The European Commission opened Digital Services Act proceedings against Booking.com on 21 October over fake listings, phishing and whether paid rankings are labelled as ads.
Cover image: The Berlaymont building, European Commission headquarters in Brussels (file photo) — photo by EmDee, CC BY-SA 4.0, via Wikimedia Commons.
The European Commission on 21 October 2026 opened formal proceedings against Booking.com under the Digital Services Act (DSA), its first DSA case against the platform. It will assess whether Booking.com “may have breached” the law “by not having diligently assessed or effectively mitigated risks related to fraudulent listings and phishing scams”, and whether it did not clearly label as ads the listings whose providers paid a higher commission for a better search ranking.
No breach has been found. The Commission says opening proceedings “does not prejudge any final outcome or decision”, and as of 25 October 2026 no fine or deadline has been set. A confirmed breach could cost Booking.com, part of Booking Holdings, up to 6 per cent of global annual turnover.
What is the Commission investigating at Booking.com?
Release IP/26/2223 sets out three areas, after a preliminary probe of Booking.com’s risk-assessment reports since 2023 and its replies to information requests sent on 23 September 2025 and 26 May 2026.
| Area | What the Commission will examine |
|---|---|
| Fraudulent listings | Non-existent properties, impersonation fraud and non-compliant offers; whether risks were assessed and listings removed |
| Phishing | How guest data is shared with properties, the messaging service’s design, safeguards against fraudulent payment requests |
| Boosted listings | Whether users can tell they are ads and see who paid and why |
If proven, the Commission says, the failures would breach Articles 34 and 35, which oblige very large platforms to assess and mitigate systemic risks, and Article 26(1), which requires that users can clearly identify advertisements.
“Europeans should be able to book their holidays without fear of being scammed,” said Henna Virkkunen, the Commission’s Executive Vice-President for Tech Sovereignty, Security and Democracy. A senior EU official described what Booking.com had done as “absolutely substandard”, EU Perspectives reported.
Why does the boosted-listings strand matter to hotels?
It reaches into how the platform earns money. The Commission says providers “can make their listings more visible in Booking.com’s search results by paying a higher commission”, and users “should be able to clearly recognise” these as advertisements.
“If you pay to have your hotel ranked higher on the platform, that’s simply advertising,” spokesperson Thomas Regnier said, according to EU Perspectives. “While the practice as such is legal, Booking must be transparent towards consumers.”
Regnier said Booking.com handles two-thirds of hotel bookings made through online travel agencies in Europe. The commission model is explained in how online travel agencies work and shapes the choice between booking direct and booking through an OTA. In the US, a proposed class action against Expedia also targets ranking tools.
How do the phishing scams reach guests?
Many start after a genuine booking, EU Perspectives reported: criminals take over hotel accounts and write to guests through Booking.com’s own messaging service, and guests pay a second time or hand over card details.
EU officials cited a Dutch consumer report counting 1,072 fraud notifications on the platform in the first part of 2026, ten times the 2025 level.
Hotel associations want a role in the fix. The Hotelstars Union, which covers more than 22,000 classified hotels and operates under the auspices of HOTREC Hospitality Europe, offered Booking.com free access to its official star data, arguing a cross-check would confirm that a hotel exists. The Commission’s release does not mention stars; the separate dispute over the stars Booking.com displays is covered in how hotel star ratings work.
What happens next?
The Commission, which supervises Booking.com with the Dutch Authority for Consumers and Markets, will investigate “as a matter of priority”. It can adopt interim measures or a non-compliance decision, or accept commitments from Booking.com. Precedent suggests a long process: the Commission fined Temu €200 million on 28 May 2026 for failing to properly assess the risks of illegal products on its platform, nearly 19 months after opening proceedings on 31 October 2024.
Booking.com told Reuters it was engaging constructively with the Commission. “Security, trust and the protection of personal information are top priorities at Booking.com,” a spokesperson said, adding that it remained committed to working with governments, regulators, law enforcement and industry partners “to combat cybercrime and online fraud, and protect travelers and partners.”
“This is a systemic problem,” said Agustín Reyna, director general of the consumer group BEUC.
Frequently asked questions
Has Booking.com been found in breach of the Digital Services Act?
No. On 21 October 2026 the European Commission opened formal proceedings to assess whether Booking.com may have breached the law, and it says this “does not prejudge any final outcome or decision”. As of 25 October 2026 there is no finding, fine or interim measure.
What are “boosted listings” on Booking.com?
The Commission uses the term for listings whose accommodation providers pay Booking.com a higher commission to appear more prominently in search results. It is examining whether guests can recognise them as advertisements and see who paid and why. Commission spokesperson Thomas Regnier said the practice itself is legal but must be transparent.
How large a fine could Booking.com face?
A confirmed breach of the Digital Services Act can bring a fine of up to 6 per cent of global annual turnover, Reuters and Euronews reported. There is no fixed legal deadline, and the Commission can instead accept commitments from Booking.com to remedy the problems.
Does the investigation change anything for travellers booking now?
Not yet. As of 25 October 2026 the Commission has ordered no changes to how Booking.com works. The scam pattern described in reporting on the case is a message after a genuine booking, sometimes sent through the platform’s own chat, asking a guest to pay again or share card details.
Sources
- European Commission, Booking.com DSA proceedings (IP/26/2223)
- Reuters via The Star, Booking.com targeted in EU investigation
- Euronews, EU probes Booking.com over fake listings and phishing
- EU Perspectives, EU probes how Booking.com tackles scams
- Hotelstars Union, Real stars, real hotels
- European Commission, Commission fines Temu €200 million (IP/26/1178)
