(A) in subparagraph (A), by striking ‘‘; 
or’’ and inserting a semicolon; 
(B) in subparagraph (B), by striking the 
period at the end and inserting ‘‘; or’’; and 
(C) by adding at the end the following new 
subparagraph: 
‘‘(C) to use or cause to be used an applica-
tion that performs automated tasks to purchase 
event tickets from an internet website or online 
service in circumvention of posted online ticket 
purchasing order rules of the internet website 
or online service, including a software applica-
tion that circumvents an access control system, 
security measure, or other technological control 
or measure.’’; 
(2) by redesignating subsections (b) and (c) as 
subsections (c) and (d), respectively; 
(3) by inserting after subsection (a) the fol-
lowing new subsection: 
‘‘(b) REQUIRING ONLINE TICKET ISSUERS TO PUT 
IN PLACE SITE POLICIES AND ESTABLISH SAFEGUARDS 
TO PROTECT SITE SECURITY.— 
‘‘(1) REQUIREMENT TO ENFORCE SITE POLI-
CIES.—Each ticket issuer that owns or operates an 
internet website or online service that facilitates or 
VerDate Sep 11 2014 
10:18 Apr 15, 2025
Jkt 000000
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB
executes the sale of event tickets shall ensure that 
such website or service has in place an access control 
system, security measure, or other technological con-
trol or measure to enforce posted event ticket pur-
chasing limits. 
‘‘(2) REQUIREMENT TO ESTABLISH SITE SECU-
RITY SAFEGUARDS.— 
‘‘(A) IN
GENERAL.—Each ticket issuer 
that owns or operates an internet website or on-
line service that facilitates or executes the sale 
of event tickets shall establish, implement, and 
maintain reasonable administrative, technical, 
and physical safeguards to protect the security, 
confidentiality, integrity, or availability of the 
website or service. 
‘‘(B) CONSIDERATIONS.—In establishing 
the safeguards described in subparagraph (A), 
each ticket issuer described in such paragraph 
shall consider— 
‘‘(i) the administrative, technical, and 
physical safeguards that are appropriate to 
the size and complexity of the ticket issuer; 
‘‘(ii) the nature and scope of the ac-
tivities of the ticket issuer; 
VerDate Sep 11 2014 
10:18 Apr 15, 2025
Jkt 000000
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB
‘‘(iii) the sensitivity of any customer 
information at issue; and 
‘‘(iv) the range of security risks and 
vulnerabilities that are reasonably foresee-
able or known to the ticket issuer. 
‘‘(C) THIRD PARTIES AND SERVICE PRO-
VIDERS.— 
‘‘(i) IN GENERAL.—Where applicable, 
a ticket issuer that owns or operates an 
internet website or online service that fa-
cilitates or executes the sale of event tick-
ets shall implement and maintain proce-
dures to require that any third party or 
service provider that performs services with 
respect to the sale of event tickets or has 
access to data regarding event ticket pur-
chasing on the website or service maintains 
reasonable administrative, technical, and 
physical safeguards to protect the security 
and integrity of the website or service and 
that data. 
‘‘(ii) OVERSIGHT
PROCEDURE
RE-
QUIREMENTS.—The 
procedures 
imple-
mented and maintained by a ticket issuer 
VerDate Sep 11 2014 
02:48 Apr 18, 2025
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB
in accordance with clause (i) shall include 
the following: 
‘‘(I) Taking reasonable steps to 
select and retain service providers 
that are capable of maintaining ap-
propriate safeguards for the customer 
information at issue. 
‘‘(II) Requiring service providers 
by contract to implement and main-
tain adequate safeguards. 
‘‘(III) Periodically assessing serv-
ice providers based on the risk they 
present and the continued adequacy of 
their safeguards. 
‘‘(D) UPDATES.—A ticket issuer that owns 
or operates an internet website or online service 
that facilitates or executes the sale of event 
tickets shall regularly evaluate and make ad-
justments to the safeguards described in sub-
paragraph (A) in light of any material changes 
in technology, internal or external threats to 
system security, confidentiality, integrity, and 
availability, and the changing business arrange-
ments or operations of the ticket issuer. 
