The key facts

  • The EC is checking Booking.com's compliance with the DSA: fake listings, phishing, advertising transparency
  • Possible measures: interim decisions, non-compliance decisions, commitments or a fine of up to 6% of turnover
  • Booking.com says it is fully cooperating with the regulator

Formal proceedings under the DSA

The European Commission has opened formal proceedings against Booking.com to determine whether the platform violated the Digital Services Act (DSA) by insufficiently combating fraudulent listings, phishing schemes, and by failing to ensure advertising transparency. This is the first investigation of the service under this law, which regulates online platforms, including social networks and digital marketplaces.

Fake listings and advertising

The first part of the investigation concerns whether the platform identified and mitigated risks related to fake accommodation listings: non-existent properties, impersonation fraud, and offers that do not comply with the rules. The Commission will also check whether sufficient measures were taken to prevent such listings from appearing on the service. A separate issue is advertising labelling: according to the European Union, the company may have violated the rules by failing to mark as advertising those listings whose providers paid for a higher placement in search results.

Phishing and user data

The second focus is phishing attacks on Booking.com users using booking and guest data. The regulator will assess whether the platform adequately assessed risks when transferring booking information to hotels, how its messaging service is structured and operates, and whether there are sufficient safeguards against misuse of personal data for sending phishing messages and fraudulently obtaining payments.

Statements from the parties

European Commissioner for Digital Matters Henna Virkkunen stated: 'Europeans must be able to book a holiday without fear of falling victim to fraudsters,' adding that the DSA 'sets out clear obligations' and that it is necessary to make sure that Europe's leading booking platform takes them seriously. Booking.com said it is 'fully cooperating' with the investigation, calling security, trust, and the protection of personal data its priorities, and expressed its readiness to work with governments, regulators, law enforcement agencies, and industry partners to combat cybercrime and online fraud.

Possible consequences

The Commission stated that it will conduct an in-depth investigation as a matter of priority, gathering additional evidence through requests for information, interviews, and inspections. Possible measures include interim measures, non-compliance decisions, or the acceptance of commitments from Booking.com. If DSA violations are confirmed, the company faces a fine of up to 6% of its global annual turnover.