On 21 October 2026, the European Commission has opened an official investigation in order to assess whether Booking.com may have breached the Digital Services Act. The commission suspects the online booking platform has not been doing enough to address fake listings and phishing scams.
The news follows a preliminary investigation, which included an analysis of the risk assessment reports submitted by Booking.com in 2026 and the preceding three years, information published in its transparency reports, and the company’s replies to the Commission’s formal requests for information sent on 23 September 2025 and 26 May 2026.
According to a European Commission spokesperson, the research revealed that the number of scams reported on Booking.com rose by 500 per cent between 2022 and 2024, with fraud totalling 4.2 billion euros in 2024.
According to the European Commission, Booking.com may have breached the Digital Services Act (DSA) on three specific subjects.
Firstly, the Commission will examine whether the provider of Booking.com has properly identified and assessed the systemic risks linked to the dissemination of illegal content. Fake listings, such as for non-existent properties, impersonation fraud, and non-compliant accommodation offers may have negative effects on consumer protection. The investigation will also assess whether the platform has put in place effective measures to mitigate these risks, including by removing fraudulent and non-compliant listings.
Secondly, the investigation will determine whether the provider of Booking.com has diligently assessed and addressed the risks that phishing scams pose to consumers. The research will focus on risks related to the way reservation and guest data is shared with accommodation providers, and the design and functioning of Booking.com’s messaging service. The Commission will also examine whether the company has put in place sufficient safeguards to prevent data from being misused to carry out phishing and solicit fraudulent payments.
Finally, the Commission will investigate whether Booking.com complies with the DSA’s advertising transparency obligations. Accommodation providers can make their listings more visible in Booking.com’s search results by paying a higher commission but users should be able to clearly recognise that these ‘boosted listings’ are in fact advertisements.
Booking a holiday should be exciting, not risky. Europeans deserve to book with confidence, knowing platforms are taking their safety seriously. We’ll make sure they live up to their responsibilities. 🔗 More: https://t.co/PdRBQHxfJN https://t.co/PaxZGfGH6J
— European Commission (@EU_Commission) October 21, 2026
The Commission will also examine whether, for each advertisement shown on Booking.com, users can easily see who is behind, who paid for it, why they are seeing it and how they can change the settings that determine which ads they see. This matters as under the DSA, users are entitled to understand when, and on whose behalf, an ad is shown to them. Without this, they cannot tell whether a listing appears prominently because it matches their search or because the accommodation provider paid for that visibility.
“Europeans should be able to book their holidays without fear of being scammed. The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously,” said Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, in a statement.
Now that the formal proceedings have been opened, the Commission will carry out an in-depth investigation while it will also be able to take further enforcement steps, such as interim measures and non-compliance decisions. Moreover, through the investigation, the Commission is empowered to accept commitments offered by Booking.com to remedy the matters subject to the proceedings.
If the Commission finds Booking.com to have broken the rules and if the platform refuses to change its policies, the Commission could impose fines amounting to up to 6% of the company’s turnover.
