The European Commission has launched formal proceedings to assess whether Booking.com may have breached the Digital Services Act (DSA). The investigation will examine whether the platform has diligently assessed and effectively mitigated risks related to fraudulent listings and phishing scams. It will also look at whether listings whose providers paid for higher placement in search results have been clearly labelled as advertisements.
The case covers three connected concerns: fake accommodation offers, the misuse of reservation data to request fraudulent payments, and the disclosure of paid visibility to users.
Three areas under examination
The first area concerns fraudulent and non-compliant listings. The Commission will examine whether Booking.com has properly identified and assessed systemic risks linked to the dissemination of illegal content. These include listings for non-existent properties, impersonation fraud, and accommodation offers that do not comply with applicable rules. It will also assess whether the platform’s mitigation measures, including the removal of such listings, are effective.
The second area focuses on phishing. The Commission will examine the risks that arise from the way reservation and guest data is shared with accommodation providers, as well as the design and functioning of Booking.com’s messaging service. It will also assess whether sufficient safeguards exist to prevent this data from being misused for phishing and for soliciting fraudulent payments. This element of the case is relevant to payments and fraud professionals because it concerns the communication channels through which consumers may receive payment requests.
The third area addresses advertising transparency. Accommodation providers can increase the visibility of their listings in Booking.com’s search results by paying a higher commission. Under the DSA, users must be able to recognise these ‘boosted listings’ as advertisements. In addition, the Commission will also check whether users can easily see who is behind each ad, who paid for it, why they are seeing it, and how they can change the settings that determine which ads they see.
Legal basis and possible outcomes
If proven, the alleged failures would constitute infringements of Articles 34 and 35 of the DSA. These articles require Very Large Online Platforms and Search Engines to identify, analyse, assess, and mitigate systemic risks. The alleged failures would also breach Article 26(1), which obliges online platforms to ensure that users can clearly identify advertisements and the information about them.
The Commission has said it will carry out an in-depth investigation as a matter of priority. It will continue to gather evidence through additional requests for information, interviews, or inspections. Opening formal proceedings allows the Commission to take further enforcement steps, including interim measures and non-compliance decisions. It may also accept commitments offered by Booking.com to remedy the matters under investigation.
The opening of proceedings does not prejudge any final outcome. It also does not affect enforcement actions taken by other authorities under separate regulatory frameworks. However, Digital Services Coordinators and other competent authorities in EU Member States lose their powers to supervise and enforce the DSA in relation to the suspected Article 26(1) infringement, as regards the conduct covered by the proceedings.
Background to the case
The decision follows a preliminary investigation. That investigation included an analysis of the risk assessment reports Booking.com submitted in 2026 and the three preceding years, as well as information published in its transparency reports. It also covered the company’s replies to formal requests for information sent on 23 September 2025 and 26 May 2026. The Commission supervises Booking.com under the DSA in cooperation with the Dutch Authority for Consumers and Markets, the Digital Services Coordinator of the Member State where Booking.com is established.
