Peter

Here we go again... Remember the wave of restrictions slapped on Season Ticket holders over the summer? The club is now targeting Official Members. They aren't even calling it "suspicious activity" anymore; they’ve rebadged it as "activity that requires further review." We all want touting tackled, but dropping restriction emails on a Monday at 18:00 with a deadline of Wednesday at 08:00 gives fans barely 38 hours, effectively one single working day to respond. This is completely unacceptable for innocent supporters. One fan who contacted me is travelling all the way from Spain and now has no idea if his ticket for Saturday will even work at the turnstiles. If United are taking this heavy-handed approach, their detection needs to be bulletproof. We all know how flawed the club's data matching can be, yet they clearly haven't learned from summer's mistakes. Worse still, this directly violates the club's own published Club Sanctions and Appeals Policy, which contractually guarantees supporters a fair 14-day window to appeal any initial sanction decision. Slashing a two-week policy down to one working day is a blatant failure of due process and breaches the Consumer Rights Act 2015, which protects paying consumers from unfair terms and one-sided ultimatums. The club cannot bypass its own written rules simply because a fixture falls within that 14-day window. If you’ve been hit with one of these emails, submit a response before the Wednesday 08:00 deadline so your ticket isn't automatically cancelled for Saturday, but state clearly in writing that you are replying strictly under protest and duress, reserve your full 14-day right to reply, and will escalate any wrongful cancellation to the Independent Football Ombudsman. The Sanctions process is broken, United are unfairly treating supporters, and they need reporting. You can do this through any or all of the following: Independent Football Ombudsman (@TheIFO): For direct breach of their own published 14-day sanctions policy and lack of procedural fairness. Citizens Advice / Trading Standards: Under the Consumer Rights Act 2015 for unfair commercial practices and unreasonable deadlines on paying customers. The FSA (@WeAreTheFSA): Log your case with the Football Supporters' Association, they are collecting evidence on unfair club sanction regimes. Information Commissioner's Office (@ICOnews): If they use vague digital tracking/profiling and refuse to provide your data under a Subject Access Request (SAR). If you are a member who has received one of these restriction emails, please get in touch. The way you treat us is a disgrace.

I used to get such a buzz on match day; the butterflies, the anticipation, seeing mates, meeting new people, getting inside Old Trafford, watching the players walk out of the tunnel onto the pitch, and looking around in awe at everything. After the clubs attack on loyal supporters over the last 6 weeks, today feels very different. Don't get me wrong, I'll get behind Carrick, his team and the players. I'll support everything that is right about Manchester United, the Football Club. That will never change. But why does it feel so different? Because Manchester United, the business, no longer seems to want me, my mates, or the supporters who have given so much. It feels like they're slowly draining the life and soul out of everything that made Manchester United one of the most famous football clubs in the world. Manchester United still wants to be the known as the biggest and most famous club in the world, they just seem to want to do it without people like me & you supporting them, that helped give them that title in the first place.

