Its a bit grayer than that. In this case generally it is option 1 (transaction contract when the key is originally given or sold). But then a third party comes in and makes a marketplace out of people breaking their contract and how you deal with THAT.

Its basically the Airbnb scenario.