EU Opens DSA Case Into Booking.com Scams and Ads

Brussels wants to know whether Booking.com has done enough to stop fake properties appearing on its site and to protect guests from scammers who exploit their own reservation details. The European Commission opened formal proceedings against the travel platform under the Digital Services Act (DSA) on Wednesday. It is also examining whether listings that hosts pay to promote are clearly labelled as advertising.

This is the start of a case, not its end. In its full press release the Commission says opening proceedings “does not prejudge any final outcome or decision”, and it has not found that Booking.com broke the law. What the case tests is one of the DSA’s central duties for the largest platforms: to spot the systemic risks their services create and to do something effective about them.

The phishing strand goes to how hosts and guests talk

The Commission sets out three areas of concern. The first is fraudulent and non-compliant listings, such as non-existent properties, impersonation fraud and accommodation offers that break the rules. Investigators will look at whether Booking.com properly identified those risks and whether it removes such listings effectively.

The second, and the most familiar to travellers, is phishing. The Commission will look at the risks created by the way reservation and guest data is shared with accommodation providers, and at the design and workings of Booking.com’s messaging service. It will also ask whether there are enough safeguards to stop that data being misused to send phishing messages and to ask for fraudulent payments.

“Europeans should be able to book their holidays without fear of being scammed,” said Henna Virkkunen, the Commission’s executive vice-president for tech sovereignty, security and democracy. She added that the Commission “must ensure that the leading booking platform in Europe takes those responsibilities seriously”.

Paying for prominence may need an ad label

The third strand is about money. Accommodation providers can make their listings more visible in Booking.com’s search results by paying a higher commission, the Commission says. Under the DSA, users should be able to see that these “boosted listings” are adverts, and who paid for each one, why they are seeing it and how to change the settings behind it.

If the suspicions were proven, they would breach Articles 34 and 35 of the DSA, which oblige very large online platforms to assess and mitigate systemic risks, and Article 26(1), which requires adverts to be clearly identifiable. Booking.com was designated a very large online platform on 25 April 2023.

The Commission has been looking at Booking.com for some time. It says the case follows a preliminary investigation that drew on Booking.com’s risk assessment reports for 2026 and the three years before, its transparency reports, and its answers to formal requests for information sent on 23 September 2025 and 26 May 2026. The Dutch Authority for Consumers and Markets, which supervises Booking.com under the DSA because the company is based in the Netherlands, is working with the Commission.

A fine is possible, but the case has only just begun

Platforms that breach the DSA risk fines of up to 6% of global annual turnover, Reuters reported. No penalty has been proposed here. For now the Commission says it will gather more evidence through further information requests, interviews or inspections. Formal proceedings also let it impose interim measures, adopt a non-compliance decision or accept commitments from Booking.com to fix the problems.

Booking.com said it was engaging constructively with the Commission, according to Reuters. “Security, trust and the protection of personal information are top priorities at Booking.com,” a spokesperson said, adding that the company remains committed to working with governments, regulators, law enforcement and industry partners “to combat cybercrime and online fraud”.

The DSA is EU law, so this case is about Booking.com’s service in the bloc. In Britain, online platforms answer to Ofcom under the Online Safety Act, and its chief executive told MPs this week that nine of the 11 fines it has issued remain unpaid.

The Commission has set no timetable. The next sign of direction will be whether Booking.com offers commitments to change how hosts reach guests and how boosted listings are labelled, or whether Brussels reaches for interim measures first.