VerDate Sep 11 2014 
10:18 Apr 15, 2025
Jkt 000000
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB
‘‘(3) REQUIREMENT TO REPORT INCIDENTS OF 
CIRCUMVENTION; CONSUMER COMPLAINTS.— 
‘‘(A) IN GENERAL.—A ticket issuer that 
owns or operates an internet website or online 
service that facilitates or executes the sale of 
event tickets shall report to the Commission 
any incidents of circumvention of which the 
ticket issuer has actual knowledge. 
‘‘(B) CONSUMER COMPLAINT WEBSITE.— 
Not later than 180 days after the date of enact-
ment of the Mitigating Automated Internet 
Networks for Event Ticketing Act, the Commis-
sion shall create a publicly available website (or 
modify an existing publicly available website of 
the Commission) to allow individuals to report 
violations of this subsection to the Commission. 
‘‘(C) REPORTING
TIMELINE
AND
PROC-
ESS.— 
‘‘(i) TIMELINE.—A ticket issuer shall 
report known incidents of circumvention 
within a reasonable period of time after 
the incident of circumvention is discovered 
by the ticket issuer, and in no case later 
than 30 days after an incident of cir-
VerDate Sep 11 2014 
10:18 Apr 15, 2025
Jkt 000000
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB
cumvention is discovered by the ticket 
issuer. 
‘‘(ii) AUTOMATED SUBMISSION.—The 
Commission may establish a reporting 
mechanism to provide for the automatic 
submission of reports required under this 
subsection. 
‘‘(iii) COORDINATION WITH STATE AT-
TORNEYS
GENERAL.—The 
Commission 
shall— 
‘‘(I) share reports received from 
ticket issuers under subparagraph (A) 
with State attorneys general as appro-
priate; and 
‘‘(II) share consumer complaints 
submitted through the website estab-
lished under subparagraph (B) with 
State attorneys general as appro-
priate. 
‘‘(4) DUTY
TO
ADDRESS
CAUSES
OF
CIR-
CUMVENTION.—A ticket issuer that owns or operates 
an internet website or online service that facilitates 
or executes the sale of event tickets must take rea-
sonable steps to improve its access control systems, 
security measures, and other technological controls 
VerDate Sep 11 2014 
10:18 Apr 15, 2025
Jkt 000000
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB
or measures to address any incidents of circumven-
tion of which the ticket issuer has actual knowledge. 
‘‘(5) FTC GUIDANCE.—Not later than 1 year 
after the date of enactment of the Mitigating Auto-
mated Internet Networks for Event Ticketing Act, 
the Commission shall publish guidance for ticket 
issuers on compliance with the requirements of this 
subsection.’’; 
(4) in subsection (c), as redesignated by para-
graph (1) of this subsection— 
(A) by striking ‘‘subsection (a)’’ each place 
it appears and inserting ‘‘subsection (a) or (b)’’; 
(B) in paragraph (2)— 
(i) in subparagraph (A), by striking 
‘‘The Commission’’ and inserting ‘‘Except 
as provided in paragraph (3), the Commis-
sion’’; and 
(ii) in subparagraph (B), by striking 
‘‘Any person’’ and inserting ‘‘Subject to 
paragraph (3), any person’’; and 
(C) by adding at the end the following new 
paragraphs: 
‘‘(3) CIVIL ACTION.— 
‘‘(A) IN GENERAL.—If the Commission has 
reason to believe that any person has committed 
VerDate Sep 11 2014 
10:18 Apr 15, 2025
Jkt 000000
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB
a violation of subsection (a) or (b), the Commis-
sion may bring a civil action in an appropriate 
district court of the United States to— 
‘‘(i) recover a civil penalty under 
paragraph (4); and 
‘‘(ii) seek other appropriate relief, in-
cluding injunctive relief and other equi-
table relief. 
‘‘(B) LITIGATION AUTHORITY.—Except as 
otherwise provided in section 16(a)(3) of the 
Federal Trade Commission Act (15 U.S.C. 
