Fourth Amendment Limits NYC’s Demands for Airbnb Customer Records

As part of its ongoing crackdown on short-term lodging, New York City passed an anti-Airbnb ordinance scheduled to take effect next month. HomeAway was also affected by the law, but I’ll focus on Airbnb. The ordinance addresses the challenges faced by the enforcement agency because Airbnb “Listings do not include a host’s full name, email address, telephone number, or the rental property’s exact address; Airbnb securely stores that information.” The ordinance requires Airbnb to provide monthly reports of its short-term lodging transactions that include:

(1) The physical address of the short-term rental associated with such transaction, including the street name, street number, apartment or unit number, borough or county, and zip code;

(2) The full legal name, physical address, phone number and email address of the host of such short term rental and the uniform resource locator (URL) and the individualized name and number of such host on such booking service’s platform;

(3) The individualized name and number and the URL of such advertisement or listing;

(4) A statement as to whether such short-term rental transaction involved (i) shortterm rental of the entirety of a dwelling unit of housing accommodations in a building or (ii) short term rental of part of such unit or housing accommodations;

(5) The total number of days that the dwelling unit, part thereof or housing accommodations in a building were rented as a short-term rental through such booking service’s platform;

(6) The total amount of fees received by such booking service for short-term rental; and

(7) If such booking service collects rent for short-term rentals on behalf of such host, (i) the total amount of such rent received by such booking service and transmitted to such host and (ii) the account name and consistently anonymized identifier for the account number for the account used by such host to receive payments from such booking service or, if such booking service provides an explanation why such anonymized identifies are unavailable, the account name and account number of such account.

The ordinance also requires Airbnb to “obtain, from each host using such booking service to offer, manage or administer a short-term rental, lawful consent to provide the information described in subdivision a to the administering agency.” Penalties include at least $1,500 for each underreported listing. During the PI hearing, the city made some concessions about damages, but it still left open the possibility that Airbnb would have been exposed to $360M in fines based on 2015 activity.

The court grants a preliminary injunction against the ordinance on Fourth Amendment grounds.

Does the Fourth Amendment Apply?

As a threshold matter, the court says “the compelled production from home-sharing platforms of user records is an event that implicates the Fourth Amendment.”

The city argued that Airbnb has no privacy interests in its users’ data. The court responds:

a home-sharing platform has at least two very good reasons to keep host and guest information private, whether as to these users’ identities, contact information, usage patterns, and payment practices. One is competitive: Keeping such data confidential keeps such information from rivals (whether competing platforms or hotels) who might exploit it. The other involves customer relations: Keeping such data private assuredly promotes better relations with, and retention of, a platform’s users…. this Court holds that platforms have privacy interests in their user-related records that “are more than sufficient to trigger Fourth Amendment protection.”

In a footnote, the court adds: “some data the Ordinance seeks from “booking services” appears to originate with these services themselves. For instance, the Ordinance requires these services to disclose “[t]he total amount of fees received by such booking service” per rental. This reinforces that the Ordinance implicates cognizable Fourth Amendment interests of the platforms.”

The court says it doesn’t matter that Airbnb’s TOS tells users that it may turn over data to regulators. The court interprets that clause as a waiver of users’ Fourth Amendment claims against Airbnb. Also, the fact that Airbnb turned over records to the city in response to past subpoenas doesn’t waive future Fourth Amendment arguments.

The Ordinance May Violate the Fourth Amendment

Having concluded that the Fourth Amendment applies to the ordinance, the court weighs its reasonableness.

On the plus side, the ordinance “does not entail the on-site presence of state officers or any physical entry into the quarters of the booking services subject to it.” Also, the ordinance does not give the city “discretion as to the information that the booking service is required to produce. Instead, the Ordinance prescribes that data, with commendable precision.”

