The European Commission wants to establish whether Booking.com has adequately assessed and mitigated the risks of fraud on its platform. A second question is whether users can recognise that certain properties appear prominently only because the provider pays for it. Booking.com has been designated a very large online platform (VLOP) since 25 April 2023 and is therefore subject to the strictest obligations of the Digital Services Act (DSA, Regulation (EU) 2022/2065).
The key points:
- The Commission is examining three areas: fraudulent and non-compliant accommodation listings, phishing using booking and guest data, and paid ranking advantages without clear ad labelling.
- Possible infringements concern Articles 34 and 35 DSA (risk assessment and risk mitigation) and Art. 26(1) DSA (advertising transparency).
- Opening proceedings is not a finding of an infringement. Possible outcomes include interim measures, a non-compliance decision or binding commitments offered by Booking.com.
- The standard for paid visibility also affects marketplaces, comparison portals and app stores.
What does the European Commission allege against Booking.com?
The Commission suspects that Booking.com has not diligently identified and effectively mitigated systemic risks of fraud. This is set out in the Commission’s announcement of 21 October 2026, which names three areas of investigation.
The first concerns fraudulent and non-compliant listings, such as accommodation that does not exist and cases of identity fraud in which third parties pose as hosts. The Commission wants to know whether Booking.com identified these risks and whether its countermeasures, such as removing such listings, actually work.
The second is phishing. Booking.com passes reservation and guest data to accommodation providers and runs its own messaging system between guest and host. The Commission is examining whether the platform does enough to prevent this data and this channel from being misused for phishing messages and fraudulent payment requests.
The third concerns paid visibility. Accommodation providers can improve their position in search results by paying a higher commission. The Commission is examining whether users can see that this is advertising, on whose behalf it is shown, who paid for it, why it is shown to them and how they can change their settings.
The proceedings follow a preliminary investigation. The Commission analysed Booking.com’s risk assessment reports for 2026 and the three previous years, its transparency reports and its replies to formal requests for information of 23 September 2025 and 26 May 2026. Executive Vice-President Henna Virkkunen said: “Europeans should be able to book their holidays without fear of being scammed.”
Which DSA obligations are at the centre of the case?
At its core, the case is about the duties of risk assessment and risk mitigation that apply only to very large platforms and search engines. Under Art. 34 DSA, they must identify, analyse and assess the systemic risks of their service at least once a year. This expressly includes the dissemination of illegal content, which covers fraudulent listings. Art. 35 DSA requires them to mitigate those risks with reasonable, proportionate and effective measures, for instance by adapting the design of the service, content moderation or recommender systems.
The test is therefore not whether individual fake listings slip through. No platform can prevent that entirely. What matters is whether the provider captures the risk systematically and has aligned its processes accordingly. For a booking platform, this includes vetting new hosts, responding to notices and securing the communication channels through which payment details could be requested.
The obligation under Art. 26(1) DSA, by contrast, applies to all online platforms, not only the very large ones. Under Art. 19 DSA, only micro and small enterprises are exempt. Every advertisement must be identifiable as such to the user in a clear, concise, unambiguous manner and in real time. Users must also be able to see on whose behalf it is presented, who paid for it and the main parameters used to select them as recipient, including how to change those parameters.
Why is paid ranking without labelling a problem?
Paying for a higher position is advertising, even if the listing looks like an ordinary search result. Users generally assume that the order of a results list says something about price, rating or relevance. An undisclosed paid placement distorts that expectation.
This is not just a DSA issue. German unfair competition law expressly prohibits, in No. 11a of the Annex to Section 3(3) of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG), displaying search results without clearly disclosing paid advertising or specific payments for a higher ranking. Section 5b(2) UWG also requires information on the main ranking parameters. In the relationship with business users of the platform, Art. 5 of the P2B Regulation (EU) 2019/1150 requires the platform to describe in its terms whether and how ranking can be influenced against remuneration.
For Booking.com the topic is not new. Courts and authorities have previously dealt with how freely hotels may set their prices and how the platform presents its listings. What is new is that the Commission is now acting directly against the platform with its DSA enforcement powers.
What happens next in the proceedings?
The Commission will now carry out an in-depth investigation as a matter of priority and gather further evidence, for example through additional requests for information, interviews or inspections. It has not set a deadline. Several outcomes are possible:
- Interim measures under Art. 70 DSA, where there is a risk of serious damage to users.
