The European Commission today opened formal proceedings against Booking.com under the Digital Services Act, examining whether the travel platform failed to assess and curb fake listings and phishing scams, and whether listings that accommodation providers pay to push up its search results are clearly labelled as advertising.

In Short

The European Union's executive has started an official investigation into Booking.com, the hotel and holiday rental website. It wants to know whether the company did enough to stop fake properties and scam messages from reaching travellers, and whether listings that hotels pay to rank higher are honestly marked as ads. Nothing has been decided yet, but the case could end in binding orders, a non-compliance decision or promises from Booking.com to change how its site works.

What the Commission opened

According to the European Commission, the proceedings assess "whether Booking.com may have breached the Digital Services Act (DSA) by not having diligently assessed or effectively mitigated risks related to fraudulent listings and phishing scams." A second strand concerns transparency. The platform "may also have breached the DSA when it comes to transparency because it did not clearly label as ads those listings whose providers paid for a higher ranking in search results shown to users," the Commission states.

The announcement carries the reference IP/26/2223 and is dated Brussels, October 21, 2026. Three captures of it were reviewed for this article: the Commission's press corner web page, the press corner's print version, and a news item on the Shaping Europe's digital future website, which is managed by the Directorate-General for Communications Networks, Content and Technology. The two press corner versions carry identical wording, figures, dates and legal references. The Shaping Europe's digital future item is a shorter summary that lists the three investigation areas and points readers to the full release; it adds nothing that contradicts the main text. None of the three documents gives a separate date for the formal decision opening the proceedings, so the opening and the announcement are treated here as falling on the same day.

The Commission framed the case around three areas.

Fraudulent and non-compliant listings

The first concerns what appears on the platform itself. According to the Commission, it "will examine whether the provider of Booking.com has properly identified and assessed the systemic risks linked to the dissemination of illegal content." The release names the categories it has in mind: "Fake listings, such as for non-existent properties, impersonation fraud, and non-compliant accommodation offers may have negative effects on consumer protection."

Assessment is only half of the obligation. The investigation, the Commission says, "will also assess whether the platform has put in place effective measures to mitigate these risks, including by removing fraudulent and non-compliant listings." The term "non-compliant accommodation offers" is not defined in the release. It sits alongside outright fraud, which suggests the Commission is looking beyond invented properties toward listings that may exist but break applicable rules, though the document does not say which rules.

Phishing through reservation and guest data

The second area is the one most likely to be familiar to travellers. According to the Commission, the investigation "will focus on risks related to the way reservation and guest data is shared with accommodation providers, and the design and functioning of Booking.com's messaging service."

That wording places the platform's own architecture at the centre of the inquiry. Booking.com passes booking details to the hotels and hosts listed on it, and it runs an internal channel through which guests and properties exchange messages. The Commission wants to know whether the company "has put in place sufficient safeguards to prevent data from being misused to carry out phishing and solicit fraudulent payments." The release does not describe any specific incident, does not quantify how many users were targeted, and does not say whether the data reached fraudsters through compromised partner accounts or by another route. Phishing is a form of fraud built on impersonation, and in this case the question is whether the platform's design gave impersonators the material they needed.

Boosted listings and advertising transparency

The third area is where the case touches the advertising business directly. According to the Commission, "Accommodation providers can make their listings more visible in Booking.com's search results by paying a higher commission. Users should be able to clearly recognise that these 'boosted listings' are in fact advertisements."

The distinction matters for how the platform makes money. Booking.com is paid by commission on stays, and the release describes a mechanism in which a higher commission rate buys prominence in the ranking. Under the Commission's reading, that paid prominence is advertising, and it carries the disclosure duties that apply to any ad on an online platform. The Commission "will also examine whether, for each advertisement shown on Booking.com, users can easily see who is behind, who paid for it, why they are seeing it and how they can change the settings that determine which ads they see."

Those four questions map onto the four elements of Article 26(1) of the DSA: recognising that something is an ad, the person on whose behalf it is presented, the person who paid for it if different, and meaningful information about the main parameters that determine who sees it, along with how to change them. The Commission's rationale is plain. "Under the DSA, users are entitled to understand when, and on whose behalf, an ad is shown to them. Without this, they cannot tell whether a listing appears prominently because it matches their search or because the accommodation provider paid for that visibility."

