Sports Ticketing Systems: What to Buy, and What a Ticket Cannot Do

A fan buys a seat. Your systems then have to prove the seat is theirs, open a gate in a few seconds, let them pass it legally to a friend, and tell you afterwards what happened inside the building. Almost all of the procurement attention goes to the first of those, and almost none to the last.

This is a buyer’s guide for the people who sign for that stack: ticket office, IT, security and venue operations, who rarely sign at the same time. It covers what a sports ticketing system has to do, which of those duties are legal rather than optional, and where the system stops being useful: the moment the barcode turns green and somebody is standing in a concourse with no idea which stair reaches section 214.

What is a sports ticketing system?

A sports ticketing system is the software that prices, sells, delivers, validates and re-sells admission to an event, plus the records that link every seat to a person.

It is rarely one product. Most venues run five layers, bought at different times from different suppliers, and the failures land between the layers rather than inside them. A transfer that works in the app but not at the turnstile is an integration defect, not a ticketing defect, and it will be reported to you as “the ticket didn’t work”.

Access control is the layer most often underspecified, because it is the only one that fails in public. Arrivals cluster hard against kick-off, so lane throughput decides queue length at the single moment anyone is watching. Ask for it as a measured number per lane, per reader model, with the network unplugged.

What does the law require of a ticketing system in 2026?

Four bodies of law bind a ticketing system directly: bot and resale law, consumer information duties, accessibility law, and data protection. None of them are satisfied by a vendor’s assurance that the platform is compliant.

The Better Online Ticket Sales Act of 2016 (S.3183, 114th Congress, signed 14 December 2016) makes it unlawful to circumvent a security measure or access-control system used to enforce ticket purchase limits, and to resell tickets knowingly obtained that way. Enforcement sits with the Federal Trade Commission and with state attorneys general. The practical consequence for a buyer is that your purchase-limit logic is a legal control, so it needs logs that survive an inquiry.

In the United Kingdom the same conduct is criminal rather than civil, under powers created by the Digital Economy Act 2017. Separately, section 90 of the Consumer Rights Act 2015 requires a secondary ticketing facility to tell a buyer the seat or standing area, the face value, and any restriction on who may use the ticket. If you run your own resale marketplace, those duties are yours.

Accessible seating is regulated as a sales process in its own right. 28 CFR 36.302(f) requires wheelchair spaces and companion seats to be sold through the same channels, during the same sales stages, for the same prices and in the same number of ticket classes as other seats; the Department of Justice publishes a plain-language version of those rules at ada.gov. An accessible-seating request form that sits behind a phone number is not equivalent access.

Fan data is the asset the system creates and the liability it carries. Under the GDPR, Article 5(1)(c) limits you to the data needed for the stated purpose, Article 6 requires a lawful basis for each use, and Article 9 classes biometric data used to identify a person as a special category.

How should mobile delivery and gate scanning be specified?

Specify the credential, the reader and the offline behaviour, in that order. A gate that cannot validate a ticket when the connection drops is not an access control system. It is a queue with a logo on it.

Name the standards in the contract. “Industry-standard scanning” is not a specification, while ISO/IEC 18004 and ISO/IEC 14443 are testable against the readers you already own. Ask whether entitlement is cached locally on each scanner, how long that cache stays valid, how a revoked or transferred ticket propagates to it, and what the device does when two gates scan the same code within a second of each other.

Re-entry is the quiet one. Decide before procurement whether a ticket is single-admission, pass-out enabled, or zone-restricted, because that choice reaches every scanner, every steward’s handheld and every suite door, and retrofitting it mid-season is a rewrite rather than a setting.

What does accessible ticketing require in practice?

Three things: accessible seats sold on equal terms, a ticketing interface that works without sight or a mouse, and an accessible route that actually exists inside the building once the fan is through the gate.

The web half now has a date attached. The Department of Justice’s Title II web and mobile accessibility rule, a final rule published 24 April 2024, requires public entities to conform with WCAG 2.1 Level AA, with compliance from 24 April 2026 for public entities serving populations of 50,000 or more and from 26 April 2027 for smaller entities and special district governments. A state university arena, a city-owned ballpark and a municipal stadium are all in scope, including web content a third-party ticketing vendor provides on their behalf.

WCAG 2.1 was published by the W3C on 5 June 2018 and remains the version the rule names, even though WCAG 2.2 followed on 5 October 2023. Conform to the version in the regulation, and treat the newer one as the direction of travel.

The third part is the one no ticketing platform solves. Equal access to a seat means an equal route to it: step-free, lift-served, signed, and discoverable before arrival rather than by asking a steward. Mapsted’s interactive maps and blue-dot navigation include built-in accessibility options and multi-language support, so a fan can be routed to a wheelchair space by a path that avoids stairs.

Can facial recognition replace the ticket scan?

