Airbnb already verifies every booking guest, and DAC7, France's registration number, Italy's CIN and New York's Local Law 18 verify the host, not the guest. This guide explains when to check guests yourself, how a document and selfie check works, what Nowistay's Stripe Identity check shows you for EUR 2 per completed check, what Airbnb, Booking.com and Vrbo allow for security deposits, and how long to keep ID data under GDPR.
Sign up free. Send each guest a document and selfie check through Stripe Identity, see the result on the booking, and hold check-in instructions until the guest is verified. EUR 2 per completed check.
Start free trialThe reliable way to verify a guest is a photo of an ID document plus a matching selfie, checked by a dedicated identity provider, sent automatically after booking, with your access instructions held back until the check passes. Do not collect passport photos by email: they are hard to secure, hard to delete and prove little. On Airbnb, every booking guest is already identity verified by Airbnb, and you may ask for ID yourself only in limited cases, so most hosts focus their own checks on direct bookings and other channels.
This guide covers what the platforms already verify, which rules apply to you as a host, the risks a check reduces, the tools available, what Airbnb, Booking.com and Vrbo allow for security deposits, and how to keep ID data compliant with GDPR.
Most of the recent rules verify the host and the listing, not the guest. Checking guests remains a risk decision for most hosts, but identity is now a normal part of short-term renting.
According to Airbnb’s Help Center, every host, new co-host and booking guest must be identity verified to use the platform, and guests verify when they book. Airbnb may ask for a photo of a government ID and a selfie. It does not share the guest’s government ID with the host. A host may ask for a government ID after the reservation only if the listing description said what is required and why at the time of booking, and only where it is required for legal or compliance reasons.
DAC7 (Council Directive (EU) 2021/514, applied since 1 January 2023) requires platforms such as Airbnb, Booking.com and Vrbo to collect and report information on the hosts who rent through them: identity and tax details, the address of each listing, the amounts paid each quarter and, where available, the number of days rented. The threshold often quoted, fewer than 30 transactions and less than EUR 2,000 a year, only excludes sellers of goods. Hosts who rent out property are reported whatever their volume, except businesses with more than 2,000 rentals of the same listing in a year. DAC7 verifies you, not your guests.
France’s Loi Le Meur of 19 November 2024 extends registration to every furnished tourist rental. According to service-public.gouv.fr, the national online registration service is planned for the fourth quarter of 2026: until it opens, registration is mandatory only in the communes that require it, and once it opens it becomes mandatory everywhere. Italy requires a national identification code (CIN) to appear in every short-term rental listing. These numbers identify the property and its host; they do not require you to check your guests.
New York City’s Local Law 18 requires short-term rental hosts to register with the Mayor’s Office of Special Enforcement, which began enforcing it on 5 September 2023 and asks booking platforms to stop processing transactions that are not verified against the city’s system. Cities such as San Francisco and Los Angeles also run host registration. Here again, the check is on the host.
For guests, the change is practical: on direct bookings and on channels where you see little about the guest, the risk sits with you, and an inbox full of passport photos is a compliance problem in itself.
The problems: ID scans kept in an inbox or a shared folder sit there indefinitely and sync to every device, which is hard to square with GDPR’s data minimization and storage limitation principles. The eyeball check catches obvious fakes, not good ones. There is no record of the decision tied to the booking. And the back and forth annoys legitimate guests, especially those Airbnb already verified.
Airbnb verifies every booking guest itself, as described above, but you never see the document, and the check does not carry over to a direct booking with the same guest.
The default and the weakest option: free and simple, but no audit trail and a compliance liability.
Stripe Identity, Persona, Onfido and Veriff specialize in document verification and selfie matching, and some add watchlist screening. You get a verified or not result while the images stay with the provider rather than in your inbox. A good fit for hosts who take direct bookings, as long as the check is wired into the booking flow.
Some PMS embed a provider directly: the verification link goes out with your guest messages, the result is stored against the booking, and you do not manage the workflow by hand. The checks are either included or billed per check.
Specialist guest-screening services bundle identity checks with damage waivers or deposit protection, usually billed per booking and sometimes passed on to the guest.
Some hosts treat smart-lock entry events as identity proof: the guest who knew the code entered the property. Useful as a complement, not a replacement: it proves access, not identity.
Nowistay runs guest identity checks through Stripe Identity. You connect your Stripe account in Integrations, then turn on Identity Screening for the properties you choose in Automations. Each completed check costs EUR 2, billed on a monthly invoice separate from your subscription; if a guest never completes the check, there is no charge.
Add the {{identity_check_link}} variable to a guest message template, typically the one sent when the booking is confirmed. When the message goes out, the variable becomes a unique link for that booking. The guest photographs an ID document and takes a selfie, and Stripe checks that the document is genuine and that the selfie matches it. Nowistay then compares the name on the document with the name on the booking, allowing for several first names and compound surnames.
