Booking.com Faces DSA Probe Over Fraud, Phishing and Advertising Transparency

The European Commission has opened formal proceedings against Booking.com under the Digital Services Act (DSA). The investigation concerns whether the platform adequately assessed and reduced systemic risks linked to fraudulent accommodation listings, phishing scams, and advertising transparency.

The Commission will examine Booking.com’s handling of fake and non-compliant listings, including non-existent properties, impersonation schemes, and accommodation offers that may breach applicable rules. The central question is whether Booking.com identified the consumer-protection risks associated with these listings and implemented effective measures to prevent and remove them.

The proceedings will also assess risks arising from phishing scams that misuse reservation and guest data. The Commission will review how Booking.com shares information with accommodation providers, as well as the design and operation of its messaging service. It will consider whether sufficient safeguards were in place to prevent misuse of data for fraudulent payment requests.

A further focus concerns paid-for ranking visibility. Accommodation providers may obtain higher placement in search results by paying higher commissions. The Commission will assess whether users can clearly recognize these boosted listings as advertisements and whether Booking.com provides the information required by Article 26(1) DSA, including who paid for an ad, who is behind it, why it is displayed, and how advertising settings can be changed.

If the concerns are substantiated, Booking.com may have infringed Articles 34 and 35 DSA on systemic risk assessment and mitigation, as well as Article 26(1) on advertising transparency. The investigation follows a preliminary review of Booking.com’s risk assessment and transparency reports, together with responses to Commission information requests sent in September 2025 and May 2026. Opening proceedings does not determine the final outcome.