Across the country, local governments have set up a complex web of burdensome restrictions on short-term rentals (STRs), units leased to tenants for 30 days or less. Despite their local nature, these restrictions extend well beyond county lines, affecting the online platforms that facilitate STR transactions.
At a minimum, STR restrictions center around licensing. If a person doesn’t have a license to run an STR out of their home, then they are violating the law. However, in many localities, anti-STR restrictions are imposed on would-be hosts to make it nearly impossible to obtain a license. Because these requirements are so nuanced, they are impossible to enforce without spending considerable amounts of tax dollars. So instead of scaling back their requirements, local governments turn to online STR platforms that facilitate transactions, demanding they hand over data about the hosts using their platforms—creating a privacy predicament for online platforms and a honeypot for hackers.
As more localities move to impose burdensome STR restrictions that rely on the data and assistance of online platforms for enforcement, state lawmakers should act to make clear that online platforms are not supplements to aid in the administration of overly burdensome local requirements, and the data they collect on hosts should only be accessible to localities when there’s a warrant involved.
The patchwork problem created by multiple different licensing requirements
In Muskegon, Mich., the number of licensed short-term rentals is capped at 25 percent in neighborhoods. In Kansas City, Mo., rentals operated by non-residents are generally prohibited in residential zones, with few exceptions. And in Louisville, Ky., STRs can be no closer than 600 feet from another STR.
These are only a few of the many differing restrictions localities impose based on who they decide can and cannot rent out a home. In their zeal, however, these localities run headlong into the costly and complicated issue of actually having to enforce their ordinances by hiring staff and implementing monitoring software. When faced with this challenge, many cities and localities instead turn to the online platforms that facilitate transactions between hosts and guests, like Airbnb, Homeaway, and Vrbo, demanding they turn over data about their users to be used to verify compliance and send a takedown request for out-of-compliance STR listings.
The cybersecurity problem hidden beneath the surface of these requirements
Complying with the demands and restrictions of hundreds of different localities is an obvious headache for online platforms and STR operators alike. But the most concerning part of the local-level compliance burden is that, in many cities and towns, online platforms are strong-armed into turning over data to government agencies rather than prioritizing protecting their users’ privacy. Platforms are often required to provide local governments with detailed data that includes whatever information a locality deems necessary, such as host names, dates a property was in operation, length of guest stays, amount charged per night, and more.
Many states have data protection laws on the books, but these laws protect user data from misuse in the hands of corporations—not local governments. Once a STR platform is forced to turn over data, users are dependent on their localities to protect their data.
Unfortunately, such data transfers add to an already existing honeypot of information within local government servers, which are already a favorite target for hackers to tap into. Many local governments’ cybersecurity systems are woefully underfunded, resulting in insufficient investment in the infrastructure needed to keep such data safe.
How states should approach the policy problem at hand
There are many more examples of online platforms caught in the web of local government requirements than just STR platforms. But they all face the same central issues, which break down into two key components. First, online platforms should not be part of the regulatory equation at the local level. Second, absent a full-on warrant requirement, the data that a locality can request from an online platform should be significantly limited.
Several states have already adopted workable approaches. Tennessee’s 2021 law prohibits local regulation of online marketplace operations and prohibits demands for personally identifiable user information without an administrative subpoena or court order. North Carolina enacted similar restrictions in 2023, requiring a subpoena or court order for compelled disclosure. Utah’s 2026 law follows the same approach.
Conclusion
A platform may provide convenience in connecting STR hosts with guests, but that convenience shouldn’t be the excuse local governments use to conscript online platforms when their STR ordinances get too complex for localities to police on their own. Such convenience favors the regulator, and much of the privacy, security, business risk, and cost of compliance is ignored or passed along to the platform and its users. As more localities seek to pass burdensome STR restrictions that rely on online platform data for enforcement, more states should follow the lead of states like Tennessee, North Carolina, and Utah.