The release does not name any Booking.com programme, product or label, and it does not say whether the boosted listings currently carry any marking at all. The Commission's phrase is "not clearly identifiable as advertisements," which leaves open whether the problem is the absence of a label or a label that falls short.

According to the Commission, "If proven, these failures would constitute infringements of Articles 34 and 35 of the DSA, which oblige Very Large Online Platforms and Search Engines to identify, analyse, assess, and mitigate systemic risks; and of Article 26(1), which requires providers of online platforms to ensure that users can clearly identify advertisements and the information about them."

The split is significant. Articles 34 and 35 apply only to services designated as a Very Large Online Platform or Very Large Online Search Engine, and they are built around the concept of systemic risk: the platform must identify the risks its service creates, assess them, and adopt measures proportionate to them. Article 26(1) is broader. It applies to all online platforms, regardless of size.

That difference explains one of the more technical sentences in the release. "The opening of formal proceedings relieves Digital Services Coordinators, or any other competent authority of EU Member States of their powers to supervise and enforce the DSA in relation to the suspected infringement of Article 26(1) as regards the conduct covered by the proceedings." Because the obligations reserved for the largest platforms are enforced by the Commission in any case, only the advertising duty, which a national authority could otherwise police, needed to be taken out of national hands. For the conduct covered here, the advertising question now belongs to Brussels alone.

Booking.com's status is not in doubt. According to the Commission, "Booking.com was designated as Very Large Online Platform under the EU's Digital Services Act on 25 April 2023." The release does not mention any designation as a search engine, and it gives no current user figure for the platform.

How the Commission got here

The proceedings did not come out of nowhere. According to the Commission, its decision "follows a preliminary investigation, which included an analysis of the risk assessment reports submitted by Booking.com in 2026 and the preceding three years, information published in its transparency reports, and the company's replies to the Commission's formal requests for information sent on 23 September 2025 and 26 May 2026."

Read literally, that means four annual risk assessments were reviewed, covering 2026 and the three years before it. The release does not name those years individually, and it does not describe what the requests for information asked or what Booking.com said in reply. Thirteen months passed between the first request and today's opening, with a second request roughly eight months into that period.

The Commission also names its national partner. It "cooperates with the Dutch Authority for Consumers and Markets, the Digital Services Coordinator of the Member State where Booking.com is established, in the supervision of Booking.com under the Digital Services Act." Booking.com is established in the Netherlands, which places it under the Dutch authority for DSA coordination purposes. The release does not describe what that authority contributed to the preliminary investigation.

Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, provided the only quoted statement in the documents. "Europeans should be able to book their holidays without fear of being scammed," she said. "The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously."

Next steps and possible outcomes

According to the Commission, it "will carry out an in-depth investigation as a matter of priority, continuing to gather evidence, for example by sending additional requests for information, conducting interviews or inspections."

The opening widens the tools available. "The opening of formal proceedings also empowers the Commission to take further enforcement steps, such as interim measures and non-compliance decisions," the release states. "The Commission is also empowered to accept commitments offered by Booking.com to remedy the matters subject to the proceedings."

There is a standard caveat, too. "Opening formal proceedings does not prejudge any final outcome or decision, nor does it impact enforcement actions undertaken by other authorities under other regulatory frameworks." That last clause leaves room for consumer protection, competition or data protection authorities to pursue their own cases on overlapping facts.

What the documents do not say

Several points that readers might expect are absent from all three captures:

  • No fine is mentioned, either as a figure or as a ceiling. The release does not cite the DSA's penalty provisions.
  • No deadline or expected duration for the investigation is given. "As a matter of priority" is the only indication of pace.
  • No statement from Booking.com appears. The documents do not say whether the company was notified in advance, whether it disputes the concerns, or whether it has offered commitments.
  • No figures on fake listings, phishing incidents, affected users or financial losses are provided.
  • No specific Booking.com legal entity is named; the release refers to "the provider of Booking.com" and to "the company."
  • No Member State or market is singled out, beyond the Netherlands as the country of establishment.
  • No reference is made to Booking.com's separate status under the Digital Markets Act or to any competition case.

