Written by: Haim Ravia, Dotan Hammer
On October 21, 2026, the European Commission opened formal proceedings against Booking.com under the Digital Services Act (DSA) to assess whether the platform has failed to diligently assess and effectively mitigate the risks arising from fraudulent listings and phishing scams, and whether it has breached the DSA’s advertising transparency rules by failing to clearly label as advertisements listings whose providers paid for higher visibility. Booking.com was designated a Very Large Online Platform (VLOP) under the DSA on April 25, 2023, which subjects it to the enhanced obligations that the DSA imposes on the largest platforms.
The decision to open proceedings follows a preliminary investigation in which the Commission analyzed Booking.com’s risk assessment reports for 2026 and the preceding three years, its transparency reports, and its replies to two formal requests for information sent on September 23, 2025 and May 26, 2026. The Commission is working in cooperation with the Dutch Authority for Consumers and Markets, the Digital Services Coordinator in the Netherlands, where Booking.com is established.
The investigation focuses on three areas. First, the Commission will examine whether Booking.com has identified and assessed the systemic risks related to the dissemination of illegal content through fraudulent and non-compliant listings, such as non-existent properties, impersonation fraud, and accommodation offers that may harm consumers, and whether it has put in place effective mitigation measures, including the removal of such listings. Second, the Commission will assess whether Booking.com has adequately assessed and mitigated the risk of phishing scams that exploit reservation and guest data. This part of the investigation will look at how reservation and guest data are shared with accommodation providers, the design of Booking.com’s messaging service, and whether safeguards are in place to prevent that data from being misused for phishing or fraudulent payment requests. Both of these areas concern Articles 34 and 35 of the DSA, which require VLOPs to assess and mitigate systemic risks.
Third, the Commission will investigate Booking.com’s “boosted” listings, under which accommodation providers may pay a higher commission to Booking.com in exchange for greater visibility in search rankings. Under Article 26(1) of the DSA, users of online platforms must be able to identify advertisements clearly, including on whose behalf an advertisement is presented, who paid for it, why the user is seeing it, and how to change the parameters used to display it. The Commission will assess whether users can distinguish between listings ranked for relevance and those ranked higher because of payment. Henna Virkkunen, the Commission’s Executive Vice-President for Tech Sovereignty, Security and Democracy, said that Europeans should be able to book their holidays without fear of being scammed.
The Commission stated that it will carry out an in-depth investigation as a matter of priority and may gather further evidence through additional requests for information, interviews or inspections. The opening of formal proceedings empowers the Commission to take further enforcement steps, including interim measures and non-compliance decisions, and to accept commitments offered by Booking.com to remedy the issues under investigation. Under the DSA, non-compliance decisions may be accompanied by fines of up to 6% of the provider’s total worldwide annual turnover. The opening of proceedings does not prejudge the outcome. As a result of the opening of proceedings, Member State authorities are relieved of their powers to supervise and enforce Article 26(1) of the DSA with respect to the conduct concerned.
The proceedings signal that the Commission treats consumer fraud and the misuse of customer data on online marketplaces as systemic risks under the DSA, and that the transparency of paid ranking is a priority for enforcement.
Click here to read the European Commission’s press release.
