Court Finds that MLB’s Arbitration Clause Doesn’t Cover the Bases

On September 30, 2026, a New York federal judge denied Major League Baseball’s digital-ticketing arm, MLB Advanced Media, L.P. (MLBAM), a chance to send to arbitration most claims over tickets that disappeared from the MLB Ballpark app after a cyberattack. Lanham v. MLB Advanced Media, L.P., No. 25-cv-7780 (AS), slip op. at 6–8 (S.D.N.Y. Sept. 30, 2026). The order is a reminder that arbitration language in online terms of use does not guarantee a cyber dispute will be arbitrated.

The complaint alleged that attackers used credentials leaked or stolen from other websites to access MLBAM accounts and steal fans’ tickets. The plaintiffs claimed the app’s security flaws enabled the intrusions.

The court saw two main hurdles to arbitration. The first was whether the plaintiffs had agreed to MLBAM’s 2024 terms of use at all. MLBAM pointed to emails and app pop-ups announcing the changes, plus terms linked on sign-up and login screens during the 2025 season. However, most plaintiffs had opened their accounts years earlier, and the court held that the record did not establish whether and when they encountered a screen that required them to accept the updated terms.

Second, the terms excluded claims related to alleged violations of users’ privacy rights or interests. MLBAM argued that plaintiffs alleged only potential privacy violations and that exposed information was publicly available. The judge focused instead on the alleged account intrusions: users had a privacy interest in their accounts and contents, even if the claims also involved missing tickets. Because the carveout covered “any” related claim and its examples were nonexclusive, it was “capacious.”

Organizations should keep in mind that notice of revised terms may not establish assent, particularly for longtime users. Records showing which version each user accepted, when, and through what screen, can help demonstrate user agreement. They should also consider how broadly a privacy carveout may reach claims involving account access, exposed information, or missing digital property. If certain disputes are intended to remain in arbitration, the carveout’s boundaries should be clear. Otherwise, the exception could take arbitration out of play.