What changed between these versions
A substantive refinement of the BOTS Act, v2 narrows the scope of certain prohibitions and requirements to 'online ticket issuers' and significantly alters enforcement provisions. It removes explicit civil penalty authorities and detailed security safeguard mandates, while adding limitations on how Commission guidance can be used in enforcement actions.
Overview
Extensive changes are present throughout Section 2 of the bill, which amends the Better Online Ticket Sales Act of 2016. · v2 refines and clarifies the scope of the BOTS Act, particularly by focusing on 'online ticket issuers,' while also streamlining certain requirements and significantly altering the enforcement mechanisms and the legal weight of Commission guidance.
The most significant changes in v2 involve a shift in focus to 'online ticket issuers' through new definitions and consistent application across the bill, streamlining the requirements for these issuers regarding site policies and security. Crucially, v2 removes the explicit civil action and specific civil penalty provisions that were present in v1, replacing them with a new limitation on the enforceability of Commission guidance. While the core intent to combat ticket bots remains, the regulatory approach and enforcement tools are substantially modified.
Major additions
This new paragraph, 'Limitation on commission guidance,' specifies that any guidance issued by the Commission regarding the Act does not confer rights, bind the Commission, or serve as the sole basis for an enforcement action. Enforcement actions must allege a specific violation of a provision of the Act.
This addition significantly limits the legal authority and practical impact of any guidance the Federal Trade Commission (FTC) may issue under the Act. It means that non-compliance with FTC guidance alone cannot be the basis for an enforcement action, potentially reducing the effectiveness of regulatory recommendations.
This new paragraph defines 'online ticket issuer' as a ticket issuer that owns or operates an Internet website or online service that, in the regular course of trade or business, facilitates or executes the sale of event tickets to the general public.
This definition is critical as v2 consistently applies the bill's requirements and prohibitions to 'online ticket issuers.' It clarifies which entities are subject to the Act's provisions, effectively narrowing the scope of some requirements compared to v1's broader 'ticket issuer' terminology.
Deletions
This subsection in v1 required ticket issuers to establish, implement, and maintain reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, integrity, or availability of their website or service. It included detailed considerations for these safeguards and specific procedures for overseeing third parties and service providers.
The deletion of this detailed provision removes prescriptive requirements for online ticket issuers regarding their internal cybersecurity practices and third-party vendor management. While a general duty to enforce and update site policies remains, the specific, granular obligations for security safeguards are eliminated, reducing the regulatory burden on issuers in this area. This shifts the focus from proactive security measures to reactive enforcement of purchasing limits and addressing circumvention incidents.
These subsections in v1 explicitly granted the Commission authority to bring civil actions in district courts to recover civil penalties and seek other relief for violations of subsections (a) or (b). They also established specific civil penalties: not less than $10,000 per day and $1,000 per violation, with an enhanced penalty of not less than $10,000 per intentional violation.
The deletion of these provisions fundamentally alters the enforcement framework of the BOTS Act. It removes the explicit statutory basis for the Commission to seek specific, substantial civil penalties for violations. While the Commission retains general enforcement authority under other provisions, the removal of these specific, enhanced penalties could be interpreted as a significant weakening of the Act's enforcement teeth against bot operators and non-compliant ticket issuers.
In v1, these subparagraphs included phrases like 'Except as provided in paragraph (3), the Commission' and 'Subject to paragraph (3), any person' when discussing the Commission's enforcement powers and the ability of State attorneys general to bring actions.
The deletion of this conditional phrasing is a direct consequence of the removal of v1's Section 2(c)(3) (Civil action) and its replacement with a different Section 2(c)(3) (Limitation on commission guidance) in v2. This change ensures that the enforcement powers described in (c)(2) are not made conditional on the new, unrelated paragraph (c)(3) in v2.
This provision in v1 mandated that the Commission create a *new* publicly available website within 180 days of enactment to allow individuals to report violations of the subsection.
The deletion of the explicit requirement to create a *new* website means the Commission is not obligated to build a dedicated platform for consumer complaints under this Act. Instead, v2 refers to sharing complaints submitted through 'the Commission's website,' implying the use of existing complaint mechanisms. This reduces the administrative burden on the Commission to establish a new digital infrastructure.
Modifications
This modification narrows the scope of the prohibition to specifically target 'online ticket issuers,' meaning entities that do not operate an internet website or online service for ticket sales are explicitly excluded from this particular prohibition, even if they are otherwise considered a 'ticket issuer'.
Before
Prohibited the sale of tickets obtained via bots by a 'ticket issuer' if the sale was in violation of posted purchasing limits.
After
Prohibits the sale of tickets obtained via bots by an 'online ticket issuer' if the sale was in violation of posted purchasing limits.
This modification makes the prohibition more precise by explicitly linking the act of circumvention to the bypassing of *technological controls* (access control systems, security measures) that enforce purchasing rules, rather than just the rules themselves. It also consistently applies the term 'online ticket issuer'.
Before
Prohibited using automated tasks to purchase tickets in circumvention of posted online ticket purchasing order rules, including software that circumvents access control systems.
After
Prohibits using automated tasks to purchase tickets from an Internet website or online service used by an 'online ticket issuer' *through the circumvention of an access control system, security measure, or other technological control or measure* used to enforce posted online ticket purchasing order rules.
This modification streamlines v1's separate requirements into a single, clearer mandate for online ticket issuers to enforce and update their site policies and technological controls. It removes the more prescriptive and detailed 'site security safeguards' requirements from v1, potentially offering more flexibility to issuers in how they meet their security obligations, while still requiring active management of their systems.