An update on the ongoing #MUFC ticketing restrictions and the data behind them. I've reviewed a formal response to a Subject Access Request (SAR) submitted to Manchester United regarding the tracking data used to flag accounts. For those interested in how the club and its third-party providers are handling data protection, compliance, and transparency, the response exposes serious contradictions. Here is an analysis of what the club disclosed, what they withheld, and why their position under UK GDPR is deeply flawed. 1. The Investigation Thresholds and Device Totals The Data Protection Team confirmed the underlying mechanics behind the "trawling": "Our review identified where one device had been used to access multiple accounts. In order to do this, we used tooling to allocate unique identifiers to devices... we applied a lower threshold at which we would contact account holders for more information, which is why you received our email." In the disclosure, they provided aggregate figures across linked accounts: One device accessed 16 accounts in total between 1 March and 12 July 2026. Another linked device accessed 40 accounts across the same period. 4 different devices accessed each individual account. 4 distinct IP addresses were recorded against login details on one account, and 5 distinct IP addresses against the other. While this confirms that device fingerprinting was the primary mechanism used to flag accounts, providing summary numbers is not the same as providing the actual personal data. A SAR is meant to provide the data subject with copies of their raw data, including the actual device fingerprint hashes, unique identifiers, and timestamped access logs generated against the account, not merely an executive summary written by an administrator. 2. The IP Address Contradiction: Using Data as Evidence While Denying Access The most glaring contradiction in the club’s response comes down to how they treat IP addresses: "4 different IP addresses are recorded against the log in details for [Account A], and 5 different IP addresses are recorded against the log in details for [Account B]. We are unable to provide you with those specific IP addresses, as this is personal data which we cannot verify as being about you." Let that sink in. The club used these exact IP addresses and login events to monitor, flag, and restrict supporter accounts. Yet, when a supporter asks to see the specific IP logs associated with their own login history under Article 15 of the UK GDPR, the club refuses on the grounds that they "cannot verify" whether the IP belongs to them. You cannot have it both ways. If an IP address is considered reliable enough evidence to restrict a supporter's account and restrict their match tickets, it cannot suddenly become too detached to disclose when that same supporter exercises their statutory legal rights. Under ICO guidelines and established data protection law, network logs linked directly to an identified user account form part of that individual's processing history. 3. Conflating Statutory Legal Rights with Internal Appeals A Subject Access Request is a legal process governed by the Data Protection Act 2018 and UK GDPR. It is entirely separate from club ticketing operations. Yet, the Data Protection Team used a statutory legal response to lobby on behalf of the ticketing appeals department: "If you have not already, we encourage you to reply to the email you received from the Club. The best way to resolve any of these issues is to share the information we need to understand the account activity in question. Every response is reviewed individually by a member of the ticketing team." A Data Protection Officer's role is to ensure legal compliance and provide unredacted personal data held on file, not to act as an administrative chaser nudging supporters into complying with an internal ticketing interrogation. 4. General Disclaimers Instead of Specific Compliance When requested to provide the exact purposes of processing and third-party disclosures under Article 15, the club simply pointed to a generic webpage: "In addition to the data we have provided, you are entitled to understand why we hold your data, in accordance with Article 15 of the UK GDPR. To this end, we direct you to the Club's Privacy Policy which contains all the relevant details." Directing individuals to a broad, off-the-shelf privacy policy does not meet the requirement to explain which specific third-party data processors (the external analytics firm) processed the data, how long those unique device identifiers are retained, or how the profiling was executed in this specific investigation. Where This Leaves Us The club has declared the SAR "completed in full," but this response raises more questions than it answers: Why are supporters denied access to the specific IP and timestamp logs used to place restrictions on their accounts? What specific third-party data processor was engaged to harvest and generate these unique device identifiers? Why is the club relying on high-level summaries rather than providing the underlying audit data as required by law? If the club is genuinely committed to the transparency promised in its public statements, that transparency must extend to supporters exercising their statutory rights under data protection law. Refusing to hand over the underlying technical data while using that very same data to justify account restrictions falls well short of that standard.

We are now just 6 working days away from the Hull City away fixture, yet numerous genuine supporters are still trapped in limbo awaiting outcomes on account restrictions. Five members of my regular matchday group are currently sitting in a WhatsApp chat every day with zero clarity. Others in identical circumstances have had their restrictions lifted, while these five are left chasing updates, only to be told that the club hopes to hold a meeting next week, with more to follow. Let us remember what Manchester United stated publicly in their update: "We know that this issue has caused significant concern and distress for some supporters." "However, we recognise that the way this process was communicated, and the impact it has had on some loyal match going supporters, has caused genuine upset and distress." Despite acknowledging the upset and distress caused by this flawed process, the club continues to inflict it on innocent, loyal fans through complete inaction and bureaucratic delays. The Club have openly said it might not be done next week, after their statement said it would be before the start of the season: "we are hoping to hold a meeting next week and then subsequent meetings to follow”. Who enters a process like this without planning for these types of outcomes when the season starts at the end of next week? If the club acknowledges that genuine match-going supporters are caught in this net, holding vague meetings week after week while fixtures approach is unacceptable.