European Commission opens proceedings against Booking.com over scams and ads

On Wednesday 21 October 2026 the European Commission opened formal proceedings against the Booking.com platform. It wants to establish whether the service meets its obligations under the EU Digital Services Act (DSA).

Three areas of the investigation

The first concerns illegal content. The Commission will check whether Booking.com properly identifies and assesses the risks linked to publishing such content and whether it mitigates them effectively. This includes fictitious accommodation, impersonation of property owners and listings that do not meet requirements.

The second area is protection against phishing, meaning attempts to extract data and money. Brussels will look at how booking and guest data are shared with accommodation providers and how the messaging system between users and hosts works. It wants to determine whether the safeguards sufficiently protect this data from being used for fraud and payment scams.

The third area is advertising transparency. Properties can increase the visibility of their listings in search results by paying a higher commission. The Commission will examine whether such listings are clearly labelled as ads and whether users can easily see who paid for them and why they appear in the results. According to the Commission, a lack of clear labelling makes it harder to tell whether a listing ranks highly because it matches the search or because the owner paid for visibility.

The decision follows an earlier preliminary inquiry. It covered an analysis of the risk assessment reports Booking.com submitted in 2026 and in the three previous years.

Comments

Henna Virkkunen, the Commission's Executive Vice-President for tech sovereignty, security and democracy, said Europeans should be able to book holidays without fear of being scammed. She added that Europe's largest booking platform must take its DSA obligations seriously.

Booking.com told the Polish Press Agency (PAP) that it is cooperating fully with the Commission. The company said safety, trust and data protection are its priorities and that it works with authorities and industry partners to combat cybercrime.

What happens next

If the allegations are confirmed, Booking.com could be found in breach of the DSA, which could mean financial penalties. However, opening proceedings does not prejudge the outcome or whether a breach will ultimately be found.

What this means for people in the UK

Many travellers use Booking.com, including for trips to Poland and elsewhere in Europe. The proceedings do not change how the service works for now. They concern the platform's obligations towards users in the EU, and any changes depend on the outcome. Until then, it is worth being cautious when booking: watch out for messages asking for extra payments or card details outside the platform.