On Wednesday, October 21, 2026, the European Commission opened an official investigation to verify whether Booking.com is fulfilling its obligations regarding user protection against fraud and advertising transparency. The investigation concerns listings for nonexistent or non-compliant properties, phishing attempts exploiting booking data, and offers displayed higher in search results in exchange for higher commissions. The procedure is being conducted under the Digital Services Act (DSA), without the European executive having established an infringement or imposed a fine.
In brief
The Commission is checking whether Booking.com identifies and removes fake listings sufficiently effectively, including offers for nonexistent properties and cases of impersonation. The investigation examines whether booking data and the messaging system can be exploited to send customers fraudulent payment requests. Offers that receive a better position in search results because owners pay a higher commission must be recognizable as advertising. The Commission may request additional documents, conduct interviews and inspections, or accept binding remedial commitments. Opening the proceedings does not establish that Booking.com has violated the law. For proven infringements committed intentionally or negligently, the fine may reach 6% of the provider’s total worldwide annual turnover in the preceding financial year. This is the legal maximum, not a penalty decided in the Booking.com case; no end date for the investigation has been announced.
The first component of the investigation concerns trust in accommodation offers. The Commission will verify whether Booking.com properly identified and assessed the systemic risks associated with illegal listings, including those for nonexistent properties, non-compliant offers, and fraud in which a person claims to represent a property they do not manage. The European authority will also examine the effectiveness of measures to reduce these risks, including the removal of problematic listings.
A second component concerns phishing messages, meaning attempts to obtain money or sensitive information through communications that appear legitimate. In the case of travel bookings, such a scam may take the form of a message apparently sent by the accommodation provider, asking the customer to confirm payment or access an external link. The Commission will examine the risks associated with how Booking.com shares booking and guest data with accommodation providers, as well as the design and operation of the messaging service. The investigation will determine whether sufficient safeguards exist against the abusive use of these data and channels for fraudulent payment requests.
The third aspect is how search results are ranked and labeled. Some accommodation providers may gain greater visibility by paying a higher commission, and users must be able to distinguish this commercial promotion from ranking based on other criteria. The Commission will verify whether promoted offers are clearly identified as advertising and whether the person on whose behalf the advertisement is displayed is indicated, as well as who paid for it when that is a different person. Users must have easy access to information about the main parameters determining the display of the advertisement and, where applicable, how they can modify them.
The obligations under investigation require very large online platforms to carefully assess systemic risks and adopt reasonable, proportionate, and effective measures to reduce them. These requirements are set out in Articles 34 and 35 of the DSA, while the identification and transparency of advertising are regulated by Article 26(1). Booking.com was designated a very large online platform on April 25, 2023, which entails additional risk-management obligations and Commission oversight.
The decision to open the proceedings follows a preliminary analysis of the risk assessments submitted by Booking.com in 2026 and the preceding three years, transparency reports, and responses to official requests for information dated September 23, 2025, and May 26, 2026. The Commission may continue gathering evidence through new data requests, interviews, and inspections. If there is urgency due to the risk of serious harm to users and a prima facie finding of an infringement, it may order interim measures. It may also make the remedial commitments proposed by the company binding through a separate decision.
Henna Virkkunen, Executive Vice-President of the Commission for Technological Sovereignty, Security and Democracy, stressed that Europeans must be able to book their holidays without fear of scams and that large platforms must assume the responsibilities provided for by the DSA. In a response sent to The Register, a Booking.com spokesperson stated that the company is fully cooperating with the Commission and that security, trust, and the protection of personal information are priorities. The company reaffirmed its commitment to working with authorities and industry partners to combat cybercrime and online fraud.
The Commission is cooperating with the Netherlands Authority for Consumers and Markets, the digital services coordinator in the country where Booking.com is established. For the alleged breach of advertising-transparency and conduct obligations covered by these proceedings, national authorities no longer exercise their own DSA supervisory and enforcement powers. The competent institutions may nevertheless continue to intervene under other legislative frameworks, while cooperation with the Dutch authority continues in the European investigation.
If it establishes an intentional or negligent infringement of DSA obligations, the Commission may impose a fine of up to 6% of the provider’s total worldwide annual turnover in the preceding financial year. The amount must take into account the nature, gravity, duration, and repetition of the infringement; the maximum does not represent a penalty proposed or imposed on Booking.com now. Before a non-compliance or fining decision, the company has the right to respond to the preliminary findings and the measures under consideration.
The Commission has not announced a date by which the investigation must conclude, and the outcome remains open. For travelers, the issue is the effectiveness of protection against fraudulent offers and deceptive payment requests, together with the ability to recognize when an offer’s position in search results reflects paid promotion.
Context: Before the DSA investigation, Booking.com had made changes related to mandatory price “parity”Prior to the Commission’s decision regarding the DSA investigation, Booking.com adjusted how the Sponsored Benefit program operates in the European Economic Area: following a dialogue with the European Commission concerning compliance with the Digital Markets Act, the platform no longer used the prices displayed by hotels on their own websites or on other platforms to determine eligibility. The change eliminated one of the exceptions in which external rates could influence participation in the program.
In the same context, Booking.com increased the transparency provided to hotels about Sponsored Benefit’s effects on bookings and changed how information from the Extranet concerning external prices is presented, indicating that these are for informational purposes and are not used for default ranking or for eligibility in commercial programs such as Genius, Preferred, and Preferred Plus.
