Technology · News
EU Opens Formal Digital Services Act Probe Into Booking.com Over Scams and Fake Listings
Published:
In brief
The European Commission has opened a formal investigation into Booking.com under the EU's Digital Services Act, examining whether the platform did enough to stop fraudulent listings and phishing scams that exploit guest data. The probe also looks at whether paid "boosted" listings are clearly labeled as advertisements. It is the first formal DSA case brought against Booking.com.
The European Commission announced on 21 October 2026 that it has opened formal proceedings against Booking.com under the Digital Services Act (DSA), the EU's main rulebook for large online platforms. The move follows a preliminary review and marks the first formal DSA investigation into the travel booking site.
What the Commission Is Investigating
According to the Commission's own announcement, the formal proceedings will assess three areas. First, whether Booking.com diligently identified and mitigated risks linked to fraudulent or non-compliant listings, including fake or misrepresented properties. Second, whether the design of its reservation system and messaging service, and the way guest and booking data are shared with accommodation providers, leaves travelers exposed to phishing attempts and fraudulent payment requests. Third, whether so-called 'boosted' listings, those that appear higher in search results because a provider paid for the placement, are clearly and consistently labeled as advertising.
The Commission's digital chief, Henna Virkkunen, said travelers should be able to book their holidays without worrying about being scammed, according to reporting by TheNextWeb. The Commission separately stated that users should be able to tell apart listings that rank highly because they match a search from those promoted through payment, Xinhua reported.
Why Booking.com Falls Under the DSA
Booking.com has been designated a 'very large online platform' under the DSA since April 2023, a status that applies to services with more than 45 million average monthly users in the EU, according to TheNextWeb. That designation subjects the company to the DSA's strictest obligations, including annual risk assessments covering illegal content, fraud and consumer-protection risks, and independent audits of those assessments.
The platform connects travelers to more than 30 million accommodation listings worldwide and says it has processed 6.5 billion bookings since 2010, the Irish Times reported. TheNextWeb also noted that an incident in April involved unauthorized third-party access to reservation information, a type of breach that investigators say can enable so-called reservation-hijacking schemes used to send fraudulent payment demands to guests.
| Figure | Value | Source |
|---|---|---|
| EU 'very large online platform' status since | April 2023 | TheNextWeb |
| Average monthly EU users required for VLOP status | 45+ million | TheNextWeb |
| Accommodation listings worldwide | 30+ million | Irish Times |
| Bookings processed since 2010 | 6.5 billion | Irish Times |
| Maximum possible DSA fine | 6% of global annual turnover | TheNextWeb |
Company Response and What Happens Next
Booking.com said it would cooperate fully with the Commission's investigators and said that security, trust and the protection of personal information were top priorities for the company, according to a statement reported by TheNextWeb.
The Commission has not set a fixed deadline for concluding the investigation, TheNextWeb reported. Under the DSA, the Commission can impose interim measures while the probe continues, accept binding commitments from Booking.com to address the concerns, or ultimately issue a non-compliance decision. If a breach is confirmed, fines can reach up to 6% of the company's global annual turnover. An unnamed senior EU official told TheNextWeb that Booking.com's existing risk assessments fell far short of what is required.
Europeans should be able to book their holidays without fear of being scammed.
Questions
- What is the EU investigating Booking.com for?
- The European Commission is examining whether Booking.com adequately mitigated risks from fraudulent listings and phishing scams that exploit guest and reservation data, and whether the platform clearly labels paid 'boosted' listings as advertising, as required under the Digital Services Act.
- What law is the investigation based on?
- The probe is brought under the EU's Digital Services Act, which imposes extra risk-assessment and transparency obligations on platforms designated as 'very large online platforms,' a category Booking.com has fallen into since April 2023 because it has more than 45 million average monthly users in the EU.
- Could Booking.com be fined?
- Yes. If the Commission finds that Booking.com breached the Digital Services Act, it can impose fines of up to 6% of the company's global annual turnover. The Commission can also accept remedial commitments from Booking.com instead of a formal non-compliance decision.
- Has Booking.com responded to the investigation?
- Booking.com said it would cooperate fully with the investigation and said that security, trust and the protection of personal information were top priorities for the company, according to TheNextWeb.
- Is this the first EU case against Booking.com under the DSA?
- Yes. The European Commission's announcement on 21 October 2026 is described as the first formal Digital Services Act investigation opened into Booking.com.
Sources
- Irish Times — Booking.com under investigation over fraudulent listings concerns
- European Commission — Commission to investigate how Booking.com combats scams and fraud under the Digital Services Act
- TheNextWeb — EU opens Digital Services Act investigation into Booking.com over scams
- Xinhua — EU opens probe into Booking.com over scams, advertising transparency
This piece was prepared with artificial intelligence and passed an automated source check before publication. If you see an error, ask for a correction. Request a correction or reply · How we make this
Related
TechnologyNews
Critical PHP Flaws Force Government Sites Offline Before Emergency Patch
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, led government agencies in the Netherlands and Finland to take websites offline on October 21, 2026, hours before PHP's developers shipped an emergency patch. Both flaws are rated 9.2 on the CVSS v4.0 scale and allow remote code execution without authentication; Cloudflare reported early exploitation attempts before the fix went out.
TechnologyNews
Google Cloud Outage Disrupts UK Banks and NHS; Google Cites Power Failure, Not a Software Bug
A Google Cloud outage on 20 October 2026 knocked out services for UK banks including Lloyds, HSBC and Revolut, plus NHS England, Royal Mail and other sites, after a power failure hit a London-region data-center zone. Google said the roughly eight-hour disruption was caused by this power event, not a software vulnerability; a separate critical PHP security flaw disclosed the same week is unrelated to this incident, according to the sources reviewed.
TechnologyNews
Cyberattack Takes Food Lion, Hannaford Sites Offline for More Than a Week
A cybersecurity incident at Ahold Delhaize, parent company of Food Lion, Hannaford, Stop & Shop and Giant Food, knocked websites, apps and online ordering offline across the US starting October 11-12, 2026. Physical stores stayed open throughout, and the company says it has found no evidence customer data was stolen, though some US digital services were still being restored more than a week later.
TechnologyArticle
Meta's AI Spending Surge: How Capex Growth Is Squeezing Profitability
Meta has raised its 2026 artificial-intelligence infrastructure spending guidance three times, from an initial $115–135 billion to as much as $130–145 billion, nearly double the $72.2 billion it spent in 2025. The buildout pushed free cash flow near breakeven in the second quarter and triggered sharp share-price drops, setting up heightened investor scrutiny ahead of Meta's third-quarter 2026 results on October 21.