Us Congress 2025-2026 Regular Session

Us Congress Senate Bill SB196 Compare Versions

Only one version of the bill is available at this time.

Old	New	Differences
1	1	II
2	2	119THCONGRESS
3	3	1
4	4	STSESSION S. 196
5	5	To improve online ticket sales and protect consumers, and for other purposes.
6	6	IN THE SENATE OF THE UNITED STATES
7	7	JANUARY22, 2025
8	8	Mrs. B
9	9	LACKBURN(for herself and Mr. LUJA´N) introduced the following bill;
10	10	which was read twice and referred to the Committee on Commerce,
11	11	Science, and Transportation
12	12	A BILL
13	13	To improve online ticket sales and protect consumers, and
14	14	for other purposes.
15	15	Be it enacted by the Senate and House of Representa-1
16	16	tives of the United States of America in Congress assembled, 2
17	17	SECTION 1. SHORT TITLE. 3
18	18	This Act may be cited as the ‘‘Mitigating Automated 4
19	19	Internet Networks for Event Ticketing Act’’ or the 5
20	20	‘‘MAIN Event Ticketing Act’’. 6
21	21	SEC. 2. STRENGTHENING THE BOTS ACT. 7
22	22	(a) I
23	23	NGENERAL.—Section 2 of the Better Online 8
24	24	Ticket Sales Act of 2016 (15 U.S.C. 45c) is amended— 9
25	25	(1) in subsection (a)(1)— 10
26	26	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
27	27	ssavage on LAPJG3WLY3PROD with BILLS 2
28	28	•S 196 IS
29	29	(A) in subparagraph (A), by striking ‘‘; 1
30	30	or’’ and inserting a semicolon; 2
31	31	(B) in subparagraph (B), by striking the 3
32	32	period at the end and inserting ‘‘; or’’; and 4
33	33	(C) by adding at the end the following new 5
34	34	subparagraph: 6
35	35	‘‘(C) to use or cause to be used an applica-7
36	36	tion that performs automated tasks to purchase 8
37	37	event tickets from an Internet website or online 9
38	38	service in circumvention of posted online ticket 10
39	39	purchasing order rules of the Internet website 11
40	40	or online service, including a software applica-12
41	41	tion that circumvents an access control system, 13
42	42	security measure, or other technological control 14
43	43	or measure.’’; 15
44	44	(2) by redesignating subsections (b) and (c) as 16
45	45	subsections (c) and (d), respectively; 17
46	46	(3) by inserting after subsection (a) the fol-18
47	47	lowing new subsection: 19
48	48	‘‘(b) R
49	49	EQUIRINGONLINETICKETISSUERSTOPUT 20
50	50	INPLACESITEPOLICIES ANDESTABLISHSAFEGUARDS 21
51	51	T
52	52	OPROTECTSITESECURITY.— 22
53	53	‘‘(1) R
54	54	EQUIREMENT TO ENFORCE SITE POLI -23
55	55	CIES.—Each ticket issuer that owns or operates an 24
56	56	Internet website or online service that facilitates or 25
57	57	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
58	58	ssavage on LAPJG3WLY3PROD with BILLS 3
59	59	•S 196 IS
60	60	executes the sale of event tickets shall ensure that 1
61	61	such website or service has in place an access control 2
62	62	system, security measure, or other technological con-3
63	63	trol or measure to enforce posted event ticket pur-4
64	64	chasing limits. 5
65	65	‘‘(2) R
66	66	EQUIREMENT TO ESTABLISH SITE SECU -6
67	67	RITY SAFEGUARDS.— 7
68	68	‘‘(A) I
69	69	N GENERAL.—Each ticket issuer 8
70	70	that owns or operates an Internet website or 9
71	71	online service that facilitates or executes the 10
72	72	sale of event tickets shall establish, implement, 11
73	73	and maintain reasonable administrative, tech-12
74	74	nical, and physical safeguards to protect the se-13
75	75	curity, confidentiality, integrity, or availability 14
76	76	of the website or service. 15
77	77	‘‘(B) C
78	78	ONSIDERATIONS.—In establishing 16
79	79	the safeguards described in subparagraph (A), 17
80	80	each ticket issuer described in such paragraph 18
81	81	shall consider— 19
82	82	‘‘(i) the administrative, technical, and 20
83	83	physical safeguards that are appropriate to 21
84	84	the size and complexity of the ticket issuer; 22
85	85	‘‘(ii) the nature and scope of the ac-23
86	86	tivities of the ticket issuer; 24
87	87	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
88	88	ssavage on LAPJG3WLY3PROD with BILLS 4
89	89	•S 196 IS
90	90	‘‘(iii) the sensitivity of any customer 1
91	91	information at issue; and 2
