Decoys

Enforcement and evidence

Salt Lake City could not tell which of its short-term rentals were operating legally. So its civil enforcement team contacted hosts through accounts that misrepresented who they were, and used what the hosts said back as evidence. In August, Airbnb sent the city a cease and desist.

What the ordinance actually does

Salt Lake City’s short-term rental rules took effect July 1, 2026. They are not a light touch. Rentals require a business license, are confined to commercial and mixed-use districts, and are prohibited in residential zones outright.

How the city built its case

Enforcement staff, or third parties working for the city, contacted hosts through guest accounts that did not represent who they actually were. The responses became evidence of ordinance violations. The city has confirmed it uses several methods to investigate suspected violations, including contacting people who advertise properties, and has said it will continue acting against illegal rentals.

Airbnb’s cease and desist objects to the method rather than the rules. It argues the practice breaches the platform’s terms of service, and raises a second question under a 2025 Utah law that lets cities use short-term rental listing evidence only when it is paired with additional information demonstrating a violation. Whether a decoy conversation counts as that additional information, or is itself the thing the statute limits, has not been tested.

So far the city says it has cited only owners operating in prohibited residential zones, and has not moved against eligible operators who simply have not applied yet.

Two institutions are fighting over a list, and the only party with real exposure is not in the room.

What this is really measuring

Strip out the legal argument and what is left is a familiar shape. A city could not identify the operators inside its own lodging supply through any legitimate channel, so it built an identification method out of pretending to be a customer. A platform that holds the actual list responded by defending its terms of service. Neither party proposed sharing anything.

The host is the one with money at stake, and the host had no seat. Some of the people contacted were operating illegally. Some were almost certainly operating legally and answered a stranger’s question. None of them were ever onboarded, told the rules in plain language, or given a way to comply before they were investigated.

And the destination organization, the one entity in a market whose whole job is holding relationships with the businesses that serve visitors, was not part of any of it. That is the Host Gap in its enforcement form. When nobody builds the relationship, someone eventually builds a workaround, and the workaround is what ends up in a lawyer’s letter.

The practical lesson is narrower and more useful. Identification built on relationship is durable. Identification built on subterfuge is litigable. One cease and desist and an entire evidence chain is in dispute, along with every citation that rests on it.

What a destination should do with this

1. Ask your city how it knows. If your municipality is enforcing short-term rental rules, someone is gathering evidence. Find out how. You may be the only person in the building who thinks to ask.
2. Audit the vendor, not just the dashboard. Compliance monitoring software is bought on results and rarely on method. Ask your provider, in writing, how listings are matched to addresses and whether anyone contacts hosts under an assumed identity.
3. Check your evidentiary standard before you need it. Utah’s 2025 law is not unusual. Several states now limit what listing-site evidence can support on its own. Know what yours requires before a citation is challenged.
4. Build the list the legitimate way. A registration path hosts can actually find, an onboarding that explains the rules before it enforces them, and a reason to be known. It is slower than a decoy account and it survives contact with a lawyer.

One open question

If you need the room

We work on host identification for destinations that need to know who is operating in their market and want to get there without a decoy account. Start a conversation if enforcement is arriving in your market before the relationship did.