On the minus side:

the scale of the production that the Ordinance compels each booking service to make is breathtaking. Each month, the Ordinance appropriates from every participant in the burgeoning home-sharing industry what is effectively a wholesale replica of that booking service’s database as to New York City users. The information called for appears to capture virtually all monthly information the service receives from each user. Had it been in effect in 2016, the Ordinance thus would have compelled Airbnb to produce user data as to each of the more than 700,000 bookings executed that year over Airbnb’s platform. The Ordinance does not have a temporal sunset….

the Ordinance is the antithesis of a targeted administrative subpoena for business records…

the Ordinance is devoid of any tailoring. On the contrary, it appears to be the functional equivalent of a legislative edict mandating that OSE issue an identical subpoena to every covered booking service operating in New York City, every month starting in February 2019 and extending into perpetuity, calling for production of the prescribed data as to all New York City users. In contrast to a tailored subpoena, the Ordinance applies across-the-board to all short-term listings in New York City. It does so regardless whether there is any factual basis whatsoever to suspect that any particular listing, or user, or building, or complex, at issue is in violation of the Multiple Dwelling Laws.

The city argued that the data dump would improve the efficiency of its law enforcement efforts. The court says the city has been able to tender 15 subpoenas to Airbnb and HomeAway without the data, so it’s demonstrated that such efforts are possible and a massive workaround isn’t needed. Furthermore, the data dump would eliminate the possibility of challenging the “search” in court before disclosure.

The court recognizes the obvious policy problems of allowing NYC to grab data in this fashion:

An attempt by a municipality in an era before electronic data storage to compel an entire industry monthly to copy and produce its records as to all local customers would have been unthinkable under the Fourth Amendment. It would have been out of bounds on the grounds of excessive burden alone. The more ready ability of a modern company whose business is accomplished through cyber communications to comply with such a demand lessens the burden objection. But this should not obscure the extent to which the Ordinance departs from Fourth Amendment standards. A ruling upholding the Ordinance as reasonable would invite municipalities to make similar demands on e-commerce companies, whether by legislation or subpoena, for the routinized production to investigative agencies of broad-ranging records as to all users or customers. It would invite such productions so as to permit regulators to troll these records for potential violations of law, even as to customers as to which there had been no basis theretofore to suspect any violation of law.

Existing Fourth Amendment law does not afford a charter for such a wholesale regulatory appropriation of a company’s user database. And the implications of upholding the Ordinance give pause, as just a few hypotheticals illustrate. By the City’s logic, a City Council presumably could also compel (1) all online auction services monthly to produce all records of sales by New York City residents, on the premise that such records could assist in finding sellers who evade capital gain taxes on sales of collectibles; (2) all medical providers monthly to produce all patient records for care rendered in New York City, on the premise that such records could assist in finding instances in which users engaged in up-coding and other health-care fraud; and (3) all credit card companies monthly to produce all records of expenditures in New York restaurants, on the premise that such records could assist in identifying instances in which commercial income was not reported to tax authorities. Although the Court does not resolve hypotheticals, these scenarios, and many others that the Ordinance readily conjures, underscore the potential far-reaching implications of the City’s position.

Implications

This case reminds me a lot of the Backpage v. McKenna ruling from 2012. In that case, Washington passed a law requiring online services to verify that a person depicted in third party ads was over 18. While that sounds reasonable in the abstract, imposing these kinds of verification obligations on third party content subverts Section 230, by effectively making the online services responsible for third party content. Had that law succeeded, regulators could have come up with an infinite number of ways to create and impose verification obligations for third party content, in the process destroying Section 230. Fortunately, the McKenna court recognized that risk. Similarly, NYC’s trick would be infinitely replicated by other regulators for a wide variety of legal obligations, eventually giving every government agency the unrestricted right to loot every business’s customer records as a prophylactic to find illegal activity. This would turn the Fourth Amendment on its head, allowing searches when the government has no basis to believe there was any legal violation.

This is a savvy but tremendously broad ruling. As a result, I’m reluctant to celebrate it too much until we see how it fares on appeal if the city chooses to go that route.

Case citation: Airbnb v. City of New York, 1:18-cv-07712-PAE (S.D.N.Y. Jan. 3, 2019)