92	92	‘‘(iv) the range of security risks and 3
93	93	vulnerabilities that are reasonably foresee-4
94	94	able or known to the ticket issuer. 5
95	95	‘‘(C) T
96	96	HIRD PARTIES AND SERVICE PRO -6
97	97	VIDERS.— 7
98	98	‘‘(i) I
99	99	N GENERAL.—Where applicable, 8
100	100	a ticket issuer that owns or operates an 9
101	101	Internet website or online service that fa-10
102	102	cilitates or executes the sale of event tick-11
103	103	ets shall implement and maintain proce-12
104	104	dures to require that any third party or 13
105	105	service provider that performs services with 14
106	106	respect to the sale of event tickets or has 15
107	107	access to data regarding event ticket pur-16
108	108	chasing on the website or service maintains 17
109	109	reasonable administrative, technical, and 18
110	110	physical safeguards to protect the security 19
111	111	and integrity of the website or service and 20
112	112	that data. 21
113	113	‘‘(ii) O
114	114	VERSIGHT PROCEDURE RE -22
115	115	QUIREMENTS.—The procedures imple-23
116	116	mented and maintained by a ticket issuer 24
117	117	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
118	118	ssavage on LAPJG3WLY3PROD with BILLS 5
119	119	•S 196 IS
120	120	in accordance with clause (i) shall include 1
121	121	the following: 2
122	122	‘‘(I) Taking reasonable steps to 3
123	123	select and retain service providers 4
124	124	that are capable of maintaining ap-5
125	125	propriate safeguards for the customer 6
126	126	information at issue. 7
127	127	‘‘(II) Requiring service providers 8
128	128	by contract to implement and main-9
129	129	tain adequate safeguards. 10
130	130	‘‘(III) Periodically assessing serv-11
131	131	ice providers based on the risk they 12
132	132	present and the continued adequacy of 13
133	133	their safeguards. 14
134	134	‘‘(D) U
135	135	PDATES.—A ticket issuer that owns 15
136	136	or operates an Internet website or online service 16
137	137	that facilitates or executes the sale of event 17
138	138	tickets shall regularly evaluate and make ad-18
139	139	justments to the safeguards described in sub-19
140	140	paragraph (A) in light of any material changes 20
141	141	in technology, internal or external threats to 21
142	142	system security, confidentiality, integrity, and 22
143	143	availability, and the changing business arrange-23
144	144	ments or operations of the ticket issuer. 24
145	145	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
146	146	ssavage on LAPJG3WLY3PROD with BILLS 6
147	147	•S 196 IS
148	148	‘‘(3) REQUIREMENT TO REPORT INCIDENTS OF 1
149	149	CIRCUMVENTION; CONSUMER COMPLAINTS .— 2
150	150	‘‘(A) I
151	151	N GENERAL.—A ticket issuer that 3
152	152	owns or operates an Internet website or online 4
153	153	service that facilitates or executes the sale of 5
154	154	event tickets shall report to the Commission 6
155	155	any incidents of circumvention of which the 7
156	156	ticket issuer has actual knowledge. 8
157	157	‘‘(B) C
158	158	ONSUMER COMPLAINT WEBSITE .— 9
159	159	Not later than 180 days after the date of enact-10
160	160	ment of the Mitigating Automated Internet 11
161	161	Networks for Event Ticketing Act, the Commis-12
162	162	sion shall create a publicly available website (or 13
163	163	modify an existing publicly available website of 14
164	164	the Commission) to allow individuals to report 15
165	165	violations of this subsection to the Commission. 16
166	166	‘‘(C) R
167	167	EPORTING TIMELINE AND PROC -17
168	168	ESS.— 18
169	169	‘‘(i) T
170	170	IMELINE.—A ticket issuer shall 19
171	171	report known incidents of circumvention 20
172	172	within a reasonable period of time after 21
173	173	the incident of circumvention is discovered 22
174	174	by the ticket issuer, and in no case later 23
175	175	than 30 days after an incident of cir-24
176	176	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
177	177	ssavage on LAPJG3WLY3PROD with BILLS 7
178	178	•S 196 IS
179	179	cumvention is discovered by the ticket 1
180	180	issuer. 2
181	181	‘‘(ii) A
182	182	UTOMATED SUBMISSION .—The 3
183	183	Commission may establish a reporting 4
184	184	mechanism to provide for the automatic 5
