The European Commission has opened formal proceedings against Booking.com, the Amsterdam-based travel platform, under the Digital Services Act (DSA), the EU law that sets duties for large online platforms. Announced on 21 October, it is the first formal DSA investigation into the company. Brussels wants to establish whether Booking.com diligently assessed and effectively mitigated the risks of fraudulent listings and phishing scams, and whether listings that hosts pay to push up the search results are clearly labelled as advertising.
“Europeans should be able to book their holidays without fear of being scammed,” said Henna Virkkunen, the Commission’s Executive Vice-President for Tech Sovereignty, Security and Democracy. The DSA sets clear responsibilities on platforms, she said, and “we must ensure that the leading booking platform in Europe takes those responsibilities seriously”.
Booking.com says it is cooperating fully. “Security, trust and the protection of personal information are top priorities at Booking.com,” a spokesman told The Irish Times, adding that the company remains committed to working with governments, regulators, law enforcement and industry partners against online fraud.
Three questions for Booking.com
The investigation has three strands.
The first concerns fake listings: properties that do not exist, impersonation fraud and accommodation offers that do not comply with the rules. Under Articles 34 and 35 of the DSA, the largest platforms must assess such “systemic risks” and take measures against them. As PPC Land notes, these duties apply only to very large online platforms and search engines.
The second concerns phishing. The Commission will look at how reservation and guest data is shared with accommodation providers and how Booking.com’s messaging service is designed, and whether safeguards stop that data from being misused to solicit fraudulent payments.
The third is about advertising. Hosts can make their listings more visible in search results by paying Booking.com a higher commission. “Users should be able to clearly recognise that these ‘boosted listings’ are in fact advertisements,” the Commission said, as reported by The Irish Times. Regulators will check whether users can see who is behind an ad, who paid for it and why they are shown it. This strand rests on Article 26(1) of the DSA, an advertising transparency rule that applies to all online platforms, not just the largest ones.
How the case was built
The step did not come out of nowhere. Booking.com has been designated a very large online platform since 25 April 2023 and reports more than 45 million monthly users in the EU. According to PPC Land’s reading of the Commission’s documents, Brussels sent formal requests for information in September 2025 and May 2026. It also reviewed Booking.com’s risk assessment reports for 2026 and the three preceding years, its transparency reports and its replies to those requests.
Behind the scenes, the assessment appears blunt. An unnamed senior EU official described Booking.com’s risk assessment work since 2023 as “absolutely substandard”, according to AFP as cited by TNW. The Commission’s formal position is more careful: opening proceedings “does not prejudge any final outcome or decision”.
Security researchers have documented the phishing problem for years. Infosecurity Magazine lists a 2023 Secureworks finding that criminals used the Vidar infostealer to obtain partner hotels’ Booking.com credentials and then send phishing emails to guests, a Microsoft report from March 2025 on a campaign impersonating Booking.com, and a June 2026 campaign aimed at partner accommodations in Japan. Earlier this year, Booking.com itself suffered a breach in which “unauthorised parties” accessed customer details.
What is at stake
The DSA allows fines of up to 6% of a company’s global annual turnover. Booking.com is part of the US-listed Booking Holdings, which reported revenues of $26.9 billion for 2025. If a fine were calculated on the group’s revenue, 6% would come to about $1.6 billion. The Commission has not said which turnover it would use, and a fine is only one possible outcome: the proceedings also allow interim measures, and Booking.com can offer commitments to address the concerns. There is no fixed deadline.
For comparison, these are the DSA fines the Commission has imposed so far, according to PPC Land, JURIST and TNW:
Booking.com already knows EU platform rules from another law. Under the Digital Markets Act, which applies to so-called gatekeepers, it has had to comply since 14 November 2024 and can no longer stop hotels and other providers from offering different prices and conditions on other channels, including their own websites. According to the Commission, Booking.com fully removed these parity requirements in July 2024, and in September 2026 it stopped using external prices to decide which properties in the European Economic Area qualify for its Booking Sponsored Benefit programme.
The view from outside the EU
The case differs from the DSA’s best-known transatlantic clashes. Booking.com is based in Amsterdam, but its parent company is American, and Washington has been openly hostile to EU platform rules. In August 2025, President Donald Trump wrote that the rules “are all designed to harm, or discriminate against, American Technology” and threatened further tariffs. That campaign focused largely on content moderation, which critics in the US call censorship. We found no public reaction from the US government to the Booking.com case, which concerns scams and advertising labels rather than speech.
What comes next
The Commission will now gather more evidence, through further requests for information and possibly interviews or inspections. According to The Irish Times, Booking.com has handled about 6.5 billion bookings since 2010 and offers more than 30 million accommodation options worldwide. That scale suggests the case matters beyond one company: it is an early test of whether the DSA’s risk rules can make everyday consumer services, not only social media, safer to use.
