Tickets for Bad Bunny's two farewell concerts at Estadio Hiram Bithorn sold out in under six hours on August 19, with more than 1.5 million people in the virtual queue. PR Ticket later confirmed that automated software captured roughly three percent of purchases and said they canceled those transactions. A ten-year-old federal statute governs exactly this conduct but no one sees the consequences. Few people have read it.
KEY IMPLICATIONS
A Four-Ticket Limit and 1.5 Million People in Line
Move Concerts and Noah Assad Presents announced the closing dates of the Debí Tirar Más Fotos World Tour on August 17. Two shows. August 22 and 23 at Estadio Hiram Bithorn in San Juan. The sale opened through PR Ticket at 10:00 a.m. on August 19 with face prices between $50 and $100 and a posted maximum of four tickets per transaction. More than 1.5 million people entered the virtual queue, and every seat was gone within hours.
Then the aftermath began. Resale listings appeared at prices reaching $10,850, and the Asociación de Productores y Profesionales del Entretenimiento de Puerto Rico asked the Departamento de Hacienda and the Departamento de Asuntos del Consumidor to intervene in the secondary market. PR Ticket acknowledged that automated activity accounted for roughly three percent of purchases and announced it would cancel those transactions, a measure that could reach consumers who bought through resale platforms.
The episode pushed a federal statute into public conversation. My colleague, attorney González de la Matta, circulated a short social media clip explaining that law at a high level. This article takes the longer route. It examines what the Better Online Ticket Sales Act actually prohibits, what it leaves untouched, how federal regulators have used it, and how it applies to ticket sales for events in Puerto Rico.
What the BOTS Act Prohibits
Congress enacted the Better Online Ticket Sales Act in December 2016. The statute sits at 15 U.S.C. § 45c and contains two operating prohibitions.
The first targets circumvention. The Act makes it unlawful to circumvent a security measure, access control system, or other technological control that a ticket issuer uses to enforce posted event ticket purchasing limits or to maintain the integrity of posted online ticket purchasing order rules. The trigger is the posted rule. A four-ticket limit displayed at checkout, a virtual queue, a CAPTCHA challenge, an account verification system. Defeating any of these to exceed the posted limits falls within the prohibition.
The second targets the resale side. The Act makes it unlawful to sell, in interstate commerce, tickets obtained through circumvention when the seller either participated in the circumvention, had the ability to control it, or knew or should have known how the tickets were acquired. That knowledge standard matters. A reseller who never ran a line of code can still violate the statute if the inventory carries the fingerprints of circumvention and the reseller looked away.
The Act covers events open to the general public in venues with capacity above 200 persons, marketed or ticketed in interstate commerce. Its definition of ticket issuer is broad and includes the venue operator, the promoter, the performing artist, and any agent of them. A narrow exception protects security research and enforcement-related testing.
What the Statute Does Not Do
The popular shorthand oversells the law. The BOTS Act does not regulate resale prices. It does not prohibit scalping as such. A person who lawfully buys four tickets and resells them at a markup has no federal BOTS Act problem, whatever other consumer or tax rules may apply. The statute also creates no private right of action. A fan who lost out to bots cannot sue under it.
Enforcement runs through two channels. The FTC enforces the Act with its full Federal Trade Commission Act powers, and a violation is treated as a rule violation under 15 U.S.C. § 57a(a)(1)(B), which opens the door to civil penalties for first offenses. Each ticket obtained through circumvention can count as a separate violation, at a maximum that currently stands at $53,088 per violation. The Act separately authorizes the attorney general of a State, and any other state consumer protection officer authorized by the State, to bring a parens patriae action in federal district court for injunctive relief, compliance, and damages or restitution on behalf of residents.
Price transparency has its own federal instrument. The FTC's Junk Fees Rule, issued in December 2024 and effective since May 2025, makes it an unfair or deceptive practice to advertise a live event ticket without clearly and conspicuously disclosing the total price, mandatory fees included. The rule applies across the primary and secondary markets and carries the same maximum penalty of $53,088 per violation. The BOTS Act polices how tickets are acquired. The Junk Fees Rule polices how their prices are displayed. Together they frame the federal side of the conduct now under scrutiny in Puerto Rico.
The Enforcement Record
The statute sat quiet for years. The FTC brought its first action in January 2021 against three New York ticket brokers that used automated software, concealed IP addresses, and hundreds of fictitious accounts to sweep up tens of thousands of tickets. The brokers faced judgments of more than $31 million in civil penalties, partially suspended based on their inability to pay, leaving them to pay $3.7 million. For nearly a decade that remained the only enforcement action under the Act.