Technically yes at the gate, legally it depends entirely on where you play, and operationally you still need a second lane. Biometric entry removes the credential, not the obligation.

Illinois is the jurisdiction that sets the commercial risk. The Biometric Information Privacy Act (740 ILCS 14) requires written release before collection, a published retention and destruction schedule, and a prohibition on selling the data, and it gives a private right of action with statutory damages of $1,000 for a negligent violation and $5,000 for a reckless or intentional one. Texas takes the enforcement route instead: the Capture or Use of Biometric Identifier law (Business and Commerce Code chapter 503) allows civil penalties of up to $25,000 per violation, recoverable by the attorney general.

Here is the honest trade-off. Biometric lanes move regular season-ticket holders faster, and the fan who declines must not be punished with a slower queue, a worse gate or an inferior seat. Keep the scan lane. Publish the retention period. Make consent genuinely refusable, which means the non-biometric path has to be signposted at the same distance from the gate.

What happens after the scan, and why does that belong in the same project?

The ticket proves entitlement and then stops being useful. It does not know which concourse the seat is on, where the nearest accessible toilet is, which gate is congested, or where to send 20,000 people when one stairwell closes.

Mapsted does not sell a ticketing system, and this is not a comparison with one. What we add is the part of the visit that begins after validation: indoor positioning and navigation that runs without beacons, without Wi-Fi access points and without on-site hardware, with blue-dot guidance at 1 to 5 metre accuracy and both horizontal and vertical positioning for multi-level buildings.

That changes three operational jobs. Navigation gets a fan from the gate they entered to the seat they bought, across levels, in their own language. Location-based messaging lets you push timely alerts to the people actually in a given area, about a closed route, a hazard or a maintenance issue, rather than to the whole bowl. And movement analytics, heat maps, dwell times and traffic flow analysis, tell you which concourses congest, which spaces go unused, and where the layout is fighting the crowd.

The safety case is the one that tends to carry the budget. Emergency route planning and real-time rerouting are built on the same positioning layer, and the system integrates with existing facility management systems rather than replacing them.

What should be in the ticketing RFP?

Five questions, each written so that a vendor cannot answer with an adjective. Put them in the document before the demo, because a demo answers the questions you forgot to ask.

Then phase the rollout against the calendar you actually have:

• Pre-season: one gate, one reader model, offline test with the uplink pulled.
• Early season: half the gates, with the old process still staffed behind them.
• Mid-season: full gates, plus the first analytics review of where queues formed.

Two more rules worth writing down. Make the vendor prove transfer and revocation end to end, not in the app alone, because that is where resale fraud and double-entry live. And separate the ticketing contract from the wayfinding and positioning contract, so that neither one can be delayed by the other.

If you run a stadium, arena or ballpark and the visit falls apart after the turnstile, we can look at your actual floor plans, gates and levels and tell you what positioning and navigation would do inside them. Book a scoping call.

Frequently asked questions

Five questions buyers ask most often about ticketing systems, gate scanning and the data that follows.

What is the difference between a ticketing system and an access control system?

The ticketing system owns entitlement: who holds which seat, at what price, under what transfer rules. Access control owns admission: whether this credential, at this gate, at this minute, opens a turnstile. Some vendors sell both, and the integration between them is where double-scans, failed transfers and broken re-entry rules appear. Specify them as two sets of requirements even when one supplier signs for both.

Do we need rotating barcodes?

Rotating barcodes help most where screenshot-based fraud and unauthorised resale are real, because a code that changes cannot be forwarded as an image. They cost you something in return: wallet pass support on every device, tolerance for clock drift, and a documented fallback for the fan whose phone is dead. If your main problem is gate speed rather than fraud, an NFC pass usually buys more than a rotating code does.

Does the ADA Title II web rule apply to our ticketing vendor’s pages?

If you are a public entity, the obligation follows the content you provide or make available, including pages a third-party ticketing vendor operates on your behalf. The rule, published 24 April 2024, names WCAG 2.1 Level AA, with compliance from 24 April 2026 for public entities serving 50,000 or more people and from 26 April 2027 for smaller ones. Put conformance evidence in the contract rather than in the marketing deck.

Can indoor positioning work in a stadium without installing hardware?

Yes. Mapsted’s positioning is hardware-free: no beacons, no Wi-Fi access points and no on-site installation, with blue-dot navigation at 1 to 5 metre accuracy and positioning across multiple levels. That matters in a venue where the ceiling is 40 metres up and every gate closure changes the route. It also means the deployment does not compete with the access control hardware project for the same shutdown windows.

What data should we expect to get after the gate?

Expect movement, not just counts. Heat maps of high-traffic areas, dwell times, traffic flow analysis and space utilisation data tell you which concourses congest, which areas of the building are used least, and where a layout change would relieve a bottleneck. Scan counts tell you how many people came in. They cannot tell you why the north-west concourse jams at half-time while the south stays empty.