Before
Required ticket issuers to ensure their website has an access control system or security measure to enforce posted event ticket purchasing limits. Separately, v1 also had detailed requirements for establishing and updating site security safeguards.
After
Requires each 'online ticket issuer' to establish, implement, and maintain an access control system, security measure, or other technological control to enforce posted event ticket purchasing limits and maintain the integrity of posted online ticket purchasing order rules, and to regularly evaluate and adjust these systems.
This modification removes the mandate for the FTC to create a *new* dedicated consumer complaint website, instead directing complaints to existing Commission channels. This reduces administrative overhead for the FTC while maintaining the mechanism for sharing relevant information with State attorneys general, ensuring continued coordination on enforcement.
Before
Required the Commission to share reports from ticket issuers and consumer complaints from a *newly created* website with State attorneys general.
After
Requires the Commission to share reports from 'online ticket issuers' and consumer complaints submitted through 'the Commission's website' with State attorneys general.
This modification expands the duty of online ticket issuers beyond merely reacting to *actual knowledge* of circumvention incidents to also addressing *known or reasonably foreseeable risks*. This places a more proactive responsibility on issuers to anticipate and mitigate potential circumvention methods.
Before
Required a ticket issuer to take reasonable steps to improve its systems to address any incidents of circumvention of which it has actual knowledge.
After
Requires each 'online ticket issuer' to take reasonable steps to improve its systems to address any *known or reasonably foreseeable risks connected to* incidents of circumvention.
This modification changes the specific federal entity for coordination from the 'Department of Justice' to the 'Attorney General.' This is a minor administrative change, likely intended to clarify the specific point of contact or authority within the Department of Justice for such coordination, without altering the overall intent of inter-agency cooperation.
Before
Required coordination between the Federal Bureau of Investigation, the Department of Justice, and other law enforcement officials with the Commission.
After
Requires coordination between the Federal Bureau of Investigation, the Attorney General, and other law enforcement officials with the Commission.
This is a minor textual clarification, changing 'status of enforcement actions' to 'status of any enforcement action.' It does not appear to have a significant operative impact on the reporting requirement itself, maintaining the Commission's obligation to inform Congress about its enforcement activities.
Before
Required the Commission to report to Congress on the 'status of enforcement actions taken pursuant to this Act'.
After
Required the Commission to report to Congress on the 'status of *any* enforcement action taken pursuant to this Act'.
This modification broadens the reference for the definition of 'circumvention' from a specific subsection (2(b)(1)) to the entire section 2. This ensures that the definition applies consistently across all relevant provisions of the Act, especially given the restructuring of subsection 2(b) in v2, which no longer contains a distinct 2(b)(1) that directly matches v1's structure.
Before
Defined 'circumvention' as avoiding, bypassing, or impairing an access control system, security measure, safeguard, or other technological control or measure described in *section 2(b)(1)*.
After
Defined 'circumvention' as avoiding, bypassing, or impairing an access control system, security measure, safeguard, or other technological control or measure described in *section 2*.
Scope
Meaningful expansion or narrowing — The changes are concentrated within Section 2, which amends the core provisions of the Better Online Ticket Sales Act, and the definitions in Section 3. — v2 represents a meaningful refinement and narrowing of the policy direction. While maintaining the core objective of combating ticket bots, it shifts the regulatory burden and enforcement mechanisms, particularly by focusing on 'online ticket issuers' and altering the FTC's explicit enforcement powers and the weight of its guidance. — The changes, particularly the new definition of 'online ticket issuer' and the restructuring of Section 2(b), interact significantly with other provisions by clarifying which entities are subject to the Act's requirements and how those requirements are enforced. The removal of specific civil penalty provisions also impacts the overall enforcement landscape of the BOTS Act.
Impact analysis
Online Ticket Issuers
Online ticket issuers experience a procedural change, with a reduction in prescriptive security requirements but a clarified and potentially more proactive duty to address foreseeable circumvention risks. The consistent application of the 'online' qualifier provides clearer boundaries for their obligations.
v2 narrows the scope of certain prohibitions and requirements to explicitly apply to 'online ticket issuers' through a new definition. It also removes the highly prescriptive requirements for establishing detailed site security safeguards and third-party oversight, streamlining these into a more general duty to enforce and update site policies and technological controls.
Federal Trade Commission (FTC)
The FTC loses explicit, enhanced enforcement tools and faces new limitations on the use of its guidance in enforcement actions, potentially making it more challenging to pursue certain violations or rely on non-statutory recommendations.
v2 removes the explicit statutory authority for the FTC to bring civil actions for specific, enhanced civil penalties for violations of the BOTS Act. It also adds a new provision limiting the legal weight and enforceability of any guidance the Commission issues under the Act.
Consumers Reporting Violations
Consumers will still be able to report violations, but the expectation of a new, dedicated platform is removed. They will likely use existing FTC complaint channels, which may or may not be as prominent or user-friendly as a purpose-built site.
v1 mandated the creation of a new, dedicated public website for consumer complaints. v2 removes this mandate, instead referring to the use of 'the Commission's website' for submitting complaints.
Law Enforcement (specifically Department of Justice)
This is a minor administrative change, clarifying the specific point of contact for coordination within the Department of Justice without altering the overall intent of inter-agency cooperation on cyberattacks related to ticket sales.
v2 changes the specific federal entity for coordination from the 'Department of Justice' to the 'Attorney General' in the law enforcement coordination section.