- Commitments under Art. 71 DSA, by which Booking.com addresses the concerns and which the Commission can make binding.
- A non-compliance decision under Art. 73 DSA, which may be accompanied by a fine of up to 6% of worldwide annual turnover in the preceding financial year (Art. 74 DSA).
The Commission stresses that opening proceedings does not prejudge the outcome. It is cooperating with the Netherlands Authority for Consumers and Markets (ACM), the Digital Services Coordinator responsible for Booking.com because the company is established in the Netherlands. For the conduct examined under Art. 26(1) DSA, national authorities lose their supervisory powers once proceedings are opened. This follows from Art. 66(2) DSA. Civil claims by competitors, associations or consumers before German courts remain unaffected.
What does this mean for hosts and hotels?
Hosts should expect Booking.com to tighten its checks and requirements. Platforms often respond to Commission proceedings with stricter identity checks, additional mandatory information and faster suspensions. That protects against fraudsters, but can also hit legitimate providers whose documents are incomplete or whose account looks unusual.
Practical recommendations:
- Secure your access: Phishing via booking platforms often starts with a hijacked host account. Two-factor authentication, separate logins for staff and regular reviews of access rights are a must.
- Take data breaches seriously: Hotels and landlords are themselves controllers under data protection law for the guest data they receive from the platform. If this data is harvested through a compromised account, notification to the supervisory authority within 72 hours under Art. 33 GDPR and communication to guests under Art. 34 GDPR may be required.
- Document paid visibility: If you use programmes for better placement, keep the terms. If the platform changes its labelling or its programmes, you can then show what was agreed.
- Challenge suspensions: If the platform suspends an account or removes listings, it must give reasons under Art. 17 DSA. The decision can be challenged through the internal complaint-handling system under Art. 20 DSA, out-of-court dispute settlement under Art. 21 DSA and the courts.
What does this mean for travellers?
For travellers, nothing changes for now; the basic rules remain the same. Pay only through the channels provided by the platform and never to a third-party account on request by message, messenger or link. Legitimate hosts do not ask you to re-enter card details via a link they send you.
You can report suspicious listings through the platform’s notice mechanism under Art. 16 DSA. The platform must process the notice and inform you of its decision. If it does not respond adequately, you can lodge a complaint under Art. 53 DSA with the Digital Services Coordinator of your Member State, in Germany the Federal Network Agency (Bundesnetzagentur). If money has already been paid, contact your bank or card issuer immediately and report the matter to the police.
What does this mean for other platforms?
The case shows where supervisors are looking: at fraud by providers and at hidden advertising in rankings. Both affect every marketplace on which third parties sell or rent. The Commission is also conducting DSA proceedings against marketplaces such as Temu and AliExpress. Smaller platforms that are not designated as VLOPs must also comply with Art. 26 DSA as soon as they are no longer micro or small enterprises. German unfair competition law applies regardless of size.
Platform operators should therefore check whether paid placements, “top offers” or featured partners are clearly labelled as advertising in every view, including in the app and in filtered result lists. Sellers and landlords who book such programmes should be aware that, although they are rarely the addressees of DSA obligations themselves, their listings may suddenly appear differently if the platform changes its approach. For more on when a platform counts as “very large”, see our article on the General Court’s Stripchat judgment (in German).
Frequently asked questions about the DSA proceedings against Booking.com
Has Booking.com infringed the DSA?+
What penalty does Booking.com face?+
Must paid ranking on platforms be labelled?+
What should I do if I was scammed via a booking platform?+
What can hosts do if their account is suspended?+
Account suspended, listing removed or your platform under regulatory scrutiny?
We represent hosts, sellers and platform operators in account suspensions, DSA compliance and ad labelling issues. You will usually receive an initial assessment within 24 hours.
Further information
- General Court on Stripchat: when an online platform is “very large” (in German)
- TikTok before the Federal Court of Justice: can consumer associations enforce DSA obligations? (in German)
- Can Amazon suspend without reasons? What Art. 4 P2B Regulation and Art. 17 DSA require (in German)
- Booking.com: CJEU ruling on the order button in distance contracts (in German)
- Our fields of activity
- Our successes
Related posts
