The European Commission opened formal proceedings against Booking.com on 21 October 2026 to examine suspected breaches of the Digital Services Act (DSA). The Booking.com DSA investigation covers fraudulent accommodation listings, phishing scams involving reservation and guest data, and whether listings boosted through higher commissions are clearly identified as advertisements.
The proceedings move the case beyond a preliminary investigation into a formal assessment of the platform’s compliance. The Commission stressed that opening proceedings does not prejudge the outcome. The announcement does not establish that Booking.com has breached EU law.
The Commission will assess whether Booking.com properly identified and evaluated systemic risks arising from illegal content on its platform. These include listings for non-existent properties, impersonation fraud and accommodation offers that do not comply with applicable requirements.
Investigators will also examine whether the company implemented effective measures to reduce those risks, including removing fraudulent and non-compliant listings. The issue is both the quality of the assessment and the effectiveness of the response.
For marketplace compliance teams, the case centres on platform-specific DSA risk assessments and the controls used to address identified threats to consumers. If proven, the suspected failures could breach Articles 34 and 35, which require designated very large services to assess and mitigate systemic risks.
A second strand concerns phishing scams targeting consumers. The Commission will examine how reservation and guest data is shared with accommodation providers, alongside the design and operation of Booking.com’s messaging service.
Investigators will assess whether sufficient safeguards prevent that data from being misused to solicit fraudulent payments. This places the platform’s data-sharing arrangements and communication features within the scope of the investigation, rather than limiting scrutiny to accommodation listings.
For cybersecurity and product-development teams, the relevant issues include reservation and guest data safeguards and how messaging functionality can be exploited. The announcement does not identify a particular technical vulnerability or attribute the scams to a specific attack method.
The Commission is also investigating DSA advertising-transparency obligations. Accommodation providers can increase their visibility in Booking.com’s search results by paying a higher commission. According to the Commission, users should be able to recognise these boosted listings as advertisements.
The investigation will examine whether users can easily identify who is behind an advertisement, who paid for it and why it is shown to them. It will also assess information about changing the settings that determine which advertisements users see.
These requirements are set out in Article 26(1) of the DSA. The issue concerns whether consumers can distinguish visibility purchased by an accommodation provider from prominence based on how well a listing matches their search.
Booking.com was designated a Very Large Online Platform on 25 April 2023. The Commission’s preliminary work included risk assessment reports submitted in 2026 and the preceding three years, transparency reports, and responses to formal information requests sent on 23 September 2025 and 26 May 2026.
The Commission is cooperating with the Dutch Authority for Consumers and Markets, the Digital Services Coordinator in the member state where Booking.com is established.
It will now gather further evidence as a priority, potentially through additional information requests, interviews and inspections. Formal proceedings allow interim measures, non-compliance decisions or acceptance of commitments offered by Booking.com. The next development to monitor is whether the investigation produces findings or remedial commitments concerning listing controls, phishing safeguards or advertising disclosures.