Ticket Bots and the BOTS Act: What the Law Bans and Who Enforces It

What the Better Online Ticket Sales Act of 2016 prohibits, which events it covers, how the FTC and states enforce it, and how fans can report suspected violations.

go2.fan · Last reviewed October 24, 2026 · 5 min read

You were online the second tickets went on sale, and they were gone almost at once. Minutes later, the same seats appeared on resale sites at several times the price. Sometimes that's simply demand outstripping supply. Sometimes it's people breaking the rules to buy far more tickets than allowed.

The federal law aimed at that second problem is the Better Online Ticket Sales Act of 2016, usually called the BOTS Act. This guide explains what it bans, what it covers, who enforces it and what it does not do.

The law is codified at 15 U.S.C. section 45c. Where this guide quotes it, the words come from the official U.S. Code text.

What the law prohibits

The BOTS Act makes two things unlawful.

First, it bans circumventing a ticket issuer's online defenses. In the statute's words, it is unlawful "to circumvent a security measure, access control system, or other technological control or measure" on a website or online service that the ticket issuer uses to enforce posted ticket purchasing limits or to maintain the integrity of posted online ticket purchasing order rules.

Second, it bans selling or offering to sell, in interstate commerce, a ticket obtained through that kind of circumvention, if the seller took part in or could control the circumvention, or knew or should have known that the ticket was acquired that way.

The FTC's 2025 business guidance gives concrete examples: the Act makes it illegal to bypass maximum ticket purchasing limits through technological means or by buying tickets under fake identities.

It's not only about bots

Despite the name, the law isn't limited to automated software. The FTC's 2021 business blog post on its first BOTS Act cases says ticket buyers who evade limits by using fictitious identities, multiple credit cards or multiple spoofed IP addresses on the same device are in violation of the Act, even if they don't use bots.

The statute has narrow exceptions. It doesn't make it unlawful to create or use software to investigate or enforce violations of the law, or for certain security research aimed at identifying flaws in these protective systems.

Which events and tickets are covered

The Act defines an event as a concert, theatrical performance, sporting event, show or similarly scheduled activity at a venue with a seating or attendance capacity of more than 200 people, that is open to the general public and is promoted, advertised or marketed in interstate commerce, or whose tickets are generally sold or distributed that way. The FTC's guidance notes that this covers events of all sizes above that threshold.

The definition of event ticket is broad. It includes physical and electronic tickets and any other evidence of a right to enter a venue or occupy a seat or area, as well as an entitlement to buy such a right for future events.

Who enforces it, and the penalties

The FTC enforces the BOTS Act, and a violation is treated as a violation of an FTC rule against unfair or deceptive practices. The FTC says that if you violate the Act, it can seek civil penalties and other relief.

States can enforce it too. A state attorney general, or another authorized state consumer protection officer, can sue in federal court on behalf of state residents to stop violations and to seek damages, restitution or other compensation. The state must generally notify the FTC in writing at least 10 days before filing, and the FTC may step into the case.

Enforcement so far

The FTC announced its first BOTS Act cases in January 2021. According to the FTC, the three ticket brokers involved used automated software to find and reserve tickets, software to hide their IP addresses, and hundreds of fictitious accounts and credit cards to get around posted ticket limits. They agreed to orders requiring them to pay $3.7 million in civil penalties, with larger judgments partially suspended based on their ability to pay.

On March 31, 2025, Executive Order 14254 directed the FTC to rigorously enforce the BOTS Act and to work with state attorneys general on enforcement. It also directed the FTC to act on price transparency across the ticket-buying process, including the resale market.

On October 15, 2026, the FTC announced a new lawsuit, filed by the Department of Justice on the FTC's referral, against a ticket broker and three of its executives. The complaint alleges that since 2022 the company bought more than eight tickets for at least 83,500 events, amassing more than 18.5 million tickets and making at least $120.8 million in profit by reselling them. It alleges the company used thousands of accounts set up with other people's names, addresses or phone numbers, virtual credit cards, IP proxy services and multi-session browsers to get around ticket limits. These are allegations, and the FTC notes that the court will decide the case.

What the BOTS Act doesn't do

The Act targets circumvention and the sale of tickets obtained through it. It doesn't set ticket prices, cap fees or ban resale in general. Resale rules, such as price caps or licensing requirements for brokers, come mainly from state law and vary by state, as the GAO found in its 2018 review. Fee disclosure is covered by a separate FTC rule, explained in our guide All-In Ticket Pricing: What the FTC Fees Rule Requires.

The law also hasn't ended the problem. GAO wrote in 2018 that it was not yet clear how much the Act had reduced bot use. The FTC staff report on its 2019 ticketing workshop said thwarting bots and identifying the people behind them were still not easy tasks, though panelists described industry efforts such as virtual waiting rooms and fan verification programs.

What fans can do

Report it. If you think a ticket broker isn't playing by the rules, the FTC asks you to report it at ReportFraud.ftc.gov. You can also contact your state attorney general.
Play by the posted rules yourself. The statute applies to "any person," not just big brokers, so buying past a posted limit with extra accounts or borrowed identities is risky for anyone.
Watch for listings that appear before or during an on-sale for tickets in large quantities. That's not proof of a violation, but it is worth noting when you report.

Key takeaways

The BOTS Act bans circumventing ticket issuers' purchase limits and order rules, and selling tickets obtained that way.
Fake identities, multiple credit cards and spoofed IP addresses can violate the Act even without bots.
It covers public events at venues with capacity over 200 people.
The FTC and state attorneys general both enforce it; violations can bring civil penalties.
Report suspected violations at ReportFraud.ftc.gov.

Sources

Spotted something out of date? Let us know.