Ask most STR hosts what could go seriously wrong with their property, and you'll get a familiar list. A guest gets hurt. A pipe bursts. A party gets out of hand. A hurricane comes through. These are real risks, and they deserve the attention they get.
But a case working its way through federal court right now points to a different category of exposure entirely. One that involves no injury, no claim, no damage, and no failure at the property itself. And the financial consequences rival the worst liability scenarios we analyze.
What Happened in Honolulu
Sandra May is 83 years old. She has lived in the same house in Honolulu since 1968 and rents out a one-bedroom unit to supplement her Social Security income. On Oahu, short-term rentals (stays under 30 days) are illegal outside resort-zoned areas, and since 2019 even advertising one carries fines that can reach $10,000 per day.
According to her lawsuit, May understood the rules. She set her listing to require a minimum stay of 30 days. That should have been the end of it.
It wasn't. Her listing apparently showed availability for stays shorter than 30 days anyway. When she contacted the platform, they told her the short-stay availability was an internal error on their side, and confirmed she had configured the 30-day minimum months earlier. The error wasn't something she caused. It was something that happened to her listing, inside a system she didn't control.
The city's enforcement system flagged the listing regardless. And then the timing turned a problem into a catastrophe. In 2024, a serious car accident put May in and out of the hospital. A violation notice arrived by mail during that period. She lives alone. No one else checks her mail. She didn't see the notice for nearly two months.
At $10,000 per day, two months of unread mail is the difference between a manageable fine and a life-altering one. The total reached roughly $600,000. The city filed a lien against her home. She is now in federal court arguing the fine is unconstitutionally excessive relative to an accidental advertisement.
Why This Isn't Really a Hawaii Story
It would be easy to file this under "extreme local regulation" and move on. We think that misses the point.
Honolulu's enforcement program uses a computer monitoring service that sweeps dozens of websites looking for noncompliant listings. The system identifies violations, generates notices, and fines accrue daily until the issue is resolved. City officials have publicly stated they intend to collect close to the full value of fines rather than settling for small percentages, as was common in earlier years.
Strip away the specifics and you have a structural pattern that is spreading across STR markets nationwide: automated detection, daily-accruing penalties, paper-based notice, and limited consideration of intent or proportionality. Honolulu happens to be further along this curve than most jurisdictions. It will not stay unusual for long.
When you put that enforcement model next to the way listings actually work, the exposure becomes clear. Your listing lives on a platform's servers. Its settings are subject to that platform's software, its syncing logic, its updates, and its bugs. You can configure everything correctly and still have your public-facing listing display something different. In May's case, the platform itself confirmed exactly that.
So the question every host should sit with is this: if a regulator's automated system reads your listing tomorrow, does what it sees match what you think you've configured? And how would you know?
The Risk Layer Taking Shape
We'd describe what this case illustrates as an emerging operational risk layer, separate from the property-level risks hosts already plan for. It has several components worth naming individually.
Platform dependency risk. Your regulatory compliance is partially executed by software you don't control. Minimum-stay settings, registration numbers displayed on listings, calendar syncing, channel managers pushing data between systems. Any of these can fail silently, and the regulatory consequence lands on you, not the platform. There is no meaningful legal framework today that shifts liability to a platform for a listing error, even one they admit causing.
Automated enforcement risk. Enforcement is increasingly done by monitoring software, not inspectors. Software doesn't distinguish between a deliberate illegal operator and a configuration error. It reads what's displayed and generates a violation. The human review, if it comes, happens after the fines have started accruing.
Administrative exposure. May's fines grew tenfold not because of what she did, but because of how she received notice. Physical mail, a hospitalization, no backup. Most enforcement regimes still run on paper notices with short response windows. A vacation, a hospital stay, or a wrong address on file can convert a correctable issue into a six-figure one.
Documentation gaps. May was fortunate that the platform verbally confirmed the error and her original settings. Verbal confirmation is thin evidence in a legal fight. Most hosts have no contemporaneous record of how their listings were configured on any given date, which means no way to prove a discrepancy wasn't theirs.
Where Insurance Fits, and Where It Doesn't
This is the part of the analysis that matters most for our readers, so we'll be direct: insurance generally does not cover this.
Regulatory fines and civil penalties are excluded from virtually every property and liability policy on the market, and in many states they're considered uninsurable as a matter of public policy. There is no endorsement you can buy that would have paid Sandra May's $600,000. A good STR policy protects you from guest injuries, property damage, and liability claims. It does not protect you from your local government's enforcement apparatus.
That distinction is exactly why this risk deserves separate attention. Risks you can transfer through insurance get managed at renewal time. Risks you can't transfer have to be managed operationally, through systems and habits. This one falls entirely in the second category.
What Managing This Risk Actually Looks Like
The practical response here is not dramatic. It's a handful of operational habits that cost little and create real protection.
Verify your listings from the outside. Once a month, view your own listings the way a guest (or an enforcement bot) would. Attempt to select dates shorter than your minimum stay. Confirm your registration or permit number displays where your jurisdiction requires it. Don't trust your dashboard settings; trust what's publicly visible.
Document your configuration. Take dated screenshots of your minimum-stay settings, registration fields, and calendar rules whenever you change them, and on a periodic schedule even when you don't. If a platform error ever creates a discrepancy, a timestamped record of your settings is the difference between a strong defense and your word against an automated report.
Close the notice gap. Know exactly how your city and county deliver violation notices, and make sure that channel is monitored even when you're not available. That might mean a second person checking mail, a mail-forwarding service, or simply confirming the contact information your jurisdiction has on file. May's case turned on two months of unread mail. That's a solvable problem.
Get anything a platform tells you in writing. If a platform representative ever acknowledges an error, ask for email confirmation before the call ends. Verbal assurances from support staff have a way of becoming unavailable when you need them.
Know your local fine structure before you need to. If you can't say what your jurisdiction charges per day for an advertising violation, that's worth twenty minutes of research this week. The number shapes how fast you need to be able to respond, and how much a notice gap could cost you.
The Larger Pattern
We expect to see more cases like this, not fewer. Enforcement budgets are growing, monitoring software is getting cheaper, and the political pressure around housing in tourist markets is not going away. Permitting disputes, registration lapses, platform synchronization failures, and automated violations are becoming part of the operational risk picture for STR hosts in regulated markets, alongside the guest-injury and property-damage risks the industry already understands.
The hosts who navigate this well won't be the ones with the strongest opinions about whether the regulations are fair. They'll be the ones who treated regulatory exposure as an operational system to manage: verified listings, documented settings, monitored notice channels, and a clear picture of which risks insurance covers and which ones it never will.
That picture is worth building before a notice arrives, not after.
If you're not sure where your own exposure sits, take 5 minutes to check your coverage gaps with our free risk score. It won't assess your regulatory compliance, but it will show you whether the risks insurance can cover are actually covered.
The STR Risk Report is produced by Threshold STR, a professional audit and placement service for short-term rental hosts. We help hosts understand their coverage gaps and find proper protection before an incident occurs. Details of the Honolulu case described above are drawn from the publicly filed lawsuit and news reporting as of June 2026; the litigation is ongoing.