[REVISION HISTORY]

European Commission regulatory scrutiny of Booking.com

Updated 6 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-25 15:23 UTC → 2026-10-26 01:06 UTC · added ~~removed~~

Booking.com has implemented voluntary transparency measures across the European Economic Area (EEA) following regulatory discussions regarding the Digital Markets Act. These changes include modifications to the ‘Booking Sponsored Benefit’ program, ensuring that prices on external channels or a hotel’s own website no longer influence program eligibility. The company also removed ‘competitive’ and ‘non-competitive’ labels from its extranet to reduce pressure on hotels to align prices across all channels. Despite these measures, the European Commission has launched a formal investigation under the Digital Services Act (DSA) to assess how the platform mitigates systemic risks to consumers. This inquiry focuses on fraudulent accommodation listings, identity theft, and phishing scams. Regulators are examining the platform’s ability to remove illegal content and the transparency of ‘boosted’ search results. The investigation also scrutinizes the security of the platform’s messaging system and the methods used to share reservation and guest data with providers to prevent misuse. The investigation follows reports that Booking.com experienced a 500 percent global increase in fraud cases. In the first half of 2026, the platform received 1,072 fraud reports, causing approximately 82,000 euros in damages—a tenfold increase compared to the previous year. Security researchers at Norton have identified approximately 350 compromised accommodations across 50 countries, with Germany reporting the highest number of cases at 49. These ‘reservation hijacking’ attacks involve criminals using legitimate booking data to send convincing messages to guests, requesting additional payments. In its first formal proceeding against the platform under the DSA, Commission officials have criticized Booking.com’s current efforts to combat scams as “absolutely substandard,” suggesting that internal risk assessments were insufficient. As a designated Very Large Online Platform (VLOP), Booking.com is subject to direct oversight by the Commission. If the investigation finds that the platform failed to manage these risks effectively, Booking.com could face fines of up to 6% of its annual global turnover. Booking.com has stated it is “cooperating fully with the Commission” and remains committed to protecting user data and combating cybercrime.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.