The European Commission has opened an investigation into whether Booking.com is doing enough to protect its users from fake listings, online scams and the theft of personal data. Announced on Wednesday, the investigation concerns the platform’s compliance with its obligations under the EU’s Digital Services Act (DSA).
Grounds for the investigation
According to the Commission, the decision follows a preliminary review and an assessment of the risk assessment reports Booking.com submitted this year and over the previous three years.
Fake properties and impersonation
A central focus of the investigation is misleading accommodation listings, including cases of properties that appear available to book but do not actually exist.
The Commission will also examine cases of fraud through impersonation, as well as accommodation offers that do not meet the required standards. The key question is whether Booking.com has effectively identified, assessed and addressed the systemic risks linked to these practices.
Phishing and booking data
Particular attention will be given to phishing scams, in which fraudsters try to obtain sensitive information or financial details from travellers.
According to the Commission, the investigation will specifically cover scams that exploit booking and guest data shared through the platform with accommodation providers.
Paid listings
Another area under scrutiny concerns paid listings that gain greater visibility in search results. The question is whether their promotional nature is labelled with sufficient clarity.
What the Digital Services Act requires
The Digital Services Act places stricter obligations on large online platforms to identify and tackle illegal content and risks that may affect their users.
Among other things, companies must assess the risks linked to the operation of their services and put in place effective measures to mitigate them.
If infringements are established, the legislation provides for fines of up to 6% of a company’s total worldwide annual turnover.
Booking.com’s response
Booking.com, which is part of the Booking Holdings group, said it is cooperating constructively with the European Commission in the process.
A company spokesperson said safety, trust and the protection of personal information are top priorities for Booking.com. The spokesperson added that the platform remains committed to working with governments, regulators, law enforcement and industry bodies to combat cybercrime and online fraud.
The Commission’s position
Henna Virkkunen, the European Commission Vice-President responsible for technology policy, said protecting travellers from scams is a fundamental obligation of online platforms.
She said Europeans should be able to book their holidays without fear of being defrauded. She added that the Digital Services Act clearly sets out companies’ responsibilities in the face of such risks. She also said the Commission must ensure that Europe’s leading booking platform takes these obligations with due seriousness.
