The European Commission has launched a formal investigation into Booking.com over concerns it has not “effectively mitigated risks” related to fraudulent listings and phishing scams.
The formal proceedings, conducted under the Digital Services Act (DSA), will also assess whether the platform breached the Act’s transparency rules by failing to clearly label as ads listings whose providers paid for a higher ranking in search results.
The Amsterdam-based operator connects travellers with more than 30 million accommodation options across the world and has processed about 6.5 billion bookings since 2010.
It has become particularly attractive to criminals, with concerns over bogus listings deployed to scam users. Earlier this year it emerged it had suffered a data breach, with “unauthorised parties” gaining access to customers’ details, prompting concerns over “reservation hijacking” whereby criminals target people they know have legitimate bookings.
READ MORE
The commission said its investigation would examine whether the platform “has properly identified and assessed the systemic risks linked to the dissemination of illegal content”.
It will focus on fake listings including non-existent properties, impersonation fraud and noncompliant accommodation offers that “may have negative effects on consumer protection”.
It will also assess whether the platform has put in place effective measures to mitigate risks, by removing fraudulent and non-compliant listings and it will investigate whether Booking.com has “diligently assessed and addressed the risks that phishing scams pose to consumers”.
In particular, the investigation will focus on risks related to the way reservation and guest data is shared with accommodation providers, and the design and functioning of Booking.com’s messaging service.
The commission will also examine whether the company has put in place sufficient safeguards to prevent data from being misused to carry out phishing and solicit fraudulent payments.
The last strand of the investigation will look into Booking.com’s compliance with the DSA’s advertising transparency obligations.
“Accommodation providers can make their listings more visible in Booking.com’s search results by paying a higher commission,” the commission noted. “Users should be able to clearly recognise that these ‘boosted listings’ are in fact advertisements.”
It said it would “also examine whether, for each advertisement shown on Booking.com, users can easily see who is behind it, who paid for it, why they are seeing it and how they can change the settings that determine which ads they see”.
Under the DSA, users are entitled to understand when, and on whose behalf, an ad is shown to them.
“Without this, they cannot tell whether a listing appears prominently because it matches their search or because the accommodation provider paid for that visibility,” the commission said.
If proven, the failures would constitute infringements of the DSA, which obliges “very large online platforms and search Engines to identify, analyse, assess and mitigate systemic risk” and requires them to ensure users can clearly identify advertisements and the information about them.
The commission said it would carry out the “in-depth investigation as a matter of priority” and the opening of formal proceedings empowered it to take further enforcement steps, such as interim measures and noncompliance decisions.
It is also empowered to accept commitments offered by Booking.com to remedy the matters subject to the proceedings.
It stressed that opening formal proceedings “does not prejudge any final outcome or decision, nor does it impact enforcement actions undertaken by other authorities under other regulatory frameworks”.
The commission’s decision follows a preliminary investigation that included an analysis of the risk assessment reports submitted by Booking.com in 2026 and the preceding three years, information published in its transparency reports, and the company’s replies to the commission’s formal requests for information.
In a statement, Booking.com said it is cooperating fully” with the European Commission and “engaging constructively on its questions under the Digital Services Act (DSA).
“Security, trust and the protection of personal information are top priorities at Booking.com. We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud and protect traveller’s and partners,” a spokesman said.
