NEWS: EU Opens Formal DSA Investigation into Booking.com Over Scam, Phishing and Ad Transparency Risks
Commission probes whether the travel platform failed to adequately assess and mitigate fraud affecting consumers; fines could reach 6% of global turnover
BRUSSELS – The European Commission has opened formal proceedings against Booking.com to determine whether the online travel agency breached the EU's Digital Services Act (DSA) "by not having diligently assessed or effectively mitigated risks related to fraudulent listings and phishing scams."
Background to the decision
The move follows a preliminary investigation in which the Commission reviewed Booking.com's risk assessment reports for 2023, 2024, 2025 and 2026, along with its transparency reports and its responses to Commission requests for information in September 2025 and May 2026.
The DSA sets rules for how online platforms operating in the EU handle illegal content, manipulative tactics and other systemic risks. Stricter obligations apply to very large online platforms (VLOPs), a designation Booking.com received in April 2023. Large platforms found in breach can be fined up to 6% of their global annual turnover.
Scope of the investigation
The Commission will examine three areas:
Fraudulent listings: Fake listings, including those for non-existent properties, impersonation fraud and non-compliant accommodation offers. The Commission will assess whether Booking.com has "effective measures" in place to mitigate the risk to consumers.
Phishing scams: How reservation and guest data is shared with accommodation providers, and how Booking.com's messaging services are used, with a focus on the company's efforts to reduce phishing risk.
Advertising transparency: Whether Booking.com meets the DSA requirement that users can "clearly recognize" an advertisement. The Commission will evaluate how easily users can tell whether something is an ad and how they can change their settings on which ads they see.
On advertising, the Commission said: "Under the DSA, users are entitled to understand when, and on whose behalf, an ad is shown to them. Without this, they cannot tell whether a listing appears prominently because it matches their search or because the accommodation provider paid for that visibility."
Possible outcomes
The Commission said it is still gathering evidence. Opening formal proceedings allows it to impose interim measures before the investigation concludes and/or to find that Booking.com violated the DSA. Booking.com may also settle the matter without a ruling by offering commitments to address the identified problems.
Official statements
Henna Virkkunen, European Commission Executive Vice-President for tech sovereignty, security and democracy, said: "Europeans should be able to book their holidays without fear of being scammed. The Digital Services Act sets clear responsibilities on platforms to address these risks, and we must ensure that the leading booking platform in Europe takes those responsibilities seriously."
In a statement to PhocusWire, a Booking.com spokesperson said the company is "cooperating fully" with the Commission and "engaging constructively on its questions under the DSA."
The spokesperson added: "Security, trust and the protection of personal information are top priorities at Booking.com. We remain committed to working with relevant governments, regulators, law enforcement and industry partners to combat cybercrime and online fraud and protect travelers and partners."
Wider context
In April, Booking.com confirmed that unauthorized parties had accessed customer information including names, email addresses, phone numbers and booking details. The company said it acted to contain the breach once discovered, updating PINs for affected reservations and informing guests.
