By Hoin Ryou · 2026-10-27
Tools & Security · October 27, 2026
The European Commission has opened formal proceedings against Booking.com under the Digital Services Act (DSA), the EU law that sets safety and transparency duties for online services, with the strictest rules reserved for the largest platforms. The case, announced on October 21, asks whether the accommodation platform has done enough to assess and reduce the risks of fake listings and phishing scams, and whether it tells users clearly when a property appears high in search results because its provider paid for that position.
Opening proceedings is not a finding that Booking.com broke the law. It turns a preliminary inquiry into a formal case with defined questions and a range of possible outcomes. It also goes to the heart of a familiar worry for anyone who books travel online: whether the property, the message and the payment request in front of them are genuine.
Three questions at the center of the case
The first concerns listings. According to the Commission’s announcement, investigators will examine whether Booking.com properly identified and assessed the risks created by illegal content on its service, such as listings for properties that do not exist, impersonation fraud and accommodation offers that do not comply with the rules. They will also look at whether the steps taken to deal with those risks, including removing fraudulent and non-compliant listings, actually work.
The second concerns phishing. Here the Commission’s questions concern how the system is built. It will examine how reservation and guest data are passed to accommodation providers, how the platform’s messaging service is designed and operates, and whether there are enough safeguards to stop that information from being misused for phishing or to request fraudulent payments.
The third concerns advertising. Accommodation providers can pay a higher commission to make their listings more visible in search results. The Commission wants to know whether travelers can recognize these boosted placements as advertisements. It will also check whether each ad makes the advertiser and the paying party easy to find, explains the reasons a particular user is seeing it and points to the controls for changing ad preferences.
The legal provisions involved
Booking.com was designated a very large online platform under the DSA on April 25, 2023, a status that carries the law’s heaviest obligations. The Commission says that, if proven, the suspected failures would breach Articles 34 and 35 of the Digital Services Act, which require the largest platforms and search engines to identify, analyze and assess systemic risks and to take measures to mitigate them. The advertising questions fall under Article 26(1), which requires online platforms to ensure that users can clearly identify ads and the information that goes with them.
The case builds on earlier work. The Commission says its decision followed a preliminary investigation that drew on the risk assessment reports Booking.com submitted in 2026 and in the three preceding years, its published transparency reports, and its replies to formal requests for information sent on September 23, 2025, and May 26, 2026. The Commission cooperates in supervising Booking.com with the Dutch Authority for Consumers and Markets, the national DSA coordinator for the country where the company is established.
.jpg){kind=link}
What can happen next
The Commission says it will treat the investigation as a priority and keep gathering evidence, for example through further requests for information, interviews or inspections. Formal proceedings give it the power to take further enforcement steps, including interim measures while the case is open and, eventually, a non-compliance decision. It can also accept commitments offered by Booking.com to fix the problems under review.
For confirmed infringements, Article 74 of the DSA allows the Commission to fine a very large platform up to 6% of its total worldwide annual turnover in the preceding financial year. As of October 27, 2026, no fine had been proposed in this case, and the Commission stresses that opening proceedings does not prejudge any final outcome. It also does not affect action by other authorities under other laws.
One procedural detail matters for national regulators. For the advertising conduct covered by the case, opening proceedings removes the power of national DSA coordinators and other national authorities to supervise and enforce Article 26(1) themselves. The Commission now leads on that question.
Booking.com’s response
A Booking.com spokesperson told PhocusWire that the company was cooperating fully with the Commission and engaging constructively with its questions under the DSA.
What travelers can do while the case runs
An investigation does not change how a booking works today, but the risks it describes point to practical habits. The US Federal Trade Commission’s guidance on rental listing scams says that anyone who insists on payment by wire transfer, gift card or cryptocurrency is running a scam. A guide on Booking.com’s travel-articles site, which carries a note that it reflects its author’s views, makes a similar point: it warns that wire transfers and cash-app payments are difficult to trace and to reverse, and advises guests to book and pay through the platform.
- Check any request to “reconfirm” card details or pay an extra amount against the reservation shown in your account or the official app, not against a link sent in a message.
- Be cautious when someone asks you to pay outside the platform or to continue the conversation on another messaging app.
- If you cannot confirm that a property or its operator is genuine, contact the platform through its official channels before paying anything.
- Report suspected fraud to the platform and, in the United States, to the FTC at ReportFraud.ftc.gov. In other countries, use the national consumer or police reporting service.
News Text commentary
The most useful part of the Commission’s case is where it locates the problem. Booking scams are usually discussed as a matter of traveler vigilance: do not click the link, do not pay by bank transfer. By examining how reservation data reaches hosts and how the messaging system is built, the Commission treats phishing partly as a design question: which information flows where, and how easily someone who gains access to a property’s account could pass as the real host. That is the right frame. Individual caution still matters, but it cannot make up for a channel that guests have been taught to trust carrying a fraudulent request. The advertising strand matters for a similar reason. Ranking is how most people choose. If paid visibility is not clearly signposted, travelers cannot tell whether the top result is the best match or simply the best-funded one.