New York Built the Gate, Forgot the Fence: 27% of Registered Listings Are Now Illegal

When New York activated Local Law 18 in September 2023, the numbers looked like a regulator’s dream. Active short-term rental listings dropped from around 22,000 to just over 3,000 — a decline of more than 90%. The Office of Special Enforcement (OSE) celebrated eliminating tens of thousands of illegal rentals. Condo boards applauded. The hotel lobby declared victory. Two and a half years later, that dream has a crack. A partial OSE audit revealed that 27% of approved NYC short-term rental listings now offer illegal stays — whether entire homes or stays for more than two guests — two violations of the conditions hosts accepted upon registration. And here’s the element that should make every operator, platform, and regulator react: Airbnb is not legally required to do anything about it.

How the Loophole Works

Local Law 18 relies on a verification protocol. Hosts register with OSE. Platforms verify that registration before processing a booking. If the host isn’t registered, the platform can’t process the transaction. That’s the fence. What the fence doesn’t cover is what happens AFTER a listing goes live. A host can register honestly as a primary resident offering a private room for two — the only configuration the law allows — get their registration number, then modify the listing to offer the entire apartment for four people. The registration remains valid. The platform isn’t required to reverify.

Why This Goes Beyond the Hudson

New York is the strictest short-term rental market in the US, and arguably the most watched globally. What happens there tends to set the tone everywhere else. City-wide rents have risen over 8% since the law took effect, with Manhattan median rent exceeding $4,000 for the first time. The average hotel room costs 12.6% more than in 2023. The vacancy rate — the metric the law was supposed to change — hasn’t moved.

What Operators Must Do

For professional managers and platforms, the NYC audit is a useful preview of the next two years of regulatory attention. Treat registration status as a living attribute, not a one-time checkbox. Assume platform-to-regulator data flows are coming — the EU’s May 2026 reporting obligation is the template. Build audit trails into your daily operations. Integrate regulatory risk into your pricing and portfolio models. Stop separating compliance from operations.