11JUL

EU short-let rule lands with split enforcement

4 min read

10:19UTC

EU Regulation 2024/1028 reaches full application on 20 May with five Mediterranean members enforcement-ready and Germany and the Netherlands still building their national portals.

← Back to Spain's rent decree stalls on coalition rift Jump to analysis ↓

SocietyDeveloping

Key takeaway

The 20 May deadline arrives unevenly: Mediterranean enforcement begins on schedule, northern compliance lags by infrastructure rather than will.

EU Regulation 2024/1028 reaches full application on Wednesday 20 May 2026, requiring every short-term rental (STR) platform to transmit monthly listing data into a national Single Digital Entry Point (SDEP) for forwarding to municipal authorities. Each transmission carries the property address, the host registration number, the listing web address, the nights rented and the guests per night. Five Mediterranean members operate live SDEPs on the deadline: Spain, France, Italy, Greece and Portugal. Germany has not transposed the underlying rules at federal level; the Netherlands left its portal mid-build despite an eighteen-month transposition runway. ¹ ²

Madrid's earlier Airbnb enforcement sets the template the new architecture inherits. Spain's Royal Decree 1312/2024 has been in force since 2 July 2025, which is what allowed the Spanish Ministry of Consumer Affairs to land its €64 million fine on the platform under listing-accuracy law rather than a cross-border digital-service argument. The same Mediterranean coalition that built domestic registration frameworks a decade before Brussels caught up is now the only group able to operate the SDEP from day one. Spain's €7bn Plan Estatal de Vivienda 2026-2030 explicitly names the regulation as the demand-side companion to its supply-side spend, locking the Madrid model into a multi-year housing strategy.

What 20 May activates is data plumbing rather than new doctrine. Once SDEPs run, every member state can see for the first time which platform listings sit inside which postcode and whether they hold a registration number. In jurisdictions whose national listings data is already centralised, enforcement begins; where the portal does not yet exist, listings continue to operate inside a vacuum no member state can close in twelve days. Berlin and Amsterdam sit inside that vacuum on 20 May, with no federal SDEP behind either listing. The platforms write their compliance playbook to the Mediterranean specification because that is the only specification with live infrastructure to write against. ³

The European Commission has not formally rated readiness, and the Code Red / Code Green classification rests on industry analysis. The factual claim the evidence supports is narrower: the rules arrive with an enforcement geometry that does not match their political geometry. The first Commission compliance report after 20 May will tell the reader whether Brussels treats the northern gap as transition or as breach.

Deep Analysis

In plain English

From 20 May 2026, EU rules require Airbnb, Booking.com and similar platforms to send monthly data about every rental listing to a national government portal in each EU country. The data includes the property address, how many nights it was rented, and the registration number the host is supposed to have. Five countries (Spain, France, Italy, Greece and Portugal) have built the portals and are ready to receive the data. Germany and the Netherlands have not finished their portals yet, so platforms cannot transmit there even if they want to. In practical terms: if you are renting your flat in Berlin on Airbnb, the German government cannot yet see that listing in the new system. If you are renting in Madrid, it can. The two cities are in the same EU regulation, but living in different enforcement realities on 20 May.

Deep Analysis

Root Causes

The Germany-Netherlands gap traces to two independent structural conditions, not regulatory will.

Germany's federal constitutional structure (Bundesstaatsprinzip) puts housing and urban-planning law at Länder level. The federal government cannot simply mandate a national SDEP without a new federal competence framework. The eighteen-month transposition window was not long enough for the Bundestag to resolve the federal-state legal architecture and deliver a portal.

The Netherlands ran into a procurement and data-architecture dispute between its Ministry of Economic Affairs and the Association of Netherlands Municipalities (VNG) over who would own and operate the portal data.

The VNG position, that municipal authorities should hold the primary data relationship with platforms rather than a national intermediary, was unresolved when the transposition deadline passed. Neither gap is a political choice to ignore the regulation; both are structural blockages that Brussels did not anticipate when setting the transposition timeline.

What could happen next?

Risk
Platforms may selectively prioritise Mediterranean SDEP compliance and treat Germany and the Netherlands as a low-risk transition zone, creating a permanent two-speed STR market unless the Commission moves to infringement proceedings.
Medium term · 0.72
Precedent
Spain's €64 million fine surviving court challenge sets the damages floor for EU STR enforcement and will be cited by enforcement authorities in France, Italy and Greece when their own platforms miss data-transmission obligations.
Short term · 0.81
Opportunity
Regulatory arbitrage between compliant and non-compliant markets creates short-term pricing advantage for Berlin and Amsterdam STR hosts, who face no registration-number requirement while Mediterranean hosts do.
Immediate · 0.68

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The enforcement geography of GDPR after its May 2018 application date maps almost exactly. Ireland's Data Protection Commission (DPC) became the de facto lead regulator for most large tech platforms because Dublin was their EU seat of business; northern member states complained that DPC enforcement was structurally slower than southern regulators.

The same structural tension, a shared regulatory floor applied to different domestic data-state capacities, produced the same two-speed outcome. By 2022 the European Data Protection Board had introduced co-determination mechanisms to compensate, and by 2025 DPC enforcement velocity had broadly converged.

