New York Built the Gate, Forgot the Fence: 27% of Registered Listings Are Now Illegal

When New York activated Local Law 18 in September 2023, the numbers looked like a regulator’s dream. Active short-term rental listings plummeted from roughly 22,000 to just over 3,000, a drop of more than 90%. The Office of Special Enforcement (OSE) celebrated the elimination of “tens of thousands” of illegal rentals. Co-op boards applauded. The hotel lobby declared victory.

Two and a half years later, that dream has a crack.

A partial OSE audit has found that 27% of approved short-term rental listings in New York City are now offering illegal stays, either whole-home rentals or accommodations for more than two guests — both violations of the terms hosts agreed to when they registered. In plain language: more than one in four hosts who passed the city’s verification turned around and crossed it to do exactly what the law was designed to prevent.

And here’s the part that should make every operator, platform, and regulator pay attention: Airbnb is not legally required to do anything about it.

How the Loophole Works

Local Law 18 relies on a verification protocol. Hosts register with the OSE. Platforms verify that registration before processing a booking. If the host isn’t registered, the platform can’t process the transaction. That’s the fence.

What the fence doesn’t cover is what happens after a listing goes live. A host can truthfully register as a primary resident offering a private room for two guests — the only configuration the law permits — obtain their registration number, and then edit the listing to offer the entire apartment for four. The registration remains valid. The platform isn’t required to re-verify. The listing keeps generating bookings.

The OSE can pursue individual hosts after the fact, but that’s complaint-driven enforcement against tens of thousands of units. It’s exactly the type of whack-a-mole the registration system was meant to eliminate.

Why This Matters Beyond the Hudson

New York is the strictest short-term rental market in the United States, and arguably the most watched in the world. What happens there tends to set the conversation everywhere.

The 27% finding arrives at a time when the debate over LL18 was already shifting. Consider what the last two years have actually produced:

• Citywide rents have risen more than 8% since the law took effect, and median Manhattan rents topped $4,000 for the first time.
• The average hotel room costs 12.6% more than in 2023.
• Apartment construction starts in Q1 2025 were more than 70% below the city’s 10-year average, the fifth consecutive quarterly decline.
• Short-term rental listings in the outer boroughs fell from roughly 17,000 to 1,400, taking with them some 80,000 guests per month and, according to an HR&A Advisors report, up to $1.6 billion in projected visitor spending.
• Vacancy rates — the metric the law was supposed to change — have not changed.

Supporters argue LL18 successfully eliminated de facto illegal hotels. Critics — increasingly including City Council members backing the Intro 1107 reform bill — argue the housing crisis has only deepened while the enforcement regime itself is now leaking. The new 27% figure gives critics a data point difficult to ignore: the system isn’t just not fixing housing — it’s failing on its own terms.

The Compliance Playbook Is Changing, Fast

Zoom out and New York is a data point in a global pattern. The enforcement frontier is shifting from gate-based (register once, list forever) to continuously monitored (prove compliance every month, forever).

Spain has already ordered platforms to remove approximately 86,000 non-compliant listings, the most aggressive takedown action in Europe to date. Barcelona is phasing out all tourist flats by November 2028; its approximately 10,101 HUT licences all expire that month, with no renewals. New short-term rental declarations are a Catalonia requirement for 2026, and operating without proper authorisation now carries fines of up to €600,000.

The European Union has a heavier hammer coming. Under Regulation (EU) 2024/1028, from May 2026, platforms must transmit monthly per-listing activity data to national single digital entry points. This is the structural fix for exactly the gap New York just discovered: if stay-level data is reported every month, a “private room for two” registration that actually books six people in a full apartment is caught in the data, not through complaint-driven inspections.

Other cities to watch: Amsterdam caps primary-residence STRs at 30 nights per year (with proposals for 15 in some zones from April 2026). Paris allows municipalities to cut primary-residence limits from 120 days to 90. Lisbon is transferring more control to municipalities under a revised Alojamento Local framework. London, Vancouver, Cape Town, and Bali are under pressure to tighten their rules.

The common thread isn’t a single rule. It’s a change in how regulators think about the problem. Registration is necessary but insufficient. What matters now is telemetry: the ability to see what a listing is actually doing after it’s been approved.

What Operators Should Actually Do

For professional managers and platforms, the New York audit is a useful preview of the next two years of regulatory attention. Some practical takeaways:

1. Treat registration status as a living attribute, not a one-time checkbox. If your operation touches any market with a registration regime — NYC, Catalonia, Paris, Lisbon, Amsterdam — create an internal process to re-verify listing configurations against registration terms. The regulator will eventually do it; it’s better to catch your own discrepancies first.

2. Assume platform-to-regulator data pipes are coming. The EU’s May 2026 reporting obligation is the template. Any listing detail that can be cross-referenced with a registration (guest cap, whole-home vs. private, nights booked, occupancy declarations) will be. Do the reconciliation now.

3. Build audit trails into daily operations. Time-stamped listing screenshots, HUT/registration number views, guest logs, condition logs: all of this stops being “nice to have” the moment an inspector shows up with a cached Google screenshot of a listing you pulled months ago.

4. Price regulatory risk into your pricing and subscription models. Barcelona’s licence sunset in 2028 is 30 months away. Paris can cut limits with a council vote. Amsterdam zones can drop to 15 nights. A yield model that doesn’t discount forced conversion or cap-reduction scenarios is a yield model that leads you to buy the wrong assets.

5. Stop separating “compliance” from “operations.” The operators who will come through the next regulatory cycle unscathed are those who have woven compliance into the very systems that manage pricing, guest communication, and property operations — not those who treat it as an annual legal review.

The Broader Question

New York’s 27% figure isn’t really a scandal about 27% of hosts. It’s a scandal about the assumption — baked into most vacation rental regulations drafted since 2018 — that one-time registration plus platform verification is enough.

It was never going to be enough. Static regulation meets a dynamic product and loses. What replaces it is a combination of continuous data sharing, platform accountability for post-registration conduct, and on-the-ground inspection regimes that treat the listing itself as the compliance object, not the host’s paperwork.

That’s a much heavier lift for platforms, a much heavier lift for operators, and — frankly — a much heavier lift for the cities that actually have to run these programs. But it’s where the market is heading. New York just confirmed why.

The only real remaining question is which market confirms it next.