Permissions: Hide guest names to comply with GDPR

I upvoted as this is annoying. I think hostaway does the same and maybe shares more. We have a condo in a community where we need to post our calendar to a shared calendar for ops. Hostaway customers show the same or more. I ended up: using my bookings data sheet (populated by webhook and wrote a google script to create a custom ics. Here is what chatgpt has to say about it. Fuzzy in the US but certainly risk.

-----------------

In the U.S., sharing personally identifiable information (PII) from short-term rental guests—such as names, emails, phone numbers, or other booking details—with third parties (e.g. cleaners, contractors) via an open or publicly accessible format like an .ics calendar can raise significant privacy and legal concerns, but the specifics depend on several factors:

Legal Considerations (U.S. context)

1. No Nationwide GDPR Equivalent

The U.S. does not have a single federal law like the GDPR in Europe.

However, some states (notably California, Colorado, Virginia, Connecticut, and Utah) have passed comprehensive privacy laws that restrict how consumer data is shared, especially when it’s linked to identifiable individuals.

2. California (CCPA / CPRA)

If you're renting to California residents (or operate out of CA and meet thresholds), the California Consumer Privacy Act (CCPA) and CPRA amendments apply.

This includes provisions requiring businesses to:

Disclose how personal information is shared.

Allow users to opt out of such sharing.

Securely handle PII—which could be considered violated if guest names are openly shared in third-party calendars without consent.

3. Third-Party Sharing Liability

Under U.S. common law and various state statutes, there can be liability for negligence if a business:

Fails to adequately protect consumer data, and

That data is then misused or causes harm (e.g., stalking, harassment, reputational harm).

If your .ics calendar (containing guest names) is accessed without proper safeguards or shared via public URL, this may expose you to liability under these frameworks.

4. Contractual and Platform Terms

Airbnb, VRBO, and other platforms prohibit the unauthorized sharing of guest data.

Hospitable’s Terms of Service may also shift liability onto you if you share data using its tools in a way that causes harm or violates privacy expectations.

Best Practices (Regardless of Legal Jurisdiction)

Never share guest names via public .ics links.

Use scripts (like the one we created) that strip PII and only include anonymized booking data for calendars accessible to cleaners, owners, etc.

Use unique calendar links with passwords or token-based access if you must share booking data externally.

Include privacy notices in your short-term rental terms or welcome materials explaining who sees what information and why.

Summary

U.S. law does not currently make this universally illegal, but:

State privacy laws, platform terms, and common law liability all create serious risk.

You are on much safer legal ground using the approach we took: custom .ics feeds without PII.