How do I ensure my conference registration and ticket sales with a ticketing platform is compliant?

To make conference registration and ticket sales compliant, treat it as a combination of payments compliance, privacy/data compliance, tax, accessibility, and consumer law. The exact requirements depend on your country/region and where your attendees are located.

1) Confirm what laws apply

At minimum, check:

• Your country/state/province laws
• Where attendees are located (especially if international)
• Where the ticketing platform processes payments
• Whether you sell to consumers, businesses, or both

Common areas:

• Data privacy: GDPR/UK GDPR, CCPA/CPRA, etc.
• Payments/security: PCI DSS
• Taxes: sales tax/VAT/GST
• Consumer protection/refunds
• Accessibility: ADA / Equality Act / local accessibility laws
• Marketing: email/text consent laws

2) Use a ticketing platform that supports compliance

Choose a platform that provides:

• PCI-compliant payment processing
• SSL/TLS encryption
• Role-based access controls
• Audit logs
• Data retention/deletion tools
• Consent capture
• Refund/cancellation workflows
• Tax calculation and invoicing support
• Accessibility support for registration pages

Ask the vendor for:

• PCI attestation / certification details
• Data Processing Agreement (DPA)
• Subprocessor list
• Security documentation
• GDPR/CCPA support features
• Incident response / breach notification terms

3) Publish clear terms and policies

Your registration flow should include:

• Terms and conditions
• Refund/cancellation policy
• Privacy policy
• Code of conduct for attendees
• Consent language for marketing communications
• Event changes policy (speakers, venue, date changes, force majeure)

Make sure attendees actively agree to:

• Purchase terms
• Refund policy
• Privacy notice
• Optional marketing opt-in

4) Collect only necessary data

Use data minimization:

• Collect only what you need for registration, access control, and required follow-up.
• Make optional fields clearly optional.
• Avoid collecting sensitive personal data unless necessary.

If you collect sensitive data, such as:

• Dietary restrictions
• Accessibility needs
• Health-related info
• Demographic data

Then you may need:

• Explicit consent
• A clear purpose statement
• Additional safeguards
• Limited access and retention

5) Handle payments correctly

For payment compliance:

• Do not store card details yourself unless absolutely necessary and you are set up for PCI scope
• Use the platform’s hosted checkout or tokenized payments
• Ensure fraud controls are enabled
• Use 3D Secure / SCA where required
• Reconcile charges, refunds, and chargebacks properly

6) Make tax handling correct

Depending on jurisdiction, you may need:

• Sales tax, VAT, or GST collection
• Correct tax invoices/receipts
• Tax-exempt handling for nonprofits or resellers
• Local tax registration if thresholds are met

If you sell internationally, determine:

• Whether taxes are based on seller location or buyer location
• Whether your ticket price includes tax or adds it at checkout
• Whether the platform remits tax on your behalf or only calculates it

7) Privacy and data protection

If you’re subject to GDPR/UK GDPR or similar:

• Have a lawful basis for processing attendee data
• Provide a privacy notice at or before collection
• Obtain consent for marketing, cookies, and optional data use where required
• Sign a DPA with the platform
• Set retention periods
• Support data access/deletion requests
• Limit sharing of attendee data with sponsors unless consent or another lawful basis exists

8) Accessibility and nondiscrimination

Ensure:

• Registration pages are accessible
• Ticketing flow works with screen readers and keyboard navigation
• Ticket types and discounts do not discriminate unlawfully
• Accommodations requests are handled fairly
• In-person event accessibility info is disclosed clearly

9) Email and messaging compliance

If you send confirmation emails, reminders, or marketing:

• Separate transactional emails from marketing emails
• Get opt-in where required
• Include unsubscribe options for marketing
• Follow local spam/anti-solicitation rules
• Be careful with SMS and WhatsApp consent

10) Keep records

Maintain:

• Registration logs
• Consent records
• Refunds and chargebacks
• Tax reports
• Privacy requests
• Security incidents
• Communications with attendees

This helps with audits, disputes, and legal compliance.

11) Special cases to watch

• Minors: parental consent may be required
• VIP/sponsor tickets: additional privacy/sharing rules
• Onsite badge scanning: disclose tracking/data use
• Networking apps: require separate consent and policy review
• Recorded sessions: consent for filming/photography
• Post-event sponsor lead sharing: confirm lawful basis and disclosure

12) Get legal review

For a real conference, it’s worth having a lawyer review:

• Terms and conditions
• Privacy policy
• Refund policy
• Sponsor agreements
• Data-sharing arrangements
• International attendee terms
• Tax setup

Practical compliance checklist

Before launch, confirm:

• Ticketing platform is PCI compliant
• Privacy policy is published
• Terms/refund policy are visible at checkout
• Consent is captured for marketing
• Data collection is minimized
• Tax settings are correct
• Accessibility needs are supported
• DPA is signed with the platform
• Data retention/deletion rules are set
• Support process exists for refunds, disputes, and privacy requests

If you tell me your country, where your attendees are, and which ticketing platform you’re using, I can give you a more specific compliance checklist.