European Commission Investigates Booking.com Over Suspected DSA Violations

Key Takeaways

• European Commission Opens Formal Investigation: Regulators are examining whether Booking.com breached the Digital Services Act through inadequate assessment and mitigation of fraudulent listings and phishing risks, as well as insufficient advertising transparency.
• Fraudulent Accommodation Listings Under Scrutiny: The Commission will assess whether Booking.com has properly identified systemic risks associated with fake properties, impersonation and non-compliant listings, and whether its mitigation measures are effective.
• Reservation Data and Messaging Raise Phishing Concerns: Investigators will examine whether the sharing of reservation and guest information with accommodation providers and the operation of Booking.com's messaging service create risks of fraudulent payment requests.
• Paid Search Rankings Face Transparency Review: The Commission is investigating whether accommodation providers that pay higher commissions for greater visibility are receiving advertising placements that consumers cannot clearly identify as paid promotions.
• Further Enforcement Action Remains Possible: The Commission may seek additional evidence, adopt interim measures, accept commitments or issue a non-compliance decision. No violation has been established, and the proceedings do not prejudge the outcome.

Deep Dive

The European Commission has opened a formal investigation into Booking.com over concerns that fraudulent accommodation listings, phishing scams and undisclosed paid promotions may be exposing travelers to risks the platform has failed to adequately address.

Announced on October 20, the proceedings will examine whether Booking.com breached the European Union's Digital Services Act (DSA) by failing to properly assess and mitigate systemic risks associated with its services. The Commission is also investigating whether accommodation providers that pay higher commissions to secure more prominent positions in search results are effectively purchasing advertising space without that arrangement being made sufficiently clear to consumers.

The investigation follows a preliminary review of several years of Booking.com's risk assessments, transparency reports and responses to regulatory inquiries. No infringement has been established, and the Commission's decision to open formal proceedings does not prejudge the outcome.

The Commission's first concern is whether Booking.com has done enough to identify and remove fraudulent or otherwise non-compliant accommodation listings. These include offers for properties that do not exist, listings involving impersonation and accommodation advertised in violation of applicable requirements.

Such listings can expose consumers to financial losses and other forms of harm. The Commission will examine whether Booking.com has properly assessed the systemic risks associated with illegal content appearing on its platform and whether its measures to address those risks, including the removal of fraudulent listings, are effective.

Articles 34 and 35 of the DSA require platforms designated as Very Large Online Platforms to identify, analyze and assess systemic risks arising from their services and adopt reasonable, proportionate and effective measures to mitigate them. The Commission's inquiry will therefore consider both the adequacy of Booking.com's assessments and the measures it has introduced in response. Identifying fraudulent activity is one part of that responsibility. Establishing safeguards capable of mitigating the associated risks is another.

Investigators are also examining the possibility that information exchanged during legitimate reservations could be exploited to deceive travelers.

Booking.com's services allow accommodation providers and guests to communicate about their reservations. The Commission is investigating whether the way reservation and guest data is shared with accommodation providers, together with the design and operation of the platform's messaging service, creates risks that have not been sufficiently addressed.

The concern is phishing. Fraudsters may seek to exploit reservation information or communications associated with a booking to impersonate legitimate parties and solicit fraudulent payments.

The Commission will assess whether Booking.com has diligently evaluated those risks and implemented sufficient safeguards to prevent information from being misused for such purposes.

Its announcement does not establish that a particular data breach occurred or identify a specific incident in which Booking.com's systems were compromised. The investigation concerns the risks associated with the platform's arrangements for sharing information and facilitating communications, and whether the company's response satisfies its obligations under the DSA.

When Higher Commissions Influence Search Results

The Commission's third area of investigation concerns the commercial arrangements that determine how prominently accommodation listings appear in Booking.com's search results. Accommodation providers can obtain greater visibility by paying higher commissions to the platform. Investigators will examine whether listings promoted through these arrangements are clearly identifiable as advertisements.

The concern is that travelers may be unable to determine whether a property appears prominently because it is relevant to their search or because the accommodation provider has paid for preferential placement.

Under Article 26(1) of the DSA, online platforms must ensure that users can clearly identify advertisements and readily obtain information about who is behind them, who paid for them and the principal parameters used to determine why they are shown.

The Commission will examine whether Booking.com meets those requirements, including whether users can understand why particular advertisements appear and how to change the settings that influence the advertising they see.

The investigation does not establish that offering greater visibility in exchange for higher commissions is itself unlawful. The suspected infringement concerns whether Booking.com adequately identifies these promoted placements as advertisements and provides the information required by European law.

For a platform whose search results influence accommodation choices, the presentation of paid placements is an important part of the consumer experience. A traveler comparing properties may see the same result regardless of whether its position reflects relevance, commercial promotion or a combination of ranking factors. The DSA requires advertising to be identifiable without leaving users to work out those commercial arrangements for themselves.

If substantiated, the Commission said the suspected failures would constitute infringements of Articles 34 and 35, governing systemic risk assessment and mitigation, and Article 26(1), governing advertising transparency.

Years of Regulatory Disclosures Under Review

The formal proceedings follow a preliminary investigation that included an examination of Booking.com's risk assessment reports submitted in 2026 and the preceding three years. The Commission also reviewed information published in the company's transparency reports and its responses to formal requests for information issued on September 23, 2025, and May 26, 2026.

Booking.com was designated a Very Large Online Platform under the DSA on April 25, 2023, bringing it within the legislation's enhanced obligations concerning systemic risks and their mitigation.

The Commission has worked with the Netherlands Authority for Consumers and Markets, the Digital Services Coordinator in the member state where Booking.com is established, in supervising the company's compliance with the legislation.

The opening of formal proceedings affects the division of enforcement responsibility between European and national authorities. For the suspected infringement of Article 26(1) covered by the investigation, national Digital Services Coordinators and other competent member-state authorities are relieved of their powers to supervise and enforce the DSA in relation to that conduct.

The proceedings do not prevent authorities from taking enforcement action under other applicable regulatory frameworks. The Commission said it would pursue the investigation as a priority and continue gathering evidence through additional requests for information, interviews or inspections.

Opening formal proceedings also gives the Commission authority to adopt interim measures, issue non-compliance decisions or accept commitments from Booking.com intended to address the matters under investigation. No deadline for completing the inquiry has been announced.

Henna Virkkunen, the Commission's executive vice-president for tech sovereignty, security and democracy, said travelers should be able to reserve accommodation without fearing fraud.

“Europeans should be able to book their holidays without fear of being scammed,” Virkkunen said. “The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously.”

The investigation now moves beyond the preliminary examination of Booking.com's regulatory disclosures to a more extensive assessment of its practices. Investigators will examine whether the company's arrangements for identifying fraudulent accommodation offers, protecting reservation-related communications and disclosing paid search placements meet the requirements imposed by the DSA.

The Commission has yet to determine whether any of the suspected infringements occurred. Its findings will establish whether further enforcement action is warranted and whether Booking.com must change the measures it uses to address fraud and advertising transparency on its platform.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey