The Bad Bunny on-sale ran through a gated system built on one sponsor's cards. Access required the first six digits of a Banco Popular card, payment had to complete with that same card, and each card got one transaction of up to four tickets. The inventory sold out in under six hours, and the platform later confirmed that automated software captured roughly three percent of purchases. Every sponsor, promoter, and platform that will ever run a card-exclusive on-sale should study the architecture.
KEY IMPLICATIONS
The Gate as Built
The conditions were public before the sale opened. Access exclusive to Banco Popular cardholders, entirely virtual, with the first six digits of a Popular-issued card entered in a CODE field to reach the seat map, one transaction per card, and a maximum of four tickets per transaction. Face prices ran from $50 to $100, and payment had to complete with the same card that opened the gate. More than 1.5 million people entered the queue on August 19. The inventory was gone within six hours.
Two disclosures after the sale complete the picture. The platform acknowledged that automated activity accounted for roughly three percent of purchases and canceled those transactions. Days later it opened a second sale through single-use email codes, under terms providing that orders failing the eligibility requirements or attempting to evade the purchase limit may be canceled and refunded even after an order confirmation has issued. One more fact frames the whole structure. Popular's own events page, which lists its card-gated presales across the island, states that the bank does not act as promoter of the events.
Set aside the concert. What remains is a legal architecture that Puerto Rico's live events economy now uses constantly, and it deserves to be understood layer by layer.
Layer One. The Sponsorship Agreement
Cardholder exclusivity is a purchased asset. The bank pays for it, the promoter sells it, and the platform builds the gate that delivers it. When automated purchasing operates inside that gate, the first question is contractual. What exactly did the parties promise one another?
Sophisticated papering answers five questions in advance. First, the scope of the asset. A BIN gate verifies that a card was issued by the sponsor bank. It cannot verify who typed the number. Exclusivity defined at the instrument level is a different product from exclusivity defined at the customer level, and the contract should say which one was bought. Second, the enforcement standard. Best-efforts deployment of commercially reasonable controls, or a guaranteed outcome? The controls here were layered. BIN validation, same-card payment, per-card transaction caps, a queue. A contract that names the required control set converts a vague promise into an auditable one. Third, circumvention risk. Automated software presenting valid card numbers defeats the gate without breaching it. Someone bears that residual risk, and silence allocates it by accident. Fourth, reporting. The sponsor that paid for exclusivity should hold post-sale audit rights over gate performance, cancellation volumes, and remediation. Fifth, remedies. The code-gated second sale that followed the cancellations functions as a cure mechanism. Whether the contract required it or the parties improvised it is precisely the difference well-drafted agreements settle before the on-sale, together with a communications protocol governing who says what when the gate leaks.
Layer Two. Representations to the Market
Advertised sale conditions are representations. Two frameworks govern them. Section 5 of the Federal Trade Commission Act reaches unfair or deceptive acts in commerce, and DACO administers Puerto Rico's own regime under Act 5 of April 23, 1973 and its rules against deceptive practices and advertisements, which reach representations that are false, misleading, or unsupported, and extend to advertising goods without having them available as announced. The federal benchmark is the FTC's Policy Statement on Deception, appended to Cliffdale Associates, Inc., 103 F.T.C. 110, 174 (1984), which asks whether a representation is likely to mislead a consumer acting reasonably under the circumstances and whether it is material to the decision.
The decisive line in this territory separates two postures. Announcing conditions a seller never built the capacity to enforce sits on one side. Posting real conditions, deploying real controls, reserving the right to cancel noncompliant orders, and exercising that reservation promptly sits on the other. The second posture is an enforcement narrative. The published record of this sale, the layered gate, the express post-confirmation cancellation reservation, the admitted detection, and the cancellations, is what that narrative looks like in the wild. The drafting lesson for every operator is to advertise the control actually engineered. A promise that purchases require an eligible card and payment with that card is verifiable machinery. A promise about who will ultimately hold the tickets is a hope. Write the machinery.
Layer Three. Federal Circumvention Law
The posted conditions of this sale, the CODE gate, the one-transaction-per-card rule, the four-ticket cap, are the "posted event ticket purchasing limits" and online "purchasing order rules" that 15 U.S.C. § 45c protects. The Better Online Ticket Sales Act runs against those who circumvent such controls and those who knowingly resell what circumvention obtained. The platform that posts and enforces the conditions is the statute's protected party, and canceling bot-acquired orders is the remedial conduct the statute contemplates. Federal enforcement of the Act has accelerated sharply since Executive Order 14254 directed the FTC to prioritize it, a record the firm examined in detail in its analysis of the BOTS Act and the Bad Bunny sale.
The card gate adds one structural observation. Automation that operated inside this sale necessarily presented valid Popular card numbers. The gate held as a filter of instruments even as it failed as a filter of conduct. For the operator, that fact pattern cuts favorably. Layered controls existed, they narrowed the attack surface, and their partial defeat by third parties is the federal violation of someone else. Preserving the evidence of that circumvention, transaction telemetry, account patterns, canceled order records, is what converts a difficult on-sale into an enforcement referral.
What This Means
For sponsors, the asset needs definition before it needs promotion. Specify instrument-level or customer-level exclusivity, name the required control set, secure post-sale audit rights, and negotiate make-goods for circumvention, because a second-chance window granted by contract is worth more than one granted by goodwill. Align the marketing claim with the engineered gate, since the sponsor's advertising often makes the promise the platform must technically deliver.
For promoters, own the chain of representations. The announcement copy, the sponsor's campaign, and the platform's terms should describe the same gate in the same words, and the incident communications protocol belongs in the production agreements, agreed before it is needed.
For platforms, the disciplines converge. Post the conditions precisely, build the reservation of cancellation into the terms, document the control architecture, remediate visibly, and preserve the circumvention record. The same file that protects the platform in a sponsorship dispute supports its posture before consumer regulators and arms a federal referral.
Maceira Zayas advises sponsors, promoters, venues, and ticketing platforms through its Regulatory Law and outside General Counsel practices, and counsels clients engaging with the emerging local and federal framework for live events through its Government Affairs practice.
San Juan, Puerto Rico · Washington, D.C.
This article is for informational purposes only and does not constitute legal advice. Receipt of this publication does not create an attorney-client relationship.
