The European Commission has opened formal proceedings against Booking.com under the Digital Services Act, to assess whether it breached Articles 34 and 35 by not properly identifying, assessing or mitigating risks from fraudulent listings, including listings for non-existent properties and impersonation fraud, and from phishing scams that exploit reservation and guest data shared with accommodation providers and the design of its messaging service.
The proceedings also cover whether listings made more visible in return for a higher commission paid by accommodation providers are clearly identifiable as advertisements, as Article 26(1) requires users to be able to recognise. The Commission said opening the proceedings does not prejudge the outcome.
The step follows a preliminary investigation that included Booking.com’s risk assessment reports and its replies to formal requests for information sent on September 23, 2025 and May 26, 2026. Booking.com is a designated very large online platform under the Act, and Reuters reported that breaches can draw fines of up to 6 percent of global annual turnover, a figure that does not appear in the Commission release itself.
The case matters beyond travel. It tests how far the Act’s systemic risk duties reach into fraud that happens partly off platform, through messages and data shared with third party accommodation providers, and whether paid visibility in rankings counts as advertising that must be labelled as such.