The wider enforcement record

Booking.com joins a lengthening list of platforms facing DSA action. Fine levels in earlier cases give a sense of what a non-compliance decision can mean. In December 2025, X was fined 120 million euros in the first non-compliance decision under the regulation, a sum that included 35 million euros for shortcomings in its advertising repository. The Commission then fined Temu 200 million euros on May 28, 2026, under Articles 34 and 35 - the same two provisions now invoked against Booking.com - after proceedings that opened on October 31, 2024. PPC Land's coverage of that decision noted that DSA penalties can reach 6% of total worldwide annual turnover. On July 20, 2026, AliExpress was fined 550 million euros over failures to assess and mitigate risks from unsafe products, more than two years after formal proceedings began on March 14, 2024.

Those timelines suggest that the period between opening and a final decision has run well beyond a year in the marketplace cases. Neither Temu nor AliExpress involved a travel platform, but both rested on the same duty that sits at the heart of the Booking.com case: identifying illegal content risks and doing something proportionate about them.

The investigation also follows a run of other DSA actions. The Commission found TikTok and Meta in preliminary breach of transparency rules in October 2025, issued preliminary findings against TikTok's addictive design on February 6, 2026, and opened a probe into X over Grok on January 26, 2026.

For Booking.com specifically, this is not the first encounter with EU regulators or courts. On September 9, 2026, the General Court dismissed Booking Holdings' challenge to the Commission's September 25, 2023 decision blocking its takeover of Etraveli Group; PPC Land's coverage of that ruling noted Booking's estimated 60-70% share of the EEA hotel online travel agency market in 2022 and its gatekeeper designation under the Digital Markets Act since May 13, 2024. In Germany, the Regional Court Berlin II ruled in December 2025 that 1,099 hotels can claim damages from Booking.com over best price clauses used between 2013 and 2016.

Why it matters for marketers

The advertising strand reaches past one company. Commission-based ranking boosts are a common feature of marketplaces, where a seller or host pays not through a separate ad buy but through a higher cut of each transaction. If the Commission concludes that such arrangements are advertisements under Article 26(1), the disclosure duties that apply to display or search ads - an ad label, the advertiser's identity, the payer, and the targeting parameters - would apply to ranking products that many platforms do not present as advertising at all.

Is a paid ranking boost an ad even when no separate ad product is sold? The Commission has now put that question at the centre of a formal case against Europe's largest accommodation platform. For hotels and short-term rental hosts that pay for visibility, the outcome could change how those placements are presented to guests. For travel marketers more broadly, it touches on the commercial logic of retail and commerce media, where sponsored placement and organic ranking often sit side by side in the same results.

The phishing strand carries a different lesson. The Commission has not limited itself to content that users see; it is examining the data flows between the platform and its business partners, and the design of a messaging tool. That widens the scope of what "systemic risk" can cover for platforms that intermediate between businesses and consumers.

Timeline

Summary

Who: The European Commission, Booking.com and, as a cooperating national authority, the Dutch Authority for Consumers and Markets. Executive Vice-President Henna Virkkunen provided the Commission's statement.

What: Formal proceedings under the Digital Services Act covering three areas: fake and non-compliant listings, phishing that exploits reservation and guest data and the platform's messaging service, and listings boosted through higher commissions that may not be clearly identifiable as ads. The suspected infringements concern Articles 34, 35 and 26(1). No fine, deadline or company response appears in the documents.

When: The proceedings were opened and announced on October 21, 2026, after requests for information sent on September 23, 2025 and May 26, 2026. Booking.com has been a Very Large Online Platform since April 25, 2023.

Where: Brussels, covering Booking.com's service across the European Union. The company is established in the Netherlands.

Why: The Commission is examining whether Booking.com diligently assessed and mitigated systemic risks tied to fraud and illegal content, and whether its paid ranking boosts meet the DSA's advertising transparency rules. The outcome could determine whether commission-based visibility on marketplaces must be disclosed as advertising.