II 

118TH CONGRESS 

1ST SESSION S. 3191 

To improve online ticket sales and protect consumers, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

NOVEMBER 1, 2023 

Mrs. BLACKBURN (for herself and Mr. LUJA ́N) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To improve online ticket sales and protect consumers, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Mitigating Automated 

5 Internet Networks for Event Ticketing Act’’ or the 

6 ‘‘MAIN Event Ticketing Act’’. 

7 SEC. 2. STRENGTHENING THE BOTS ACT. 

8 (a) IN GENERAL.—Section 2 of the Better Online 

9 Ticket Sales Act of 2016 (15 U.S.C. 45c) is amended— 

10 (1) in subsection (a)(1)— 


ddrumheller on DSK120RN23PROD with BILLS
2 

•S 3191 IS

1 (A) in subparagraph (A), by striking ‘‘; 

2 or’’ and inserting a semicolon; 

3 (B) in subparagraph (B), by striking the 

4 period at the end and inserting ‘‘; or’’; and 

5 (C) by adding at the end the following new 

6 subparagraph: 

7 ‘‘(C) to use or cause to be used an applica8 tion that performs automated tasks to purchase 

9 event tickets from an Internet website or online 

10 service in circumvention of posted online ticket 

11 purchasing order rules of the Internet website 

12 or online service, including a software applica13 tion that circumvents an access control system, 

14 security measure, or other technological control 

15 or measure.’’; 

16 (2) by redesignating subsections (b) and (c) as 

17 subsections (c) and (d), respectively; 

18 (3) by inserting after subsection (a) the fol19 lowing new subsection: 

20 ‘‘(b) REQUIRING ONLINE TICKET ISSUERS TO PUT

21 IN PLACE SITE POLICIES AND ESTABLISH SAFEGUARDS

22 TO PROTECT SITE SECURITY.— 

23 ‘‘(1) REQUIREMENT TO ENFORCE SITE POLI24 CIES.—Each ticket issuer that owns or operates an 

25 Internet website or online service that facilitates or 


ddrumheller on DSK120RN23PROD with BILLS
3 

•S 3191 IS

1 executes the sale of event tickets shall ensure that 

2 such website or service has in place an access control 

3 system, security measure, or other technological con4 trol or measure to enforce posted event ticket pur5 chasing limits. 

6 ‘‘(2) REQUIREMENT TO ESTABLISH SITE SECU7 RITY SAFEGUARDS.— 

8 ‘‘(A) IN GENERAL.—Each ticket issuer 

9 that owns or operates an Internet website or 

10 online service that facilitates or executes the 

11 sale of event tickets shall establish, implement, 

12 and maintain reasonable administrative, tech13 nical, and physical safeguards to protect the se14 curity, confidentiality, integrity, or availability 

15 of the website or service. 

16 ‘‘(B) CONSIDERATIONS.—In establishing 

17 the safeguards described in subparagraph (A), 

18 each ticket issuer described in such paragraph 

19 shall consider— 

20 ‘‘(i) the administrative, technical, and 

21 physical safeguards that are appropriate to 

22 the size and complexity of the ticket issuer; 

23 ‘‘(ii) the nature and scope of the ac24 tivities of the ticket issuer; 


ddrumheller on DSK120RN23PROD with BILLS
4 

•S 3191 IS

1 ‘‘(iii) the sensitivity of any customer 

2 information at issue; and 

3 ‘‘(iv) the range of security risks and 

4 vulnerabilities that are reasonably foresee5 able or known to the ticket issuer. 

6 ‘‘(C) THIRD PARTIES AND SERVICE PRO7 VIDERS.— 

8 ‘‘(i) IN GENERAL.—Where applicable, 

9 a ticket issuer that owns or operates an 

10 Internet website or online service that fa11 cilitates or executes the sale of event tick12 ets shall implement and maintain proce13 dures to require that any third party or 

14 service provider that performs services with 

15 respect to the sale of event tickets or has 

16 access to data regarding event ticket pur17 chasing on the website or service maintains 

18 reasonable administrative, technical, and 

19 physical safeguards to protect the security 

20 and integrity of the website or service and 

21 that data. 

22 ‘‘(ii) OVERSIGHT PROCEDURE RE23 QUIREMENTS.—The procedures imple24 mented and maintained by a ticket issuer 


ddrumheller on DSK120RN23PROD with BILLS
5 

•S 3191 IS

1 in accordance with clause (i) shall include 

2 the following: 

3 ‘‘(I) Taking reasonable steps to 

4 select and retain service providers 

5 that are capable of maintaining ap6 propriate safeguards for the customer 

7 information at issue. 

8 ‘‘(II) Requiring service providers 

9 by contract to implement and main10 tain adequate safeguards. 

