The European Union launched a probe into online travel agent Booking.com on Wednesday to determine whether it breached the bloc's digital rules in areas including fake listings and phishing scams.
The EU fears Booking.com has underestimated the impact of fraud and unlicensed accommodation, and is not sufficiently protecting users' data from being misused for scams.
The probe is the first into Booking.com under the Digital Services Act (DSA), a mammoth online content law that covers a wide array of platforms including social media and digital marketplaces.
"Europeans should be able to book their holidays without fear of being scammed," EU tech chief Henna Virkkunen said in a statement.
The EU said it was also looking into whether the Netherlands-based firm breached rules "because it did not clearly label as ads those listings whose providers paid for a higher ranking in search results shown to users."
The DSA "sets clear responsibilities" and "we must ensure that the leading booking platform in Europe takes those responsibilities seriously," Virkkunen added.
Booking.com said that it was "cooperating fully" and that "security, trust and the protection of personal information are top priorities."
"We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud and protect travellers and partners," it added.
Booking.com is among over 20 very large online platforms that must comply with the DSA's stricter rules or risk fines that could go as high as 6% of their global turnover, or even a ban for serious and repeated breaches.
There is no legal deadline for the completion of the probe, but the targeted company can offer commitments to address the European Commission's concerns.
Suspicions over data
A senior EU official was critical of Booking.com and its risk assessment efforts since 2023.
"We feel that what they have done is absolutely substandard," the official said on condition of anonymity.
The commission – the EU's digital watchdog ª said it would assess whether the online platform "properly identified" risks linked to the spread of illegal content such as non-existent properties and fraudsters portraying themselves as the owner of a property and putting it up for rent.
In some cases, customers discover on arrival that the property they thought they had booked does not exist, or more often, photographs or property descriptions do not accurately reflect reality.
The EU will also investigate whether Booking.com is doing enough to address the risks that phishing scams pose to European consumers.
Phishing is broadly defined as the practice of tricking people into sharing sensitive information through deceptive messages.
The EU said it would look at how reservation and guest data is shared with accommodation providers, and whether Booking.com has put in place "sufficient safeguards to prevent data from being misused".
"We suspect that Booking is not sufficiently protecting the data of ... private users and business users, and (this) makes the system vulnerable for this kind of phishing," the senior official said.
Meta is also under investigation over potentially fraudulent advertising on its platforms in a probe that began in 2024.