56(a)(3)), the Commission shall have exclusive 
authority to commence or defend, and supervise 
the litigation of, any civil action authorized 
under this paragraph and any appeal of such 
action in its own name by any of its attorneys 
designated by it for such purpose, unless the 
Commission authorizes the Attorney General to 
do so. The Commission shall inform the Attor-
ney General of the exercise of such authority 
and such exercise shall not preclude the Attor-
ney General from intervening on behalf of the 
United States in such action and any appeal of 
such action as may be otherwise provided by 
law. 
VerDate Sep 11 2014 
10:18 Apr 15, 2025
Jkt 000000
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB
‘‘(C) RULE OF CONSTRUCTION.—Any civil 
penalty or relief sought through a civil action 
under this paragraph shall be in addition to 
other penalties and relief as may be prescribed 
by law. 
‘‘(4) CIVIL PENALTIES.— 
‘‘(A) IN GENERAL.—Any person who vio-
lates subsection (a) or (b) shall be liable for— 
‘‘(i) a civil penalty of not less than 
$10,000 for each day during which the vio-
lation occurs or continues to occur; and 
‘‘(ii) an additional civil penalty of not 
less than $1,000 per violation. 
‘‘(B) ENHANCED CIVIL PENALTY FOR IN-
TENTIONAL
VIOLATIONS.—In addition to the 
civil penalties under subparagraph (A), a per-
son that intentionally violates subsection (a) or 
(b) shall be liable for a civil penalty of not less 
than $10,000 per violation.’’; 
(5) in subsection (d), as redesignated by para-
graph (1) of this subsection, by striking ‘‘subsection 
(a)’’ each place it appears and inserting ‘‘subsection 
(a) or (b)’’; and 
(6) by adding at the end the following new sub-
sections: 
VerDate Sep 11 2014 
10:18 Apr 15, 2025
Jkt 000000
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB
‘‘(e) LAW ENFORCEMENT COORDINATION.— 
‘‘(1) IN GENERAL.—The Federal Bureau of In-
vestigation, the Department of Justice, and other 
relevant State or local law enforcement officials shall 
coordinate as appropriate with the Commission to 
share 
information 
about 
known 
instances 
of 
cyberattacks on security measures, access control 
systems, or other technological controls or measures 
on an internet website or online service that are 
used by ticket issuers to enforce posted event ticket 
purchasing limits or to maintain the integrity of 
posted online ticket purchasing order rules. Such co-
ordination may include providing information about 
ongoing investigations but may exclude classified in-
formation or information that could compromise a 
law enforcement or national security effort, as ap-
propriate. 
‘‘(2) CYBERATTACK
DEFINED.—In this para-
graph, the term ‘cyberattack’ means an attack, via 
cyberspace, targeting an enterprise’s use of cyber-
space for the purpose of— 
‘‘(A) disrupting, disabling, destroying, or 
maliciously controlling a computing environ-
ment or computing infrastructure; or 
VerDate Sep 11 2014 
10:18 Apr 15, 2025
Jkt 000000
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB
‘‘(B) destroying the integrity of data or 
stealing controlled information. 
‘‘(f) CONGRESSIONAL REPORT.—Not later than 1 
year after the date of enactment of this paragraph, the 
Commission shall report to Committee on Commerce, 
Science, and Transportation of the Senate and the Com-
mittee on Energy and Commerce of the House of Rep-
resentatives on the status of enforcement actions taken 
pursuant to this Act, as well as any identified limitations 
to the Commission’s ability to pursue incidents of cir-
cumvention described in subsection (a)(1)(A).’’. 
(b) ADDITIONAL DEFINITION.—Section 3 of the Bet-
ter Online Ticket Sales Act of 2016 (15 U.S.C. 45c note) 
is amended by adding at the end the following new para-
graph: 
‘‘(4) CIRCUMVENTION.—The term ‘circumven-
tion’ means the act of avoiding, bypassing, removing, 
deactivating, or otherwise impairing an access con-
trol system, security measure, safeguard, or other 
technological control or measure described in section 
2(b)(1).’’. 
Æ 
VerDate Sep 11 2014 
10:18 Apr 15, 2025
Jkt 000000
PO 00000
Frm 00012
Fmt 6652
Sfmt 6301
E:\BILLS\H2713.IH
H2713
mprince on LAP1J3WLY3PROD with $$_JOB