11 ‘‘(III) Periodically assessing serv12 ice providers based on the risk they 

13 present and the continued adequacy of 

14 their safeguards. 

15 ‘‘(D) UPDATES.—A ticket issuer that owns 

16 or operates an Internet website or online service 

17 that facilitates or executes the sale of event 

18 tickets shall regularly evaluate and make ad19 justments to the safeguards described in sub20 paragraph (A) in light of any material changes 

21 in technology, internal or external threats to 

22 system security, confidentiality, integrity, and 

23 availability, and the changing business arrange24 ments or operations of the ticket issuer. 


ddrumheller on DSK120RN23PROD with BILLS
6 

•S 3191 IS

1 ‘‘(3) REQUIREMENT TO REPORT INCIDENTS OF

2 CIRCUMVENTION; CONSUMER COMPLAINTS.— 

3 ‘‘(A) IN GENERAL.—A ticket issuer that 

4 owns or operates an Internet website or online 

5 service that facilitates or executes the sale of 

6 event tickets shall report to the Commission 

7 any incidents of circumvention of which the 

8 ticket issuer has actual knowledge. 

9 ‘‘(B) CONSUMER COMPLAINT WEBSITE.— 

10 Not later than 180 days after the date of enact11 ment of the Mitigating Automated Internet 

12 Networks for Event Ticketing Act, the Commis13 sion shall create a publicly available website (or 

14 modify an existing publicly available website of 

15 the Commission) to allow individuals to report 

16 violations of this subsection to the Commission. 

17 ‘‘(C) REPORTING TIMELINE AND PROC18 ESS.— 

19 ‘‘(i) TIMELINE.—A ticket issuer shall 

20 report known incidents of circumvention 

21 within a reasonable period of time after 

22 the incident of circumvention is discovered 

23 by the ticket issuer, and in no case later 

24 than 30 days after an incident of cirVerDate Sep 11 2014 21:43 Nov 07, 2023 Jkt 049200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S3191.IS S3191

ddrumheller on DSK120RN23PROD with BILLS
7 

•S 3191 IS

1 cumvention is discovered by the ticket 

2 issuer. 

3 ‘‘(ii) AUTOMATED SUBMISSION.—The 

4 Commission may establish a reporting 

5 mechanism to provide for the automatic 

6 submission of reports required under this 

7 subsection. 

8 ‘‘(iii) COORDINATION WITH STATE AT9 TORNEYS GENERAL.—The Commission 

10 shall— 

11 ‘‘(I) share reports received from 

12 ticket issuers under subparagraph (A) 

13 with State attorneys general as appro14 priate; and 

15 ‘‘(II) share consumer complaints 

16 submitted through the website estab17 lished under subparagraph (B) with 

18 State attorneys general as appro19 priate. 

20 ‘‘(4) DUTY TO ADDRESS CAUSES OF CIR21 CUMVENTION.—A ticket issuer that owns or operates 

22 an Internet website or online service that facilitates 

23 or executes the sale of event tickets must take rea24 sonable steps to improve its access control systems, 

25 security measures, and other technological controls 


ddrumheller on DSK120RN23PROD with BILLS
8 

•S 3191 IS

1 or measures to address any incidents of circumven2 tion of which the ticket issuer has actual knowledge. 

3 ‘‘(5) FTC GUIDANCE.—Not later than 1 year 

4 after the date of enactment of the Mitigating Auto5 mated Internet Networks for Event Ticketing Act, 

6 the Commission shall publish guidance for ticket 

7 issuers on compliance with the requirements of this 

8 subsection.’’; 

9 (4) in subsection (c), as redesignated by para10 graph (1) of this subsection— 

11 (A) by striking ‘‘subsection (a)’’ each place 

12 it appears and inserting ‘‘subsection (a) or (b)’’; 

13 (B) in paragraph (2)— 

14 (i) in subparagraph (A), by striking 

15 ‘‘The Commission’’ and inserting ‘‘Except 

16 as provided in paragraph (3), the Commis17 sion’’; and 

18 (ii) in subparagraph (B), by striking 

19 ‘‘Any person’’ and inserting ‘‘Subject to 

20 paragraph (3), any person’’; and 

21 (C) by adding at the end the following new 

22 paragraphs: 

23 ‘‘(3) CIVIL ACTION.— 

24 ‘‘(A) IN GENERAL.—If the Commission has 

25 reason to believe that any person has committed 


ddrumheller on DSK120RN23PROD with BILLS
9 

•S 3191 IS

1 a violation of subsection (a) or (b), the Commis2 sion may bring a civil action in an appropriate 

3 district court of the United States to— 

4 ‘‘(i) recover a civil penalty under 

5 paragraph (4); and 

6 ‘‘(ii) seek other appropriate relief, in7 cluding injunctive relief and other equi8 table relief. 

