
 system, security measure, safeguard, or other 
 technological control or measure described in section 
 2.
 (5) Online ticket issuer.--The term ``online ticket 
 issuer'' means a ticket issuer that owns or operates an 
 Internet website or online service that, in the regular 
 course of trade or business of the issuer, facilitates 
 or executes the sale of event tickets to the general 
 public.

 * * * * * * *

Source: S. Rept. 119-57 · govinfo

How this bill changes current law

5 changes Share ↗

Compared against current U.S. Code AI-generated reading aid — verify against the official bill.

The bill expands the scope of prohibited conduct under the Better Online Ticket Sales Act by including the use of automated applications for purchasing event tickets and establishes additional requirements for ticket issuers regarding site security and incident reporting.

  • 15 U.S.C. 45c(a)(1)

    to circumvent a security measure, access control system, or other technological control or measure on an Internet website or online service that is used by the ticket issuer to enforce posted event ticket purchasing limits or to maintain the integrity of posted online ticket purchasing order rules; or → to circumvent a security measure, access control system, or other technological control or measure on an Internet website or online service that is used by the ticket issuer to enforce posted event ticket purchasing limits or to maintain the integrity of posted online ticket purchasing order rules; or (C) to use or cause to be used an application that performs automated tasks to purchase event tickets from an Internet website or online service in circumvention of posted online ticket purchasing order rules of the Internet website or online service, including a software application that circumvents an access control system, security measure, or other technological control or measure.

    This change makes it unlawful to use automated applications to bypass ticket purchasing rules.

  • 15 U.S.C. 45c

    Each ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall ensure that such website or service has in place an access control system, security measure, or other technological control or measure to enforce posted event ticket purchasing limits.

    This requires ticket issuers to implement security measures to enforce ticket purchasing limits.

  • 15 U.S.C. 45c

    Each ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall establish, implement, and maintain reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, integrity, or availability of the website or service.

    This mandates ticket issuers to maintain multiple layers of security measures to protect their services.

  • 15 U.S.C. 45c

    A ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets must take reasonable steps to improve its access control systems, security measures, and other technological controls or measures to address any incidents of circumvention of which the ticket issuer has actual knowledge.

    This establishes a duty for ticket issuers to address security incidents proactively.

  • 15 U.S.C. 45c

    A ticket issuer that owns or operates an Internet website or online service that facilitates or executes the sale of event tickets shall report to the Commission any incidents of circumvention of which the ticket issuer has actual knowledge.

    This requires ticket issuers to report known violations of security circumventions.

Action History

  1. Introduced in Senate

  2. Read twice and referred to the Committee on Commerce, Science, and Transportation.

  3. Committee on Commerce, Science, and Transportation. Ordered to be reported with an amendment in the nature of a substitute favorably.

  4. Committee on Commerce, Science, and Transportation. Ordered to be reported with an amendment in the nature of a substitute favorably.

  5. Committee on Commerce, Science, and Transportation. Reported by Senator Cruz with an amendment in the nature of a substitute. With written report No. 119-57.

  6. Committee on Commerce, Science, and Transportation. Reported by Senator Cruz with an amendment in the nature of a substitute. With written report No. 119-57.

  7. Placed on Senate Legislative Calendar under General Orders. Calendar No. 144.

Sponsors

Sponsorship breakdown

Export CSV (upgrade) →

1 sponsors · 1 co-sponsors · 545 not signed on

Sponsors (1)

Co-sponsors (1)

Not signed on (545)

545 members have not signed on to this bill.

Show all 545 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Subjects

public-safety technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

What does S 196 do?
Mitigating Automated Internet Networks for Event Ticketing Act or the MAIN Event Ticketing ActThis bill expands measures to protect the security and integrity of online ticket sales.Specifically, the bill prohibits the use of applications that perform automated tasks to purchase event tickets from online ticket sellers in circumvention of the seller's posted ticket purchasing order rules. This includes using software applications that circumvent access control systems or security measures.In addition, online ticket sellers must establish, implement, and maintain reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, integrity, or availability of the seller's website or service. Further, online ticket sellers must report known incidents of circumvention to the Federal Trade Commission and take reasonable steps to address any such incidents.The bill establishes civil penalties for violations of the provisions of this bill (and related prohibitions under current law) and authorizes the commission to bring civil actions for such violations.Federal, state, and local law enforcement agencies must coordinate as appropriate with the commission to share information about known instances of cyberattacks against the websites or online services used by ticket sellers.The commission must report to Congress on the status of enforcement actions taken under this bill.
Who sponsors S 196?
S 196 is sponsored by Blackburn, Marsha (Republican) and Luján, Ben Ray (Democratic).
What is the current status of S 196?
This bill is in committee in the Senate. Introduced January 22, 2025. It must pass committee before a floor vote.
Where can I track S 196?
Track S 196 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on S 196

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of S 196

Last checked for changes 4 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →