Brussels, 21 October 2026
On Wednesday, the EU Commission has opened formal proceedings to assess whether Booking.com may have breached the Digital Services Act (DSA) by not having diligently assessed or effectively mitigated risks related to fraudulent listings and phishing scams. The platform may also have breached the DSA when it comes to transparency because it did not clearly label as ads those listings whose providers paid for a higher ranking in search results shown to users.
The investigation will focus on the following areas:
1. Fraudulent and non-compliant listings on Booking.com
The Commission will examine whether the provider of Booking.com has properly identified and assessed the systemic risks linked to the dissemination of illegal content. Fake listings, such as for non-existent properties, impersonation fraud, and non-compliant accommodation offers may have negative effects on consumer protection.
The investigation will also assess whether the platform has put in place effective measures to mitigate these risks, including by removing fraudulent and non-compliant listings.
2. Phishing scams exploiting Booking.com’s reservation and guest data
The Commission will also investigate whether the provider of Booking.com has diligently assessed and addressed the risks that phishing scams pose to consumers.
In particular, the investigation will focus on risks related to the way reservation and guest data is shared with accommodation providers, and the design and functioning of Booking.com’s messaging service.
The Commission will also examine whether the company has put in place sufficient safeguards to prevent data from being misused to carry out phishing and solicit fraudulent payments.
3. Paid-for boosted listings not clearly identifiable as advertisements
The Commission will finally investigate whether Booking.com complies with the DSA’s advertising transparency obligations.
Accommodation providers can make their listings more visible in Booking.com’s search results by paying a higher commission. Users should be able to clearly recognise that these ‘boosted listings’ are in fact advertisements. The Commission will also examine whether, for each advertisement shown on Booking.com, users can easily see who is behind, who paid for it, why they are seeing it and how they can change the settings that determine which ads they see.
Under the DSA, users are entitled to understand when, and on whose behalf, an ad is shown to them. Without this, they cannot tell whether a listing appears prominently because it matches their search or because the accommodation provider paid for that visibility.
If proven, these failures would constitute infringements of Articles 34 and 35 of the DSA, which oblige Very Large Online Platforms and Search Engines to identify, analyse, assess, and mitigate systemic risks; and of Article 26(1), which requires providers of online platforms to ensure that users can clearly identify advertisements and the information about them.
Next steps
The Commission will carry out an in-depth investigation as a matter of priority, continuing to gather evidence, for example by sending additional requests for information, conducting interviews or inspections.
The opening of formal proceedings also empowers the Commission to take further enforcement steps, such as interim measures and non-compliance decisions. The Commission is also empowered to accept commitments offered by Booking.com to remedy the matters subject to the proceedings.
Opening formal proceedings does not prejudge any final outcome or decision, nor does it impact enforcement actions undertaken by other authorities under other regulatory frameworks.
The opening of formal proceedings relieves Digital Services Coordinators, or any other competent authority of EU Member States of their powers to supervise and enforce the DSA in relation to the suspected infringement of Article 26(1) as regards the conduct covered by the proceedings.
Background
The Commission’s decision follows a preliminary investigation, which included an analysis of the risk assessment reports submitted by Booking.com in 2026 and the preceding three years, information published in its transparency reports, and the company’s replies to the Commission’s formal requests for information sent on 23 September 2025 and 26 May 2026. The Commission cooperates with the Dutch Authority for Consumers and Markets, the Digital Services Coordinator of the Member State where Booking.com is established, in the supervision of Booking.com under the Digital Services Act.
Booking.com was designated as Very Large Online Platform under the EU’s Digital Services Act on 25 April 2023.
For more information
Quote(s)
Europeans should be able to book their holidays without fear of being scammed. The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously.
Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy
Source – EU Commission