9 ‘‘(B) LITIGATION AUTHORITY.—Except as 

10 otherwise provided in section 16(a)(3) of the 

11 Federal Trade Commission Act (15 U.S.C. 

12 56(a)(3)), the Commission shall have exclusive 

13 authority to commence or defend, and supervise 

14 the litigation of, any civil action authorized 

15 under this paragraph and any appeal of such 

16 action in its own name by any of its attorneys 

17 designated by it for such purpose, unless the 

18 Commission authorizes the Attorney General to 

19 do so. The Commission shall inform the Attor20 ney General of the exercise of such authority 

21 and such exercise shall not preclude the Attor22 ney General from intervening on behalf of the 

23 United States in such action and any appeal of 

24 such action as may be otherwise provided by 

25 law. 


ddrumheller on DSK120RN23PROD with BILLS
10 

•S 3191 IS

1 ‘‘(C) RULE OF CONSTRUCTION.—Any civil 

2 penalty or relief sought through a civil action 

3 under this paragraph shall be in addition to 

4 other penalties and relief as may be prescribed 

5 by law. 

6 ‘‘(4) CIVIL PENALTIES.— 

7 ‘‘(A) IN GENERAL.—Any person who vio8 lates subsection (a) or (b) shall be liable for— 

9 ‘‘(i) a civil penalty of not less than 

10 $10,000 for each day during which the vio11 lation occurs or continues to occur; and 

12 ‘‘(ii) an additional civil penalty of not 

13 less than $1,000 per violation. 

14 ‘‘(B) ENHANCED CIVIL PENALTY FOR IN15 TENTIONAL VIOLATIONS.—In addition to the 

16 civil penalties under subparagraph (A), a per17 son that intentionally violates subsection (a) or 

18 (b) shall be liable for a civil penalty of not less 

19 than $10,000 per violation.’’; 

20 (5) in subsection (d), as redesignated by para21 graph (1) of this subsection, by striking ‘‘subsection 

22 (a)’’ each place it appears and inserting ‘‘subsection 

23 (a) or (b)’’; and 

24 (6) by adding at the end the following new sub25 sections: 


ddrumheller on DSK120RN23PROD with BILLS
11 

•S 3191 IS

1 ‘‘(e) LAW ENFORCEMENT COORDINATION.— 

2 ‘‘(1) IN GENERAL.—The Federal Bureau of In3 vestigation, the Department of Justice, and other 

4 relevant State or local law enforcement officials shall 

5 coordinate as appropriate with the Commission to 

6 share information about known instances of 

7 cyberattacks on security measures, access control 

8 systems, or other technological controls or measures 

9 on an Internet website or online service that are 

10 used by ticket issuers to enforce posted event ticket 

11 purchasing limits or to maintain the integrity of 

12 posted online ticket purchasing order rules. Such co13 ordination may include providing information about 

14 ongoing investigations but may exclude classified in15 formation or information that could compromise a 

16 law enforcement or national security effort, as ap17 propriate. 

18 ‘‘(2) CYBERATTACK DEFINED.—In this para19 graph, the term ‘cyberattack’ means an attack, via 

20 cyberspace, targeting an enterprise’s use of cyber21 space for the purpose of— 

22 ‘‘(A) disrupting, disabling, destroying, or 

23 maliciously controlling a computing environ24 ment or computing infrastructure; or 


ddrumheller on DSK120RN23PROD with BILLS
12 

•S 3191 IS

1 ‘‘(B) destroying the integrity of data or 

2 stealing controlled information. 

3 ‘‘(f) CONGRESSIONAL REPORT.—Not later than 1 

4 year after the date of enactment of this paragraph, the 

5 Commission shall report to Committee on Commerce, 

6 Science, and Transportation of the Senate and the Com7 mittee on Energy and Commerce of the House of Rep8 resentatives on the status of enforcement actions taken 

9 pursuant to this Act, as well as any identified limitations 

10 to the Commission’s ability to pursue incidents of cir11 cumvention described in subsection (a)(1)(A).’’. 

12 (b) ADDITIONAL DEFINITION.—Section 3 of the Bet13 ter Online Ticket Sales Act of 2016 (15 U.S.C. 45c note) 

14 is amended by adding at the end the following new para15 graph: 

16 ‘‘(4) CIRCUMVENTION.—The term ‘circumven17 tion’ means the act of avoiding, bypassing, removing, 

18 deactivating, or otherwise impairing an access con19 trol system, security measure, safeguard, or other 

20 technological control or measure described in section 

21 2(b)(1).’’. 

Æ 


ddrumheller on DSK120RN23PROD with BILLS