How to export attendee data from Eventbrite (and what the file leaves out)

How do you download the attendees report from Eventbrite?

For a single event: from your account go to Events, select the event, open Reporting, choose Event reports and then Attendees; pick the file type and collect it from the Exports tab. For several events at once — the normal case when you are reconstructing a festival's history — you don't go through the individual event but through account-level Reporting, where you select the events and hit Run report, with filters for order date, currency and whether guests are included. The procedure is documented in Eventbrite's help article, which lists CSV and XLS as the formats and recommends CSV past a million records.

Don't confuse two different reports: the Orders report is built on the order object, the Attendees report on the attendee object — and an order can contain multiple tickets with multiple attendees, because a buyer can purchase for other people. If you need one row per ticket, you need the Attendees report.

If downloading by hand after every event has become a ritual, the same thing automates with an OAuth token: the Eventbrite API exposes an event's attendees at GET /v3/events/{event_id}/attendees/ with a paginated response, and lets you filter by status. It makes the files arrive by themselves; the limits of what is in them, below, are unchanged.

What is actually in the file?

The Help Center does not publish the column list. The most precise public description of the same data is the API documentation for the Attendee object, which lists it field by field: the profile (first name, last name, email), barcodes with scan status and check-in method, answers to custom questions, the check-in, cancelled and refunded flags, the ticket class name, a cost breakdown across base price, fees and tax, plus the order and event identifiers.

Excellent material for box office and access control. But the sentence that matters is the first line of that page: "The model is one Attendee per ticket." One record per ticket, not per person. Two limits follow, and no export procedure fixes either:

• No person-level identity. Someone who came to four editions is four rows in four different files. Recognising them as one person is your job, downstream.
• No consent state. The documented object has no field telling you whether that person agreed to hear from you.

The attendees report is not your consent list

This is the mistake that costs the most: download the report, paste the email column into your newsletter tool, press send. The attendees report tells you who holds a ticket, not who agreed to hear from you.

Before you download it, check one setting: under Order options → Order form you choose whether to collect details only from the "Ticket buyer" or from "Each attendee". In the first case four tickets bought together carry the same email, so the report shows four rows for one address.

Consent lives in a separate object, under Marketing → Email campaigns → Subscriber list: as Eventbrite's help article explains, an auto-generated list called "Purchasers" collects the attendees who opted into your marketing at checkout, and downloads as CSV. The same page warns that for legal reasons you cannot import attendees from events held in Australia, Canada or Germany.

And Eventbrite is clear about whose burden the legal basis is: on its EU data protection page it states that an organiser "needs to secure its own compliant opt-in consents", and that Eventbrite does not do this on the organiser's behalf. So there are two files to download and only one is a usable marketing list: if you merge them, the consent column has to survive the merge and stay current.

Who owns your attendee data?

Contractually the answer favours you. Eventbrite's Data Processing Addendum for Organizers makes the organizer the "Data Controller" and Eventbrite the "Data Processor". Exporting your data is not a favour granted to you; it is your role working as intended. The same document provides that at your request, Eventbrite will return, delete or destroy consumers' personal data — which reads equally well backwards: downloading the file does not delete the copy on the platform. Two separate actions, and the second has to be asked for.

There is a part that is not yours, though: on the same EU page, Eventbrite says it acts as a controller in its own right over people who register directly with Eventbrite, and uses their data for research, analysis, product improvement and targeted recommendations. Your export is yours; that person's marketplace profile is not.

Two points of law that are commonly stated wrongly. First, GDPR Article 20 portability is not your lever — that right belongs to the data subject, the individual, over their own data, not to the organiser who wants to change platform. Second, your lever is the contract: Article 9 of Regulation (EU) 2019/1150 (the P2B Regulation, applicable since 12 July 2020) requires online intermediation services to describe in their terms and conditions what data access business users have — or that they have none. That clause must exist: read it before you sign.

What if you sell on DICE, TicketOne or another platform?

What changes from platform to platform is not the file format: it is whether a file of personal data exists at all.

DICE is explicit: the downloads exist, and each comes with its own rules. Section 11 of DICE's MIO user guidelines separates "All Customer Data" — the full customer list, which you may contact only with transactional or operational messages about the event they bought — from "Marketing Opt-ins", the only list you can send promotions to, and one you must download fresh before every send. The guidelines do not say which fields each download contains. MIO Connect, DICE's own messaging tool, is likewise limited to operational or transactional messages, and for the contact data used through it DICE and the organiser are joint controllers.

TicketOne, the Italian CTS Eventim company, describes on its B2B site reporting tools — EVENTIM.Analytics — that help an organiser understand who is buying, with sales statistics and charts. Reporting about your audience and an extraction of personal data are different things, and that page does not state which categories of personal data an organiser can export: a question to put in writing to your commercial contact, with the answer belonging in the contract.

For other platforms we did not find public documentation detailed enough to say, and we would rather write that than fill the gap: treat the absence of a public answer as the reason to ask for one.

What do you do with the file once you have it?

An export is worth what you do with it, and there are four jobs the file will not do for you: recognising the same person across editions and systems, keeping the consent state attached, preserving history instead of overwriting it every year, and honouring suppressions even when that person buys again through a different channel.

Solco exists for that part: it ingests ticketing data — direct connectors for DICE, Eventbrite and Shopify, CSV from anything else, box office included — plus QR scans, deduplicates it into unique profiles that survive a change of ticketing platform, and keeps consent and suppressions attached to the profile rather than to a file. It is not a ticketing platform and does not replace one. From Eventbrite the connector pulls orders and attendees through the API, but for the reason above those attendees arrive with marketing consent set to false: contactability is built separately. The same material feeds the impact report for your council and sponsors: unique people, deduplicated, and origin by country, with every figure labelled for reliability. What goes in a sponsor report is covered in this guide.

Frequently asked questions