185	185	submission of reports required under this 6
186	186	subsection. 7
187	187	‘‘(iii) C
188	188	OORDINATION WITH STATE AT -8
189	189	TORNEYS GENERAL .—The Commission 9
190	190	shall— 10
191	191	‘‘(I) share reports received from 11
192	192	ticket issuers under subparagraph (A) 12
193	193	with State attorneys general as appro-13
194	194	priate; and 14
195	195	‘‘(II) share consumer complaints 15
196	196	submitted through the website estab-16
197	197	lished under subparagraph (B) with 17
198	198	State attorneys general as appro-18
199	199	priate. 19
200	200	‘‘(4) D
201	201	UTY TO ADDRESS CAUSES OF CIR -20
202	202	CUMVENTION.—A ticket issuer that owns or operates 21
203	203	an Internet website or online service that facilitates 22
204	204	or executes the sale of event tickets must take rea-23
205	205	sonable steps to improve its access control systems, 24
206	206	security measures, and other technological controls 25
207	207	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
208	208	ssavage on LAPJG3WLY3PROD with BILLS 8
209	209	•S 196 IS
210	210	or measures to address any incidents of circumven-1
211	211	tion of which the ticket issuer has actual knowledge. 2
212	212	‘‘(5) FTC
213	213	GUIDANCE.—Not later than 1 year 3
214	214	after the date of enactment of the Mitigating Auto-4
215	215	mated Internet Networks for Event Ticketing Act, 5
216	216	the Commission shall publish guidance for ticket 6
217	217	issuers on compliance with the requirements of this 7
218	218	subsection.’’; 8
219	219	(4) in subsection (c), as redesignated by para-9
220	220	graph (1) of this subsection— 10
221	221	(A) by striking ‘‘subsection (a)’’ each place 11
222	222	it appears and inserting ‘‘subsection (a) or (b)’’; 12
223	223	(B) in paragraph (2)— 13
224	224	(i) in subparagraph (A), by striking 14
225	225	‘‘The Commission’’ and inserting ‘‘Except 15
226	226	as provided in paragraph (3), the Commis-16
227	227	sion’’; and 17
228	228	(ii) in subparagraph (B), by striking 18
229	229	‘‘Any person’’ and inserting ‘‘Subject to 19
230	230	paragraph (3), any person’’; and 20
231	231	(C) by adding at the end the following new 21
232	232	paragraphs: 22
233	233	‘‘(3) C
234	234	IVIL ACTION.— 23
235	235	‘‘(A) I
236	236	N GENERAL.—If the Commission has 24
237	237	reason to believe that any person has committed 25
238	238	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
239	239	ssavage on LAPJG3WLY3PROD with BILLS 9
240	240	•S 196 IS
241	241	a violation of subsection (a) or (b), the Commis-1
242	242	sion may bring a civil action in an appropriate 2
243	243	district court of the United States to— 3
244	244	‘‘(i) recover a civil penalty under 4
245	245	paragraph (4); and 5
246	246	‘‘(ii) seek other appropriate relief, in-6
247	247	cluding injunctive relief and other equi-7
248	248	table relief. 8
249	249	‘‘(B) L
250	250	ITIGATION AUTHORITY.—Except as 9
251	251	otherwise provided in section 16(a)(3) of the 10
252	252	Federal Trade Commission Act (15 U.S.C. 11
253	253	56(a)(3)), the Commission shall have exclusive 12
254	254	authority to commence or defend, and supervise 13
255	255	the litigation of, any civil action authorized 14
256	256	under this paragraph and any appeal of such 15
257	257	action in its own name by any of its attorneys 16
258	258	designated by it for such purpose, unless the 17
259	259	Commission authorizes the Attorney General to 18
260	260	do so. The Commission shall inform the Attor-19
261	261	ney General of the exercise of such authority 20
262	262	and such exercise shall not preclude the Attor-21
263	263	ney General from intervening on behalf of the 22
264	264	United States in such action and any appeal of 23
265	265	such action as may be otherwise provided by 24
266	266	law. 25
267	267	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
268	268	ssavage on LAPJG3WLY3PROD with BILLS 10
269	269	•S 196 IS
270	270	‘‘(C) RULE OF CONSTRUCTION .—Any civil 1
271	271	penalty or relief sought through a civil action 2
272	272	under this paragraph shall be in addition to 3
273	273	other penalties and relief as may be prescribed 4
274	274	by law. 5