If the check passes and the names match, the guest automatically receives a short confirmation on the booking’s own channel, whether that is Airbnb, Booking.com, WhatsApp or email. If the check fails, the guest receives a message with the link to try again and you are alerted. A name mismatch alerts you too, so you can look at it yourself.
Each booking shows an Identity verification status: Verified, Name mismatch, Failed, Pending, Expired or Not started. View verification opens the result: the verified name and the name match, the document type, issuing country and expiration date, the date of birth, the ID number masked to its last four characters, and the Document scans and Selfie check through short-lived links. The Screening History lists every check across your properties with its status and match score.
Three actions sit next to the status. Copy link lets you resend the verification link on any channel. Restart verification starts a fresh attempt after a failed check or a name mismatch. Mark as verified is the manual override: it bypasses the automated check, so use it only when you have confirmed the guest’s identity another way, for example in person at check-in. The guest is then told their identity is verified, and the booking shows it was verified manually, without a Stripe result.
The gate is on the message, not on the lock. In your check-in instructions template, add a booking info condition: Identity Verification, Equals, Verified. The message, and the door code it contains, then goes only to verified guests and waits for the others until they complete their check. Decide your rule on paper first, for example: direct bookings must pass before the access code goes out, and any name mismatch comes to you for a human look rather than an automatic refusal.
To enable identity verification in Nowistay, see the prerequisites and steps in this guide: How to enable guest identity verification.
Identity checks and deposits answer the same worry, damage, but each platform sets its own rules for deposits. Check them before you add a deposit request to a guest message.
Airbnb’s Help Center states that most hosts are not allowed to charge security deposits, either through the Resolution Center or outside the platform. The exceptions are some hosts, including select software-connected hosts, who must show the deposit in the right fee field of the listing, and hotels. For damage, hosts request reimbursement from the guest through the Resolution Center, backed by AirCover for Hosts (see how to recover damage costs after a bad stay).
According to the Booking.com Partner Hub, partners based outside the United States, Puerto Rico and the US Virgin Islands choose between two damage policy options. With a damage deposit, the guest pays you directly before the stay, you decide how and when to collect it, and you return it as agreed at booking; Booking.com warns that deposits tend to bring fewer bookings and more cancellations. With the damage program, the guest pays nothing upfront: you submit a damage payment request within 14 days of checkout, Booking.com contacts the guest, and you are paid only if the guest agrees to pay. Vacation rentals in those three US territories are covered by Host Property Insurance instead, which replaced the damage program on 10 November 2025, and can still set a damage deposit.
On Vrbo’s help page about damage protection, hosts set a damage security amount. Up to USD 5,000, Vrbo stores the guest’s payment details as a card on file; above that amount, it charges a refundable damage deposit at booking. You can deduct reasonable repair costs if you document and report the damage within 14 days of check-out. Guests can also buy Property Damage Protection, an optional insurance plan offered instead of a deposit, for example USD 59 for USD 1,500 of coverage.
On direct bookings, you set the terms. Nowistay’s Security Deposit automation works with your connected Stripe account and offers two collection methods: Save the card only, the default, where nothing is taken and you charge the card only if you report damage, or Charge the deposit upfront, where the guest pays the full amount and is refunded automatically after checkout, minus anything you retain. The guest receives the link through the {{deposit_payment_link}} variable in a guest message, and you set how many days after checkout you can still claim, up to 28. From the booking, Charge deposit charges the saved card for damage up to the deposit amount, and Mark as paid covers a deposit collected another way. The Booking platforms setting limits the request to the channels you select, so you can keep it to direct bookings and stay within Airbnb’s rules. A booking info condition (Security deposit, Equals, Paid) holds your check-in instructions until the deposit is secured.
Step by step: How to set up security deposits. Before you require one, read why security deposits can cost you more than they protect.
GDPR applies to every ID check: collect only what you need, explain why in your privacy notice, and keep the data no longer than necessary, which is the storage limitation principle of Article 5(1)(e). The selfie match relies on biometric data, a special category under GDPR, and Stripe Identity asks the guest for consent before using it. On retention, the Stripe Identity FAQ states that biometric identifiers are removed from Stripe’s systems within one year, and that captured images and ID data stay in the business’s Stripe Dashboard for 7 years unless the business deletes them sooner. Set your own retention period, write it down, and delete any ID copies you hold elsewhere. For the wider checklist, see GDPR-safe handling of guest IDs and personal data.
UK GDPR applies the same principles: a clear purpose, minimal data and a defined retention period for any ID you check.
There is no federal requirement for short-term rental hosts to verify guests, and city rules such as Local Law 18 concern host registration. State privacy laws, such as California’s CCPA, can apply to the personal data you collect, so handle ID data with the same care.
Three failure modes and the right response:
Sign up free. Save the guest's card or charge the deposit upfront with Stripe, refunded automatically after checkout. EUR 12 per property per month, first month free.
Try Nowistay free
Over 25 years of experience in real estate investing and a recognized expert in short-term rental automation. Bassel helps property managers increase revenue, cut operating costs, and deliver 5-star guest experiences using AI-powered tools he built from firsthand hosting experience.