The posture changed in 2025. Executive Order 14254, issued March 31, 2025, directed the FTC to rigorously enforce the BOTS Act, to collaborate with state attorneys general and state consumer protection officers, and to share evidence with them. In August 2025 the FTC sued Maryland-based Key Investment Group and affiliated resellers in federal court, alleging they circumvented Ticketmaster purchase limits at massive scale to acquire and flip tickets to Taylor Swift's Eras Tour and other events. In September 2025 the agency went further and sued Live Nation and Ticketmaster themselves, joined by attorneys general from seven states, alleging the companies allowed brokers to sweep up tickets worth millions before reselling them at substantial markups. A separate broker, Elite Events, settled BOTS Act claims in 2026 after the FTC alleged it deployed overseas workers as human ticket pullers, equipped with fabricated email addresses, virtual credit cards, and proxy servers, to collect more than 100,000 tickets across nearly 6,000 events.
The most consequential development arrived this spring. Key Investment Group moved to dismiss, arguing the statute reaches only automated bots and that its own operation relied on human purchasers. On April 28, 2026, Chief Judge George L. Russell III of the District of Maryland denied the motion, rejecting the argument that the Act applies only to automated bots and holding that the FTC had plausibly alleged violations. The court also rejected vagueness and major questions challenges to the statute. The alleged scheme involved fake names, thousands of credit card numbers, and hundreds of SIM cards. The name of the statute misleads. It is a circumvention law, and the April ruling confirms that the method of circumvention does not matter.
How the Act Reaches Puerto Rico
The federal question has a clear answer and an open one.
The clear answer concerns the FTC. The Act incorporates the full jurisdiction of the Federal Trade Commission Act, and that jurisdiction extends to commerce in Puerto Rico. An event at a San Juan stadium with capacity far above 200, ticketed online to a global fanbase, sits comfortably within the statute's definitions. The August 19 sale maps onto its elements with precision. A posted four-ticket limit constitutes a posted purchasing limit. The virtual queue and anti-bot systems constitute security measures and access controls. Automated purchasing that defeated them is the exact conduct the first prohibition describes, and downstream sellers of that inventory face the knowledge standard of the second.
The open answer concerns local enforcement. The Act authorizes suits by the attorney general of a State and by other authorized state consumer protection officers. It never defines State. Congress routinely defines that term in consumer statutes to include Puerto Rico. Here it stayed silent. The channel itself is already active. Attorneys general from seven states sit beside the FTC as co-plaintiffs in the pending Live Nation litigation. Whether the Secretario de Justicia or DACO may invoke the parens patriae provision directly is an unresolved interpretive question with real practical stakes, since Executive Order 14254 instructs the FTC to share evidence with precisely these state-level officials. Nothing prevents Puerto Rico authorities from acting under their own consumer protection laws in the meantime, and the pending APPEP petitions before Hacienda and DACO show that local regulators are already being pulled into the secondary market.
What This Means
For promoters, venues, and ticketing platforms, the statute rewards discipline. Its protections attach to posted limits and deployed controls. Documenting the posted rules, the queue architecture, and the bot mitigation record preserves the enforcement predicate and positions the issuer to refer evidence to the FTC. Cancellation of bot-acquired orders is defensible and increasingly expected, and it demands careful consumer communication, since cancellations propagate to innocent downstream buyers.
For resale platforms and brokers, the April 2026 ruling eliminated the most comfortable defense. Multi-account operations run by humans sit inside the statute. Inventory acquired at volumes no ordinary purchaser could achieve invites the knew-or-should-have-known analysis, and the current FTC treats these cases as a priority backed by a presidential directive. Their listing pages carry a second federal duty as well, since the Junk Fees Rule requires the total price, mandatory fees included, in every displayed offer.
For companies in the events economy generally, this is a compliance moment. Acquisition practices, terms of service, disclosure language, and vendor relationships in the ticketing chain deserve review against a statute that spent a decade dormant and now sits at the center of federal enforcement policy.
Maceira Zayas advises ticket issuers, promoters, platforms, and companies in regulated markets through its Regulatory Law and outside General Counsel practices, and counsels clients engaging with the emerging local and federal framework through its Government Affairs practice.
San Juan, Puerto Rico · Washington, D.C.
This article is for informational purposes only and does not constitute legal advice. Receipt of this publication does not create an attorney-client relationship. AI was used to assist in the drafting of this article.
