The European Commission on Wednesday announced that it has opened formal proceedings against Booking.com to investigate whether the accommodation platform breached EU digital rules by failing to tackle fraudulent property listings and phishing scams, and by not clearly identifying paid-for search results as advertisements.
The investigation will assess whether the company complied with the Digital Services Act (DSA), which requires major online platforms to identify and mitigate systemic risks and ensure advertising transparency.
The Commission will examine whether Booking.com adequately identified and assessed risks associated with illegal content, including fake listings for non-existent properties, impersonation fraud and accommodation offers that do not comply with applicable requirements.
It will also assess whether the platform introduced effective measures to reduce these risks, including removing fraudulent and non-compliant listings, which can undermine consumer protection.
A second area of investigation concerns phishing scams exploiting reservation and guest data.
The Commission will examine whether Booking.com properly assessed and addressed the risks posed by such scams, particularly in relation to how reservation and guest information is shared with accommodation providers and how the platform’s messaging service is designed and operates.
It will also investigate whether sufficient safeguards are in place to prevent data from being misused to carry out phishing attacks or solicit fraudulent payments from customers.
The third area concerns paid-for listings that receive greater visibility in search results.
Accommodation providers can improve their ranking on Booking.com by paying higher commissions, but the Commission said users should be able to recognise clearly when such boosted listings are advertisements.
The investigation will assess whether the platform complies with advertising transparency requirements, including whether users can readily identify who is behind each advertisement, who paid for it, why it is being shown to them and how they can change the settings determining which advertisements they see.
Under the DSA, users must be able to understand when an advertisement is shown and on whose behalf it appears, allowing them to distinguish between listings that rank prominently because they match a search and those promoted through paid visibility.
If the suspected failures are established, they could constitute breaches of Articles 34 and 35 of the DSA, which require very large online platforms and search engines to identify, analyse, assess and mitigate systemic risks, as well as Article 26(1), which requires online platforms to ensure advertisements and related information are clearly identifiable.
The Commission said it would conduct an in-depth investigation as a matter of priority, gathering further evidence through additional requests for information, interviews or inspections.
The proceedings also empower the Commission to take further enforcement measures, including interim measures and decisions establishing non-compliance, or to accept commitments offered by Booking.com to address the concerns.
However, opening proceedings does not prejudge the outcome of the investigation or affect enforcement action by other authorities under separate regulatory frameworks.
The decision also removes the powers of member states’ Digital Services Coordinators and other competent authorities to supervise and enforce the DSA in relation to the suspected Article 26(1) infringement covered by the proceedings.
The Commission’s decision follows a preliminary investigation that examined Booking.com’s risk assessment reports submitted in 2026 and the preceding three years, its transparency reports, and its responses to formal information requests sent on September 23, 2025, and May 26, 2026.
The Commission is cooperating with the Dutch Authority for Consumers and Markets, the Digital Services Coordinator in the member state where Booking.com is established, in overseeing the company’s compliance with the DSA.
Booking.com was designated a Very Large Online Platform under the EU legislation on April 25, 2023.