Counter-parallel: GDPR matured into convergent enforcement because the Commission used infringement proceedings as the lever after 2021. EU Regulation 2024/1028 is younger, narrower in scope, and has no equivalent prior enforcement cycle to model against. GDPR convergence took four years and two Board interventions; the STR Regulation has had none yet.

Spain's €64 million Airbnb fine is the single largest STR enforcement action recorded in the EU and the first to survive an attempt to suspend enforcement pending appeal. Its survival at the High Court of Justice of Madrid on 23 March 2026 established that the fine amount is not disproportionate under Spanish administrative law, which is the precedent other member-state courts will now read.

Platforms write their compliance playbook to the Mediterranean specification because Spain, France, Italy, Greece and Portugal have live SDEPs, and those are the only SDEPs available to write against. In Germany and the Netherlands, platforms face no transmission obligation on 20 May because there is no portal to transmit to.

That asymmetry lets Berlin and Amsterdam listings continue to operate without the registration-number verification requirement that Mediterranean listings will carry. Short-stay yield differentials between compliant southern markets and non-compliant northern ones will be visible in Q3 2026 booking data.

Consensus view: Researchers at Bruegel and the Centre for European Policy Studies (CEPS) argue that enforcement asymmetry in EU digital-market regulation tracks one structural variable: whether a member state had already built domestic registration infrastructure before the Brussels deadline arrived. Spain's Royal Decree 1312/2024 gave it a three-year head start; Germany's federal system left Länder-level STR rules with no federal portal to aggregate into.

Counter-view: Airbnb and Booking.com's legal teams contend that GDPR (General Data Protection Regulation) constraints complicate SDEP (Single Digital Entry Point) transmission architecture in jurisdictions where data-protection authorities take a narrower view of legitimate interest. Germany's Federal Data Protection Commissioner flagged this concern in 2024; the platforms cite it as a procedural, not a political, obstacle.

Key tension: Whether the Commission's first compliance report, expected by late 2026, frames Germany and the Netherlands as member states in technical transition or as member states in breach determines whether the split enforcement geometry calcifies into a two-speed STR market across the EU.

First Reported In

Update #3 · Twelve days to a split STR framework

EUR-Lex· 8 May 2026

Read original →

Causes and effects

Caused by

Madrid court lets €64m Airbnb fine stand

Madrid court upholding €64m Airbnb fine demonstrated enforcement capability ahead of 20 May EU Regulation 2024/1028 full application deadline

Occurred 23 Mar 2026

Read story →

Spain commits EUR 7bn to housing plan

Spain's €7bn Plan Estatal de Vivienda explicitly names EU Regulation 2024/1028 as demand-side companion, linking supply-side housing spend to SDEP enforcement

Occurred 22 Apr 2026

Read story →

This Event

EU short-let rule lands with split enforcement

The bloc's first cross-border short-term rental data framework arrives with an enforcement geometry that does not match its political geometry, fixing platform compliance on a Mediterranean specification.

Led to

EU STR regulation goes live; Brussels silent

Update #3's pre-deadline coverage of the two-speed SDEP readiness directly escalates into the day-of reality of Commission silence and Airbnb defining compliance.

Occurred 20 May 2026

Read story →

Jørgensen plan queues Q4 STR caps as phase two

EU Regulation 2024/1028 reaching full application is the direct regulatory trigger for the Affordable Housing Plan's Q4 2026 second-phase STR proposal.

Occurred 16 Dec 2025

Read story →

Spain's top court voids STR registry

EU Regulation 2024/1028 reached full application one day before STS 620/2026; Spain now enforces the regulation through 17 autonomous-community registries with no central layer.

Occurred 21 May 2026

Read story →

Different Perspectives

Medellin's Secretariat of Tourism and Entertainment

Medellin issued consolidated operating guidance on 21 August listing every permission a legal short-let home needs, from National Tourism Registry entry to fire-safety certification. The guidance clarifies existing rules rather than adding new restrictions, the opposite move to Mexico City's deadline slip.

Bali's provincial government

Governor Wayan Koster moved Bali's Rp150,000 foreign-visitor levy collection to airline check-in from late August, after on-island enforcement reached only 43% compliance on Rp235bn collected. The shift concedes that ground staff cannot capture visitors that departure counters can.

Oman's government

Oman created a free 14-day tourist visa in Official Gazette 1659, in force from 3 August, the month's only entry-side loosening. The visa converts into a paid category before expiry, betting on volume against a wider regional trend of tightening continued presence.

Kenya's Ministry of Health

Kenya's health ministry set the US$50,000 floor in Gazette Notice 11492 to stop uninsured foreign visitors reaching hospitals without cover, protecting a domestic health budget rather than screening who may enter. The notice reports separate transport and treatment sub-limits within that figure.

Occupants of expired tourist-let contracts

The population France's ruling reaches is not squatters but renters whose booking simply outlasted the property owner's patience. The Conseil constitutionnel struck the criminal penalty attached to overstaying while leaving the fast administrative-expulsion route intact, so removal remains fast even where prosecution no longer is.

Georgia's Migration Department

The Migration Department gained sanction, search and fingerprinting powers under Order No. 104, aimed publicly at Labour Migration Law violations. Its own ministry has published no fine or inspection count since Law No. 1509 activated on 1 May, leaving its practical reach against Western remote workers unmeasured.