Today, the European Commission opened formal proceedings to assess whether Booking.com may have breached the Digital Services Act (DSA) by failing to exercise due diligence in assessing, and effectively mitigating, risks associated with fraudulent listings and phishing scams.
The platform may also have breached the DSA’s transparency requirements by failing to clearly label as advertisements listings whose providers paid higher commissions to secure better rankings in search results shown to users.
According to the announcement, the investigation will focus on the following areas:
1. Fraudulent and non-compliant listings on Booking.com
The Commission will examine whether Booking.com’s provider correctly identified and assessed the systemic risks associated with the dissemination of illegal content. False listings, such as those advertising non-existent accommodation, impersonation scams and offers for accommodation that do not comply with the rules, may have an adverse impact on consumer protection.
The investigation will also assess whether the platform has taken effective measures to mitigate these risks, including by removing fraudulent and non-compliant listings.
2. Phishing scams exploiting Booking.com booking and guest data
The Commission will also investigate whether Booking.com’s provider has duly assessed and addressed the risks that phishing scams pose to consumers.
In particular, the investigation will focus on risks related to how booking and guest data are shared with accommodation providers, as well as the design and operation of Booking.com’s messaging service.
The Commission will also examine whether the company has put in place adequate safeguards to prevent data from being misused to carry out phishing attacks and obtain money through fraudulent payment requests.
3. Paid-promoted listings not clearly identified as advertisements
Finally, the Commission will investigate whether Booking.com complies with the DSA’s transparency obligations concerning advertising.
Accommodation providers can increase the visibility of their listings in Booking.com search results by paying a higher commission. Users should be able to clearly recognise that these “promoted listings” are in fact advertisements.
The Commission will also examine whether users can easily see, for each advertisement displayed on Booking.com, who is behind it, who paid for it, why they are seeing it and how they can change the settings that determine which advertisements are shown.
Under the DSA, users are entitled to know when an advertisement is being shown to them and on whose behalf. Without this information, they cannot tell whether a listing appears near the top of the results because it matches their search or because the accommodation provider has paid for that visibility.
If confirmed, these shortcomings would constitute breaches of Articles 34 and 35 of the DSA, which require Very Large Online Platforms and Very Large Online Search Engines to identify, analyse, assess and mitigate systemic risks, and of Article 26(1), which requires online platform providers to ensure that users can clearly identify advertisements and related information.
Next steps
The Commission will carry out a thorough investigation as a priority, continuing to gather evidence, for example by sending further requests for information, conducting interviews or carrying out inspections.
The opening of formal proceedings also empowers the Commission to take further enforcement measures, such as imposing interim measures and adopting non-compliance decisions. The Commission also has the power to accept commitments proposed by Booking.com to address the issues under investigation.
The opening of formal proceedings does not prejudge any final outcome or decision, nor does it affect enforcement action taken by other authorities under different regulatory frameworks.
The opening of formal proceedings deprives Digital Services Coordinators or any other competent authority in EU member states of their powers to supervise and enforce the DSA in relation to the alleged breach of Article 26(1), with respect to conduct covered by the proceedings.
Background
The Commission’s decision follows a preliminary investigation that included an analysis of the risk assessment reports submitted by Booking.com in 2026 and the three preceding years, information published in the company’s transparency reports, and its responses to formal requests for information sent by the Commission on 23 September 2025 and 26 May 2026.
The Commission is working with the Dutch Authority for Consumers and Markets, the Digital Services Coordinator of the member state where Booking.com is established, to supervise the company under the Digital Services Act.