The European Commission has launched a formal investigation into the accommodation booking platform Booking.com. The regulator is checking whether the company sufficiently protects users from fraudulent listings, fake payment requests, and possible use of personal data in criminal schemes.
The European Commission announced the start of the investigation on October 21. The investigation is conducted in accordance with the European Digital Services Act (DSA).
One of the main issues is the placement on Booking.com of rental offers for accommodation that does not actually exist. The European Commission suspects that the platform may not have effectively detected fraudulent listings, cases of impersonating property owners, and accommodation offers that do not meet set requirements.
The regulator will check whether Booking.com removes such listings in a timely manner and prevents the emergence of new fraudulent offers.
The second direction of the investigation concerns phishing and the use of booking information. Fraudsters may gain access to property owners' accounts or use information about future trips to send tourists convincing messages demanding additional payment.
For example, a user may receive a message purportedly from a hotel asking to urgently confirm a booking, re-enter bank details, or transfer money via an external link.
The European Commission will determine whether Booking.com properly assesses such risks, protects guest information, and prevents the use of its internal messaging system for fraud.
Separately, the European regulator will examine the transparency of advertisements. Hotel and apartment owners may pay the platform a higher commission to have their offers appear more prominently in search results.
Under EU rules, users should understand whether an offer is shown because it matches their search query or because it has been paid for promotion. The European Commission suspects that Booking.com may not have clearly labeled such offers as advertising.
The investigation covers possible violations of Articles 26, 34 and 35 of the Digital Services Act. These establish requirements regarding advertising transparency, assessment of systemic risks, and protection of users of large online platforms.
If violations are confirmed, Booking.com could face a fine of up to 6% of its annual global turnover. However, no fine has been imposed yet, and the mere start of an investigation does not mean the company has been found guilty.
The European Commission may request additional documents, conduct inspections, and adopt interim measures. The regulator also has the right to accept commitments from the company to address any identified problems. No specific deadline for the completion of the investigation has been set.
Booking.com stated that it cooperates with the European Commission, and that protection of personal information and customer safety remain the company's priorities.
Previously, Booking.com reported a data breach involving certain bookings. In April 2026, it became known that third parties may have gained access to guests' contacts, trip details, and messages exchanged between users and accommodation providers.
For travelers, the main risk remains forged messages demanding additional payment. Before transferring money or entering payment details, one should verify requests directly through the official Booking.com app or website and not click on suspicious payment links.
Based on materials from: European Commission, RTÉ
