Brussels (Brussels Morning Newspaper) October 21, 2026 – The European Commission has opened formal proceedings to assess whether Booking.com may have breached the Digital Services Act (DSA) by failing to diligently assess and effectively mitigate risks related to fraudulent listings, phishing scams, and transparent advertising standards.
Opening Of Formal Proceedings Under The Digital Services Act
The European Commission officially announced the opening of formal infringement proceedings against Booking.com on October 21, 2026. The regulatory action aims to scrutinise whether the online accommodation platform has complied with obligations stipulated under the European Union’s Digital Services Act (DSA). Specifically, the investigation focuses on the platform’s mechanisms for combating illegal content, handling fraudulent accommodation listings, managing user data security to prevent phishing attacks, and ensuring transparency regarding paid-for advertisements.
The formal procedure follows preliminary assessments by EU regulators concerning the measures implemented by Booking.com to safeguard consumers. Under the framework of the Digital Services Act, designated very large online platforms and mainstream digital services are required to rigorously evaluate systemic risks linked to their services and deploy effective mitigation measures. The Commission will now conduct an in-depth investigation as a matter of priority through information requests, interviews, and inspections.
Investigation Focus Areas: Fraudulent Listings And Non-Compliant Offers
The primary pillar of the European Commission’s investigation centers on fraudulent and non-compliant listings hosted on Booking.com. Regulators will examine whether the platform has properly identified, prevented, and mitigated risks associated with fake accommodation advertisements. This includes non-existent properties, properties utilizing identity theft or impersonation fraud, and offers that fail to meet legal requirements.
The assessment will scrutinize the internal verification processes utilized by Booking.com when property providers register on the platform. The European Union executive aims to determine whether sufficient mechanisms are in place to stop unlawful or fraudulent listings from appearing on the service in the first place, thereby protecting consumers from financial losses and deceptive commercial practices.
Phishing Scams Exploiting Reservation And Guest Data
The second key area of the formal investigation addresses phishing scams that exploit Booking.com’s reservation and guest data systems. The European Commission will assess whether the platform adequately evaluated and managed risks arising from the sharing of sensitive reservation information between guests and accommodation providers.
Particular attention will be directed toward the design and operational framework of Booking.com’s internal messaging service. Regulators will investigate whether adequate technical safeguards and security measures are enforced to prevent personal data from being intercepted or misused by malicious actors. These bad actors frequently leverage compromised communication channels to dispatch fraudulent phishing messages to consumers, soliciting unauthorized payments outside official platform safeguards.
Transparency Deficits Concerning Paid-For Boosted Listings
In addition to fraud and scam mitigation, the investigation covers transparency obligations mandated by the Digital Services Act. The European Commission will evaluate whether Booking.com complies with rules governing online advertising transparency.
Specifically, the inquiry will examine listings where providers pay financial remuneration to secure a higher ranking in search results presented to users. Regulators will assess whether these paid-for boosted listings are clearly and unambiguously labeled as advertisements, ensuring that consumers are fully informed of commercial influences on search visibility.
Regulatory Powers And Next Steps Under European Union Law
European Tech Commissioner Henna Virkkunen emphasized that European citizens must be able to book travel accommodations without the fear of encountering scams. Highlighting the legal framework, Commissioner Virkkunen noted that the Digital Services Act imposes clear responsibilities on digital platforms to address such risks, stating that authorities must ensure leading booking services take those obligations seriously.
The opening of formal proceedings does not establish a fixed legal deadline for completion. However, the procedural step grants the European Commission extended enforcement powers. As the investigation proceeds, the Commission holds the authority to adopt interim measures, issue non-compliance decisions carrying financial penalties, or accept formal commitments from Booking.com to rectify the identified issues. In response to the announcement, representatives for Booking.com stated that the company intends to fully cooperate with the European Commission throughout the course of the investigation.
