The European Commission is investigating Booking.com over fake listings, phishing attempts and unclearly labeled advertisements

Riana Gegiu

21 October 2026, 13:19

Foto: Shutterstock.com

Always see our news on Google

The European Commission has opened an official investigation to determine whether Booking.com is taking sufficient measures against fraudulent listings, phishing attempts and other risks to users, in accordance with the European Union’s Digital Services Act (DSA).

The investigation was launched following a preliminary examination and an analysis of the risk assessment reports submitted by the company for 2026 and the three preceding years. European authorities will verify whether the platform appropriately identifies, assesses and mitigates the systemic risks associated with its activities.

The Commission will examine listings for nonexistent properties, identity fraud and accommodation offers that do not comply with the rules. The investigation also targets phishing attempts exploiting booking and customer data shared with accommodation providers, as well as paid advertisements whose commercial nature is not clearly indicated.

Large online platforms must make additional efforts to combat illegal and harmful content. In the event of a DSA violation, they can be fined up to 6% of their total annual global turnover. Booking.com, part of the Booking Holdings group, said it is engaged in constructive dialogue with Brussels and that security, trust and the protection of personal data are priorities.

Context: The Commission has already monitored platforms’ compliance with DSA/DMA obligations and intensified its oversight

Previously, the European Commission discussed aspects related to the Digital Markets Act with Booking.com, and the platform changed, in the European Economic Area, the way it used prices displayed by hotels on other channels for the “Sponsored Benefit” program, eliminating this use so as not to disadvantage properties offering different rates outside Booking.com.

In the same regulatory climate, the Commission announced that it would designate ChatGPT and Roblox as “very large online platforms” under the DSA after they exceeded 45 million monthly users in the EU, which entails additional obligations (including transparency reporting and an annual fee), and stated that it had already opened more than 12 investigations into online platforms since the regulation entered into force, including for failure to comply with transparency obligations.