275	275	‘‘(4) C
276	276	IVIL PENALTIES.— 6
277	277	‘‘(A) I
278	278	N GENERAL.—Any person who vio-7
279	279	lates subsection (a) or (b) shall be liable for— 8
280	280	‘‘(i) a civil penalty of not less than 9
281	281	$10,000 for each day during which the vio-10
282	282	lation occurs or continues to occur; and 11
283	283	‘‘(ii) an additional civil penalty of not 12
284	284	less than $1,000 per violation. 13
285	285	‘‘(B) E
286	286	NHANCED CIVIL PENALTY FOR IN -14
287	287	TENTIONAL VIOLATIONS .—In addition to the 15
288	288	civil penalties under subparagraph (A), a per-16
289	289	son that intentionally violates subsection (a) or 17
290	290	(b) shall be liable for a civil penalty of not less 18
291	291	than $10,000 per violation.’’; 19
292	292	(5) in subsection (d), as redesignated by para-20
293	293	graph (1) of this subsection, by striking ‘‘subsection 21
294	294	(a)’’ each place it appears and inserting ‘‘subsection 22
295	295	(a) or (b)’’; and 23
296	296	(6) by adding at the end the following new sub-24
297	297	sections: 25
298	298	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
299	299	ssavage on LAPJG3WLY3PROD with BILLS 11
300	300	•S 196 IS
301	301	‘‘(e) LAWENFORCEMENTCOORDINATION.— 1
302	302	‘‘(1) I
303	303	N GENERAL.—The Federal Bureau of In-2
304	304	vestigation, the Department of Justice, and other 3
305	305	relevant State or local law enforcement officials shall 4
306	306	coordinate as appropriate with the Commission to 5
307	307	share information about known instances of 6
308	308	cyberattacks on security measures, access control 7
309	309	systems, or other technological controls or measures 8
310	310	on an Internet website or online service that are 9
311	311	used by ticket issuers to enforce posted event ticket 10
312	312	purchasing limits or to maintain the integrity of 11
313	313	posted online ticket purchasing order rules. Such co-12
314	314	ordination may include providing information about 13
315	315	ongoing investigations but may exclude classified in-14
316	316	formation or information that could compromise a 15
317	317	law enforcement or national security effort, as ap-16
318	318	propriate. 17
319	319	‘‘(2) C
320	320	YBERATTACK DEFINED .—In this para-18
321	321	graph, the term ‘cyberattack’ means an attack, via 19
322	322	cyberspace, targeting an enterprise’s use of cyber-20
323	323	space for the purpose of— 21
324	324	‘‘(A) disrupting, disabling, destroying, or 22
325	325	maliciously controlling a computing environ-23
326	326	ment or computing infrastructure; or 24
327	327	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S196.IS S196
328	328	ssavage on LAPJG3WLY3PROD with BILLS 12
329	329	•S 196 IS
330	330	‘‘(B) destroying the integrity of data or 1
331	331	stealing controlled information. 2
332	332	‘‘(f) C
333	333	ONGRESSIONAL REPORT.—Not later than 1 3
334	334	year after the date of enactment of this paragraph, the 4
335	335	Commission shall report to Committee on Commerce, 5
336	336	Science, and Transportation of the Senate and the Com-6
337	337	mittee on Energy and Commerce of the House of Rep-7
338	338	resentatives on the status of enforcement actions taken 8
339	339	pursuant to this Act, as well as any identified limitations 9
340	340	to the Commission’s ability to pursue incidents of cir-10
341	341	cumvention described in subsection (a)(1)(A).’’. 11
342	342	(b) A
343	343	DDITIONALDEFINITION.—Section 3 of the Bet-12
344	344	ter Online Ticket Sales Act of 2016 (15 U.S.C. 45c note) 13
345	345	is amended by adding at the end the following new para-14
346	346	graph: 15
347	347	‘‘(4) C
348	348	IRCUMVENTION.—The term ‘circumven-16
349	349	tion’ means the act of avoiding, bypassing, removing, 17
350	350	deactivating, or otherwise impairing an access con-18
351	351	trol system, security measure, safeguard, or other 19
352	352	technological control or measure described in section 20
353	353	2(b)(1).’’. 21
354	354	Æ
355	355	VerDate Sep 11 2014 23:24 Feb 18, 2025 Jkt 059200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6301 E:\BILLS\S196.IS S196
356	356	ssavage on LAPJG3WLY3PROD with BILLS